Is Copilot Safe for Confidential Information? Consumer Copilot vs Microsoft 365 Copilot

Is Copilot safe for confidential information? On a work or school account, largely yes. Microsoft Copilot Chat and the licensed Microsoft 365 Copilot run under Microsoft's data protection addendum, prompts are not used to train foundation models, and your existing permissions and labels apply. A personal Copilot account gives your employer no contract, logs or control. The larger risk is oversharing: licensed Copilot can surface anything a user is already allowed to open.

Copilot is not one product. Microsoft offers a consumer Copilot app for personal Microsoft accounts, includes Copilot Chat at no extra cost with qualifying work and school subscriptions, and sells Microsoft 365 Copilot as a per-user licence that reads mail, chats, meetings and files through Microsoft Graph. Microsoft has since renamed the last two Microsoft Copilot Chat and Microsoft Copilot, and says some experiences and licences may keep the old names during the transition.

The documentation below was checked on 14 October 2026 on Microsoft Learn, Microsoft Support, the Microsoft Security Response Center and the US National Vulnerability Database. Our ChatGPT confidentiality guide answers the same question for OpenAI’s plans, and the shadow AI explainer covers the personal-account problem that sits underneath all of them.

Which Copilot are you using?

The sign-in account decides which terms apply. Microsoft documents four cases:

The two work rows share one contract but differ in reach. Copilot Chat answers from the web and from what a user brings in: pasted text, an uploaded file, an open document, the mailbox in Outlook, or an agent connected to tenant data. Licensed Copilot adds semantic indexing across everything the user can access, which is where both its value and most of its risk come from.

Is Microsoft Copilot safe for confidential information on a work account?

Microsoft calls the protections for work and school sign-ins enterprise data protection. They are not a separate promise: prompts and responses fall under the same Data Protection Addendum and Product Terms that cover mail in Exchange and files in SharePoint, with Microsoft acting as a data processor. Microsoft’s pages commit to the following:

• No training on your content. Prompts, responses and data accessed through Microsoft Graph aren’t used to train foundation models, including the ones Copilot runs on. Optional feedback can improve Copilot, but not those models.
• No human abuse review. Azure OpenAI offers abuse monitoring that includes human review of content; Microsoft says Copilot services have opted out of it.
• Your policies travel with the data. Copilot inherits sensitivity labels, Purview retention policies apply to Copilot interactions, and prompts and responses are stored in the tenant where audit and eDiscovery searches can reach them.
• Encryption and tenant isolation. Content is encrypted at rest and in transit, and tenants are isolated through Entra authorisation and role-based access control.
• Regulated data, with limits. Microsoft says Copilot and Copilot Chat support HIPAA compliance under a business associate agreement for properly configured implementations, and lists GDPR, ISO/IEC 27001 and ISO/IEC 42001 among Copilot’s compliance offerings. Web search queries sit outside both the DPA and the BAA.

For most confidential business information that is a sound processor arrangement, as long as staff stay in the work account. What can still make it unsafe comes next: your own permissions, routes out of the boundary, and attacks on Copilot itself.

Is Microsoft 365 Copilot safe? It depends on your permissions

Microsoft’s rule for licensed Copilot is that it only surfaces organisational data to which the individual user has at least view permission. By design, it widens nobody’s access. The trouble is how much access a typical tenant grants unnoticed: sites shared with the whole company, teams nobody pruned, files shared by link years ago. Copilot can find and summarise that material for people who would never have gone looking.

