Is Microsoft Copilot safe for confidential information?

Microsoft renamed its workplace products in 2026: Microsoft 365 Copilot is now Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. Microsoft says the rename changes nothing about security, compliance or privacy. The account you sign in with decides which terms apply.

For work accounts, Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models, and that Copilot Chat does not use your data to train them either. Optional feedback can be used to improve Copilot, and admins can manage it.

For personal accounts, Microsoft's pages are in transition. The privacy FAQ for the older Copilot app says Microsoft uses Copilot conversation activity for AI training unless you opt out, keeps conversations for 18 months by default, and subjects some conversations to automated and human review. The page for the updated app, available from 18 August 2026 and used on the web, says prompts, responses and file contents are not used to train foundation models. Which statement applies depends on the version in use, which is one more reason to keep confidential material off personal accounts.

Microsoft Copilot only surfaces organisational data that the user has at least view permission for. That is the right design, and it means Copilot is exactly as confidential as your sharing settings. A contract saved to a site that the whole company can read, a folder shared with everyone during a project years ago, or a link set to anyone in the organisation all become answerable questions for every person with access.

Microsoft's own deployment guidance starts with fixing oversharing before rollout, and notes that SharePoint's default sharing setting is the most permissive option. Its Restricted Content Discovery feature can keep sites out of Copilot while access is reviewed, but Microsoft describes it as a temporary control that does not change existing permissions.

Prompts and responses for work accounts are processed and stored in line with Microsoft's commitments for your other Microsoft 365 content. Web search is the exception to watch. When Copilot searches the web, it sends Bing a generated query of a few words informed by the prompt, and Microsoft states that its Data Protection Addendum and the EU Data Boundary do not apply to those queries. Admins can turn web search off.

Third-party models are the other one. Microsoft offers models from Anthropic and OpenAI inside Copilot, and admins decide whether to turn them on. Microsoft says Anthropic models, which run with Anthropic as a subprocessor, are currently outside the EU Data Boundary, so check which models your tenant allows before relying on that boundary.

On human review, Microsoft says Copilot services have opted out of the abuse monitoring that includes human review of content in Azure OpenAI. For UK tenants, Microsoft commits to storing Copilot and Copilot Chat interaction content at rest in the UK where the tenant's default geography is the UK. Processing inside the UK is a separate matter: Microsoft has said local processing for Copilot interactions is expected by the end of 2026.

The Solicitors Regulation Authority's warning notice on the misuse of AI, published on 17 August 2026, says client information should only go into AI systems where appropriate contractual, technical and organisational safeguards are in place, and that free and paid tools can both put confidentiality at risk depending on the provider's terms and settings. A work Copilot with enterprise data protection addresses the contractual part. The technical and organisational parts, including who can open which file, remain the organisation's job.

These are worth answering in writing before Copilot goes to people who handle confidential material.

For everyday work in Office documents and email, a work Copilot with tidy permissions is a reasonable choice for many organisations. The case changes when a team needs answers across a specific body of confidential documents, such as a set of matter files, a policy library or a deal room, and needs to show the source behind each answer.

Marella is built for that job. It answers questions over a corpus built from the documents you connect, rather than everything a user can open across Microsoft 365, and connects natively to SharePoint, OneDrive and Teams. It cites the exact passage behind each answer and fact-checks answers against their sources, flagging inaccurate citations and unsupported claims.