Skip to content
Zrico
Menu

For every firm

Is Microsoft Copilot Safe for Client Data?

What Microsoft's docs say about Copilot Chat and Microsoft 365 Copilot: what it can see, training, where data is processed, Anthropic models and retention.

Updated 7 min read

Many law and accounting firms already run on Microsoft 365, so Copilot is often the first AI tool staff reach for. Whether it is safe for client data depends on which Copilot you mean, how your tenant is set up, and what your professional rules require. This guide sets out what Microsoft’s own documentation says, as checked in October 2026. For OpenAI’s products, see Is ChatGPT safe for client data?

Three things called Copilot

Microsoft 365 Copilot is now called Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. Microsoft says the renaming changed nothing about security, compliance or privacy. There is also a consumer Copilot for personal Microsoft accounts. In this guide:

  • Copilot Chat is the chat experience included with eligible Microsoft 365 licenses at no extra cost.
  • Licensed Copilot is the paid add-on, formerly Microsoft 365 Copilot.
  • Consumer Copilot is what you get when signed in with a personal Microsoft account.

What each one can reach

Copilot Chat mainly draws on the web. It sees organizational content only when a user supplies it: pasting text, uploading a file, working on an open Word, Excel or PowerPoint file, or using an agent that has access. In Outlook, Copilot Chat can also draw on the user’s email, calendar, meetings, chats and a limited set of files, even without a paid license.

Licensed Copilot goes much further. It reaches across Microsoft Graph, which connects emails, meetings, chats, documents, SharePoint sites and other Microsoft 365 content, and it uses a semantic index to find relevant material.

Permissions are the real boundary

Microsoft says Copilot “only surfaces organizational data to which individual users have at least view permissions”, and that you should use the permission models in services such as SharePoint so the right people have access to the right content. That includes outside people you have given access, for example through shared channels in Teams.

This is where the risk sits for a firm. Copilot does not break your permissions, but it makes them matter more. If a client folder is open to everyone in the firm, or a former matter team still has access, Copilot can bring that content into their answers. A file nobody would find by browsing becomes easy to find by asking.

Microsoft publishes a blueprint for fixing oversharing with Microsoft Purview and SharePoint Advanced Management, which it says comes with a Copilot license. Sensitivity labels also help: when content is encrypted through labels or Information Rights Management, Microsoft says Copilot honors the usage rights granted to the user.

Training and the contract

Microsoft’s privacy page says prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models, including those used by Copilot. Optional feedback may be used to improve Copilot, but not to train those models, and admins can manage feedback.

For work and school accounts, Microsoft calls its commitments “enterprise data protection”. It says Copilot and Copilot Chat are covered by the Microsoft Data Protection Addendum and Product Terms, with Microsoft acting as a data processor. Copilot Chat shows a green shield when this protection applies. Microsoft also says Copilot has opted out of Azure OpenAI’s abuse monitoring, which includes human review of content.

Web search is handled differently. When Copilot searches the web, it sends Bing a short query of a few words, without user or tenant identifiers. Bing operates outside Microsoft 365, with Microsoft acting as a data controller, and the DPA, HIPAA coverage and the EU Data Boundary do not apply to these queries. The Product Terms add commitments instead: the queries are not used to improve Bing, shared with advertisers or used to train foundation models, and are treated as confidential. Admins can turn web search off for some or all users with the “Allow web search in Copilot” policy.

Where data is processed

Microsoft says Copilot calls to the model go to the closest data centers, but can go to other regions when capacity is short. For EU users, traffic stays within the EU Data Boundary. For customers outside the EU, Microsoft says queries “may be processed in the US, EU, or other regions”.

Residency commitments for stored data are in the Product Terms and DPA, and the Advanced Data Residency and Multi-Geo add-ons cover Copilot. A US firm should not assume processing stays in the US unless its agreements say so.

Anthropic models

Microsoft now offers Anthropic’s Claude models inside Copilot, with Anthropic acting as a Microsoft subprocessor. Microsoft’s page, updated September 18, 2026, says:

  • Anthropic models are on by default for most commercial cloud customers. They are off by default in the EU, EFTA countries and the UK.
  • They are used in Microsoft Copilot, Researcher, Copilot Studio, Power Platform and Copilot in Microsoft 365 apps. In the Copilot app, the interface shows when Claude is in use.
  • Microsoft’s Product Terms and DPA apply to them.
  • They are excluded from the EU Data Boundary and, where applicable, from in-country processing commitments.
  • An AI Administrator or Global Administrator can turn Anthropic off, or limit it to chosen users or groups. Some features only work when it is on.