Microsoft’s own tooling for the problem:

• Encryption that Copilot honours. When a sensitivity label or rights management applies encryption, a user needs both the VIEW and EXTRACT usage rights before Copilot will return the content.
• DLP rules for Copilot. In Purview data loss prevention, the Microsoft 365 Copilot and Copilot Chat location can stop Copilot from using the content of files and emails with chosen labels (they may still appear as citations), refuse prompts containing sensitive information types such as passport or card numbers (in preview), skip web search for such prompts, and exclude email from outside your accepted domains (in preview). Two limits apply: DLP checks typed prompt text but cannot scan files uploaded into a prompt, and a policy change can take up to four hours to reach Copilot.
• Restricted Content Discovery. This SharePoint Advanced Management setting keeps chosen sites out of organisation-wide search and Copilot while owners review access. It changes discoverability, not permissions, so anyone with rights can still open the files. It needs a Copilot licence, and Microsoft notes that a site with more than 500,000 items can take over a week to process.
• Finding the problem. Data Access Governance reports in SharePoint and Data Security Posture Management in Purview show where sharing is broadest, so start the review there.

Where prompts can leave the Microsoft 365 boundary

Four routes take Copilot data outside the commitments above. Each one has an admin control.

Web search. With web grounding on, Copilot sends Bing a few words generated from the prompt, stripped of user and tenant identifiers. Microsoft handles those queries as an independent controller, outside the DPA, the BAA and the EU Data Boundary. Its own example shows why that matters: a prompt about a possible acquisition of a named company becomes a search for that company’s strategy and financials. The Allow web search in Copilot policy turns it off for everyone or for chosen groups.

Anthropic models. Copilot, Researcher, Copilot Studio and the Office apps can use Claude models, with Anthropic as a Microsoft subprocessor. They are on by default for most commercial tenants outside the EU, EFTA and UK, and excluded from the EU Data Boundary. Models labelled as having data retention, such as Claude Fable 5 and Claude Mythos 5, stay off until an admin opts in; once enabled, Anthropic stores most inputs and outputs for up to 30 days under its own terms rather than Microsoft’s DPA. Our Claude guide covers Anthropic’s side.

Agents and connectors. A third-party agent handles your data under its own privacy statement and terms of use. In the Integrated apps section of the Microsoft 365 admin center, admins can see the permissions and data access each agent requires and decide which agents are allowed.

Flex routing in the EU. EU and EFTA tenants can allow inference in the United States, Canada or Australia during peak demand. Microsoft documents the setting as on by default for eligible tenants created after 25 March 2026; the flex routing explainer gives the path to switch it off.

Is Copilot secure for confidential information? Prompt injection and EchoLeak

Permissions and contracts govern what Copilot may do. Prompt injection concerns what an attacker can make it do with the access it already holds, by hiding instructions in an email, a document or a web page that Copilot later reads.

The best-known case is EchoLeak, tracked as CVE-2025-32711 and published by Microsoft on 11 June 2025. Microsoft described it as AI command injection in Microsoft 365 Copilot that let an unauthorised attacker disclose information over a network, and scored it 9.3, critical, with a vector requiring no privileges and no user interaction; NIST’s own assessment is 7.5, high. The Microsoft Security Response Center says the flaw was fully mitigated in the service and that users had no action to take, and lists it as not exploited.

EchoLeak was not a one-off. Searching the National Vulnerability Database for “M365 Copilot” on 14 October 2026 returned 16 further CVEs published between January and September 2026, half of them command injection flaws. Two that we checked on MSRC, CVE-2026-24307 (information disclosure, 9.3) and CVE-2026-85885 (elevation of privilege, 9.9), were likewise fully mitigated by Microsoft, needed no customer action and were not marked as exploited.

The pattern cuts both ways. A cloud service gets patched without you lifting a finger, but every fix follows a period in which the flaw was live, and what an attacker could reach during that window depended on your permissions. Least-privilege sharing, the DLP rule that keeps external email out of grounding, and a short list of approved connectors all shrink the next incident.

Is Copilot safe to use for confidential information on a personal account?

No, not for anything that belongs to your employer or your clients, even though Microsoft has tightened its consumer terms.

