- Deployment
- hosted
- Hq Country
- United States
- Hq City
- Redmond
- Ownership
- public
- Founded
- 1975
- Training Default
- never
- Residency Options
- EU Data Boundary, in-country processing (15 countries), global
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- deployer
- Certs
- ISO 42001, ISO 27001, SOC 2 Type II, C5, HDS, FedRAMP High, CSA STAR
- DPA available
- yes
- Retention Default
- No fixed vendor deletion window. Copilot interaction history is stored in the user's mailbox; admins set retention via Microsoft Purview and users can delete their own activity history.
- Retention Exceptions
- Anthropic-model path (opt-in for EU/EFTA/UK tenants): Anthropic — not Microsoft — stores most inputs and outputs up to 30 days, may retain flagged content up to 2 years, and trust-and-safety classification scores up to 7 years.
- Subprocessors
- OpenAI, Anthropic, Microsoft-owned datacentres
- Subprocessor Count
- 3
- Transfer Mechanism
- sccs
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- EU Data Boundary service with 2021 SCCs and ISO 42001 certification, but flex routing is on by default for tenants created after 2026-03-25 and lets LLM inferencing leave the EU Data Boundary during peak demand. EU-only inferencing is reachable but requires an explicit admin setting, so it is a configuration you can get wrong rather than a guarantee.
- Last Policy Change
- 2026-04-17T00:00:00.000Z
- Change Summary
- Flex routing enabled for EU/EFTA Copilot tenants: LLM inferencing may occur outside the EU Data Boundary during periods of peak demand. On by default for eligible tenants created after 2026-03-25.
- Prior Value
- EU traffic stayed within the EU Data Boundary for LLM processing.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Claim Basis
- stated
- Subprocessors Confidence
- high
- Residency Class
- eu-selectable
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- non-eu
- Underlying model providers
- OpenAI, Anthropic, Microsoft