A separate category, “Anthropic models with Data Retention”, is off by default everywhere and needs its own opt-in. For these, Microsoft says Anthropic acts under its own terms, outside Microsoft’s DPA, and stores most inputs and outputs for up to 30 days. Microsoft also lists OpenAI as a subprocessor for some Copilot experiences.

Retention and eDiscovery

Copilot keeps a record of each interaction: the prompt, the response and citations. Microsoft says this data is encrypted and stored under the same commitments as your other Microsoft 365 content. Admins manage it through Microsoft Purview, whose documentation says:

  • Copilot messages are stored in a hidden folder in the user’s Exchange mailbox, and eDiscovery tools can search them.
  • Retention policies can keep or delete them, though even a one-day delete policy can take about 16 days to finish.
  • A litigation hold or eDiscovery hold suspends deletion.
  • When an employee leaves and their account is deleted, messages under retention move to an inactive mailbox and stay searchable.

The practical point: Copilot conversations are records that can be preserved, searched and produced like email.

Consumer Copilot is a different product

Microsoft’s privacy FAQ for consumer Copilot says it does not apply to Copilot used with a work account signed in through Entra ID. Under that FAQ, Microsoft uses data from Copilot conversations to train its generative AI models unless you opt out, stores conversation activity for 18 months by default, and says you should not provide confidential or sensitive personal data. Microsoft now marks that FAQ as covering the older Copilot app, and we could not load the page it points to for the new app, so check the current terms.

People with Microsoft 365 Personal, Family or Premium can also use their Copilot on work files. Microsoft says file access is then tied to the work account, so enterprise data protection applies to the firm’s files, and admins can turn this off. The rule for a firm is simple: client work belongs under the firm’s work accounts.

What a firm should check

  1. Accounts. Require work accounts for any client work, check for the green shield in Copilot Chat, and decide whether to allow personal Microsoft 365 Copilot on work files.
  2. SharePoint, OneDrive and Teams permissions. Before buying licensed Copilot, review who can open each client or matter site. Remove “everyone” links and stale access. This is also how you keep one client’s material out of another client’s work.
  3. Sensitivity labels. Label and encrypt privileged and highly confidential material so Copilot honors the restrictions.
  4. Web search. Decide whether staff may use it on client matters, since Bing queries sit outside the DPA, and set the admin policy to match.
  5. Model providers. Decide whether Anthropic models should be on, and leave “Anthropic models with Data Retention” off unless you have reviewed Anthropic’s terms.
  6. Retention. Set Purview retention for Copilot interactions to match your records policy, and include them in your litigation hold process.
  7. Client consent. ABA Formal Opinion 512 asks lawyers to assess disclosure risk and read the tool’s terms, and requires informed consent before using a self-learning tool. The AICPA Code asks accountants for a confidentiality agreement with the provider or the client’s specific consent. See our ABA 512 checklist and AICPA guide.

To compare Copilot with ChatGPT Business and other options, see how Zrico compares.

How Zrico fits

Zrico gives each firm its own private workspace, with its own application and databases. Claude is the default and is processed only in the US. GPT and Gemini are off unless the firm owner turns them on, and their processing is not limited to the US. No AI provider trains on prompts, files or answers. Sign-in is invite-only with two-factor authentication, required for admins, and the owner gets a usage and audit report and retention settings. It costs $39 per seat per month, with a 5-seat minimum and a 30-day free trial. Microsoft 365 sign-in and client-name masking are coming soon. Zrico has no SOC 2, ISO or HIPAA certification, does not make a firm compliant, and its output must be reviewed by a professional.

Sources

General information, not legal advice. Microsoft updates these pages often, so check the current versions and your jurisdiction’s rules.

Give your firm a private place to use AI.

$39 per seat per month after a 30-day free trial, 5-seat minimum. Your workspace is ready minutes after you sign up.

Your card is charged when the trial ends. Cancel any time before then and you pay nothing.

Start 30-day free trial