Vendors · AI applications · Microsoft Copilot

Microsoft Copilot prompts train no foundation model, Microsoft says

Microsoft Copilot for work, formerly Microsoft 365 Copilot. Each line below quotes Microsoft Copilot’s own pages as kept on 26 Oct 2026.

Microsoft Copilot’s questionnaire: nine buyer questions, each answered from these pages.

Microsoft Copilot’s record as an AI bill of materials: CycloneDX · SPDX. Not signed.

What the pages say

each value, then the words it is read from
Training on business and API data
Not used to train foundation LLMs

Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.

Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb

How long API data is kept
Stored with the organization’s Microsoft 365 content; admins set retention

When you enter prompts using Microsoft Copilot, the information contained within your prompts, the data they retrieve, and the generated responses are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365.

The page adds: “Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.” Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb

Option to keep no data
Not stated in the pages kept
Searched: Data, Privacy, and Security for Microsoft Copilot.
Where data is processed and stored
EU traffic stays in the EU Data Boundary, except on Anthropic models

EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.

The next line reads: “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.” Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb

Sub-processors
Names Anthropic and OpenAI as subprocessors for their models

For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services. For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services.

Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb

Certifications and audits
ISO 27001 and ISO 42001, listed beside GDPR and HIPAA

Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.

Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb

Data processing agreement
The Microsoft Product Terms and Data Protection Addendum, named for data residency

Microsoft Copilot is upholding data residency commitments as outlined in the Microsoft Product Terms and Data Protection Addendum.

Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb

Published usage limits
Not stated in the pages kept
Searched: Data, Privacy, and Security for Microsoft Copilot.

Pages kept

each copy is held with the sha256 of its bytes as served
Page The page’s date Newest copy Checks
Data, Privacy, and Security for Microsoft CopilotTraining, storage, residency, subprocessors and certifications Last updated on 2026-08-18 26 Oct 2026, 77 KBsha256 d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c
  • 26 Oct 2026: kept

No kept page of Microsoft Copilot has changed

first kept on 26 Oct 2026

Sources

vendors.csv Every dataset → Status → Glossary →