Copilot is safe enough for everyday business work if you're signed in with a work or school account: Microsoft says your prompts and files aren't used to train its models and Copilot only shows you data you already have permission to see. The personal version is a different deal, because your chats are kept for 18 months by default and can be used for training unless you switch that off.
So the honest answer to "is Copilot safe" is another question: safe for what, and on which account? Microsoft has built it to respect permissions and to keep work data inside its service boundary. It can't fix messy file sharing for you, and it can't stop someone pasting a client contract into the wrong app. That part is still on you.
Work and school accounts: what Microsoft commits to
Microsoft's privacy page for the work version makes three statements that matter most to a business owner. First, "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot." Second, Copilot "only surfaces organizational data to which individual users have at least view permissions." Third, it says Copilot is compliant with its existing commitments to commercial customers, including GDPR and the EU Data Boundary.
It also lists the protections running underneath: blocking harmful content, detecting protected material such as copyrighted text and licensed code, and blocking prompt injections, which Microsoft calls jailbreak attacks. Microsoft adds that its Copilot services have opted out of the human abuse-monitoring review that's available in Azure OpenAI.
If your team uses the free Copilot Chat with a work account (here's what Copilot Chat includes without a licence), Microsoft says prompts and responses are processed within the Microsoft 365 service boundary with enterprise data protection, at no extra cost. You'll know it's on because there's a green shield at the top of the screen next to the New Chat button. No shield means no enterprise protection, so don't treat that chat as private work space.
The catch most people miss: web searches go to Bing
When web grounding is on, Copilot doesn't send your whole prompt to the web. It writes a short search query of a few words and sends that to Bing. Microsoft is upfront that "The Bing search service operates separately from Microsoft 365 and has different data-handling practices." Those queries fall under the Microsoft Services Agreement and the Privacy Statement, not your organisation's data protection terms, and Microsoft says web search queries sent to Bing aren't covered by the EU Data Boundary.
Microsoft's own example makes this concrete. Ask about a possible acquisition of a company called Fabrikam and the queries sent out are "Fabrikam strategy" and "Fabrikam financials". No usernames, tenant IDs or full files go with them, and Microsoft says the queries aren't shared with advertisers. Still, the subject of your question leaves the building. If the name of a deal or a client is itself confidential, think about that before you ask.
Microsoft also offers third-party models from Anthropic and OpenAI inside Copilot. Your admin decides whether to use them, and Microsoft notes that additional terms may apply and that Anthropic models are currently excluded from the EU Data Boundary.
Personal accounts: the controls you have
The consumer Copilot you sign into with a personal Microsoft account plays by different rules. Microsoft's privacy controls page says you decide whether it can personalise your experience and remember things, whether your conversation activity trains its models, and whether you see personalised ads. It also confirms the retention point: "By default, we store conversation activity for 18 months."
| Account type | Training on your chats | History kept | What you can change |
|---|---|---|---|
| Work or school (Entra ID) | Not used to train foundation models, as Microsoft states | Set by your organisation's retention policies | Mostly admin settings; you can delete your own activity history |
| Copilot Chat on a work account | Not used to train foundation models | Logged for audit under your organisation's policies | Check for the green shield before sharing work content |
| Personal Microsoft account | Used unless you opt out | 18 months by default | Training, personalisation and memory, ads, and deleting history |
Here's the route to switch training off, using the menu names Microsoft documents for the older Copilot app. Microsoft released an updated app on 18 August 2026 and its support page says those paths apply only to the older version, so as of October 2026 your screen may look a little different.
- On copilot.com, select your profile icon, then your profile name.
- Go to Privacy and turn off Training on conversation activity.
- In the same place, turn off Training on voice conversations if you use voice.
- In Copilot for Windows or macOS, the path is profile icon, then Settings, then Privacy. In the mobile app, open the menu, select your profile icon, then Account, then Privacy.
- To stop Copilot remembering things, go to Memory, then Personalization and memory, and switch it off.
- For ads, open your Microsoft personalised ad settings and switch off See ads that interest you.
Opting out of training only covers your future conversations. Microsoft says it doesn't stop your chats being used for general product improvements, safety, security and compliance, as set out in its Privacy Statement.
Files, screenshots and how long they stay
If you upload a file to personal Copilot and ask for a summary, Microsoft says the file is stored securely for a short time, no longer than 18 months, and then automatically deleted. The file and your conversation about it are treated like any other chat, so your training setting applies to them too.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Copilot Vision is handled differently. Microsoft says screenshots and camera images you share with Vision aren't stored after your session ends and aren't used to train models, though text transcripts may be saved and you can delete those. Microsoft also says it doesn't train on data from signed-in users under 18, and that it doesn't train on Copilot use inside Microsoft 365 apps on Personal or Family subscriptions either.
The privacy FAQ is blunt on one point, and I agree with it: you shouldn't give Copilot confidential or sensitive personal data you wouldn't want Microsoft to use for the purposes in its FAQ and Privacy Statement.
Your own file permissions are the bigger risk
This is my view, not Microsoft's wording. Because Copilot respects permissions, the danger on a work account usually isn't Copilot itself. It's the SharePoint site shared with everyone years ago, the salary spreadsheet in a public team folder, the guest who still has access to a shared channel. Copilot won't break those permissions, but it will happily surface what they already allow. Microsoft's own advice is to use the permission models in SharePoint and the rest of Microsoft 365 to make sure the right people have the right access.
And don't treat answers as gospel. Microsoft's Copilot Chat FAQ says Copilot can occasionally make mistakes and shows references so you can check. Use the thumbs down button to report anything wrong or harmful. If you'd rather not have it in your apps at all, here's how to switch Copilot off, and for the bigger picture of the different versions, see my guide to Microsoft 365 Copilot.
My verdict
I'd happily use Copilot on a work account with the green shield showing, once someone has tidied up who can see what in SharePoint. On a personal account, I'd turn off training and personalisation for anything private, and skip pasting client confidential data into the personal version altogether. It's a useful tool. It isn't a vault.
If you need a plain-English view of what your team can safely put into Copilot, that's the kind of AI enablement I help with. I run AI training and workshops for teams, and help businesses with AI enablement and workflow automation, so the busywork runs itself and people get time back. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
Does Microsoft train its AI on my Copilot chats?
On a work or school account, no: Microsoft says prompts, responses and data accessed through Microsoft Graph aren't used to train foundation models. On a personal Microsoft account, your conversation activity can be used for training unless you opt out in the Privacy settings.
Can Copilot see files I'm not allowed to open?
Microsoft says Copilot only surfaces organisational data that each user already has at least view permission for. It can't open a file you couldn't open yourself, but it can find a badly shared file much faster than you would.
How long does Copilot keep my conversations?
For personal accounts, Microsoft's privacy FAQ says conversation activity is stored for 18 months by default, and you can delete single conversations or the whole history at any time. Work accounts follow your organisation's retention policies instead.
Is the green shield in Copilot Chat important?
Yes. Microsoft says the green shield next to the New Chat button shows that enterprise data protection is applied to your prompts and responses. If you're signed in with a work account and can't see it, ask your IT team before you paste in anything sensitive.
