- Deployment
- vpc
- Hq Country
- United States
- Hq City
- Redmond
- Ownership
- public
- Founded
- 1975
- Training Default
- never
- Residency Options
- EU Data Boundary (EU + EFTA), EU DataZone, customer Azure geography, US, Azure Government
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- deployer
- Certs
- ISO 42001, ISO 27001, SOC 2 Type II, FedRAMP High, C5, HDS, CSA STAR
- DPA available
- yes
- Zero Retention Available
- Yes
- Retention Default
- Prompts/completions not stored beyond abuse monitoring; abuse-monitoring human-review sample store is ON by default (commonly cited as 30 days — not explicit in current Foundry docs). EEA deployments reviewed by EEA-located staff.
- Retention Exceptions
- 'Modified abuse monitoring' (gated Limited Access approval) removes the store and human review — verifiable via ContentLogging=false. Stateful features (Assistants threads, stored completions, fine-tuning) persist in customer tenant until deleted.
- Subprocessors
- Microsoft-owned datacentres, OpenAI (model weights)
- Transfer Mechanism
- intra-eu
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- Strong EU Data Boundary + ISO 42001 + EEA-resident reviewers; US CLOUD Act jurisdiction remains via US parent. Underlying model provider is OpenAI (GPAI systemic).
- Last Policy Change
- 2025-02-26T00:00:00.000Z
- Change Summary
- EU Data Boundary reached completed state — customer data + pseudonymized system-log personal data stored/processed within EU/EFTA; ISO 42001 extended to Microsoft Foundry.
- Prior Value
- EUDB phasing in; some support/telemetry processed outside the EU.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- medium
- Subprocessors Claim Basis
- inferred
- Subprocessors Confidence
- low
- Residency Class
- eu-selectable
- Portability / Exit Path
- open-api-standard
- Subprocessor Jurisdiction
- non-eu