• Training. Microsoft released an updated Copilot app on 18 August 2026, and its support page says prompts, responses and file contents in that app aren’t used to train foundation models. The privacy FAQ for the older app, which still applies to anyone who hasn’t updated, describes the opposite default: conversations used for AI training unless the user opts out.
• Retention and review. That older FAQ keeps conversation activity for 18 months by default and allows automated and human review, with no opt-out from human review. The updated app’s pages give no retention period.
• No company control. A personal account runs under consumer terms between the individual and Microsoft. Your organisation has no data processing agreement covering it, no audit trail, no retention setting and no way to search or delete what was shared.

Because one Copilot app accepts both account types, the slip is often accidental. Microsoft marks the work experience with a different background colour, a “Work” label and a green data protection shield, and Tenant Restrictions v2 in Entra lets admins manage whether personal accounts can sign in.

GitHub Copilot is a separate product with terms set by GitHub, not Microsoft 365. Since 24 April 2026, GitHub has used interaction data from Copilot Free, Pro and Pro+ users, code snippets included, to train its models unless the user opts out under Privacy in their Copilot settings; Business and Enterprise plans are not affected, as GitHub’s announcement explains.

Settings that decide whether Copilot is safe for your data

A practical order of work for admins, using Microsoft’s own controls:

1. Settle the account question. Work data goes only into Copilot signed in with a work account; put the rule in your acceptable-use policy and enforce it with Tenant Restrictions v2.
2. Find the oversharing before you license. Run Data Access Governance reports, then restrict discovery of the riskiest sites while owners clean up:

# Keep a site out of organisation-wide search and Copilot (permissions are unchanged)
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/finance -RestrictContentOrgWideSearch $true

# Confirm the setting
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/finance | Select RestrictContentOrgWideSearch

3. Encrypt what must stay narrow. Apply sensitivity labels with encryption to the documents that matter most, so Copilot checks VIEW and EXTRACT rights before using them.
4. Add Copilot DLP rules. Create a custom Purview DLP policy for the Microsoft 365 Copilot and Copilot Chat location, with separate rules for sensitivity labels and for sensitive information types, because one rule cannot combine both conditions.
5. Decide on web search per group with the Allow web search in Copilot policy. Disabling optional connected experiences also stops it, but takes other Microsoft 365 features with it.
6. Decide on Anthropic under AI providers operating as Microsoft subprocessors, and leave models with data retention off unless legal has accepted Anthropic’s terms.
7. Check flex routing if your tenant sits in the EU or EFTA.
8. Retain and review. Set Purview retention for Copilot interactions, search the audit log on a schedule and prune the agents allowed in Integrated apps. For other AI sites, Purview endpoint DLP on onboarded Windows devices can block pasting sensitive information into them.

When confidential data should not go into Copilot at all

Microsoft’s terms make Copilot a reasonable processor for most business information. They do not change where the work happens: prompts, grounding content and answers are processed in Microsoft’s cloud. Keep a data class out of Copilot when:

• a client contract, regulator or internal classification rule forbids processing by a third-party cloud provider;
• you have to prove where inference ran, not only where data was stored;
• the content is privileged, export-controlled or controlled unclassified information;
• the network has no route to the internet.

For those classes, the model, the retrieval index and the logs have to sit on infrastructure you operate. Settings also leave ownership open: who approves an agent, a connector or a scheduled workflow is the Copilot governance gap that tenant switches alone do not close. The self-hosted Copilot route and our Microsoft 365 Copilot pricing comparison cover the other option and its cost.

How VDF AI fits

VDF AI is a self-hosted platform for AI chat, private retrieval over company documents and governed agents, deployed on-premises, in a private cloud or fully air-gapped. For the data classes above, inference, indexes and audit logs stay on servers you operate, and VDF AI Router has an air-gap mode that keeps every request on local models.

It is built to sit beside Microsoft 365 rather than replace it: Copilot for everyday drafting and meetings, VDF AI Chat and governed agents for work that a contract or regulator keeps in-house. On-premises deployments sign users in through native Microsoft Entra ID single sign-on, mapping Entra security groups to VDF AI roles, so the identity model your Copilot rollout depends on carries over. Role-based access control decides who can use which agent, and because the platform runs inside your environment, your own security controls cover it.