Is Copilot Safe for Client Data in 2026?

Is Copilot Secure for Business Data?

Microsoft 365 Copilot protects business data under Microsoft’s commercial terms, but it can expose files that your staff already have permission to open. Copilot makes those files easier to find. An old sharing mistake can therefore become a client-data disclosure during an ordinary chat.

The account and service decide which protections apply. A free chat with a work account and a free chat with a personal account can have different terms.

Copilot service	Account	Protection that affects client work	Brokerage decision
Personal Copilot app	Personal Microsoft account	Consumer terms and personal history controls	Keep identifiable client records out
Microsoft 365 Copilot Chat	Work account	Enterprise data protection for prompts and responses	Allow only approved content and settings
Microsoft 365 Copilot	Work account in your organisation	Commercial protection plus access to permitted Microsoft 365 work content	Review sharing before enabling it

Microsoft confirms that Copilot Chat with a work account has enterprise data protection. It logs prompts and responses, and authorised administrators can inspect them. A personal subscription doesn’t put chats under your brokerage’s work-account controls.

In a hypothetical brokerage, an assistant can open a SharePoint folder containing every broker’s client files. Microsoft 365 Copilot can surface that content to the assistant. Remove the excessive access at the folder or site before rollout, even if nobody previously searched those files.

What Copilot Stores and Who Can See It

Microsoft 365 Copilot stores prompts and responses, including the source citations used in an answer. The business chat record can be searched by authorised compliance staff. Don’t treat a work chat as a private notebook that your employer cannot inspect.

Microsoft’s business Copilot privacy documentation explains that administrators can use Content search or Microsoft Purview to manage interaction data. Microsoft Purview is Microsoft’s information-protection and compliance system.

For Microsoft 365 Copilot and work-account Copilot Chat, Microsoft says prompts, responses and Microsoft Graph data “aren’t used to train foundation models”. That commitment appears in its enterprise data protection explanation, under the commercial Data Protection Addendum and Product Terms. It doesn’t mean those records aren’t stored.

Business retention depends on the organisation’s configured policies and holds. Microsoft’s retention guidance describes compliance copies in hidden Exchange mailbox folders. Those copies remain searchable until permanent deletion, and a legal hold can prevent deletion after a user clears their visible chat.

For the updated personal Copilot app, Microsoft also says prompts, responses and file contents aren’t used to train foundation models. This consumer promise doesn’t add your brokerage’s administrator controls or commercial contract.

Microsoft’s older consumer Copilot FAQ describes an 18-month default history period and controls for model training. That FAQ explicitly applies to the older app. Don’t apply its retention period or training settings to the updated app or a work-account service.

Is Copilot Confidential Enough for Client Files?

Microsoft 365 Copilot can handle confidential files within an approved business setup, but confidentiality depends on permissions and the processing features you enable. A sensitivity label alone doesn’t prove that only the right staff can read a file.

Before enabling access to client records, have your administrator complete these checks:

1. Review SharePoint and OneDrive access, including broad staff groups, guest users and old sharing links. Restrict each client folder to the people who need it.
2. Apply sensitivity labels to the actual documents as well as the appropriate sites. Configure the label’s protection settings, rather than relying on its displayed name.
3. Where labels encrypt files, review who has the VIEW and EXTRACT usage rights. Microsoft requires both for supported AI apps to return encrypted content.
4. Set a retention policy for Copilot interactions and restrict compliance-search permissions to authorised staff. Tell staff that these chats can become company records.
5. Review web search, connected agents and the models permitted by your organisation. Give each an approved purpose before staff send client information through it.

Microsoft’s sensitivity-label guidance explains the encryption and usage-right requirements. A folder called “Confidential clients” is useful for staff, but its name doesn’t enforce access. Use restricted permissions and configured protection on the files inside it.

Web search needs a separate decision. Copilot can send search terms derived from a prompt to Bing, which has different data-handling terms. Keep client identifiers out of web-grounded requests and disable web search where your approved workflow requires that restriction.

Data residency also needs precise wording. Microsoft’s business privacy documentation allows processing outside a customer’s country, subject to the applicable commitments. Don’t describe an Australian Microsoft 365 account as a guarantee that every Copilot request stays in Australia.

What a Broker Must Never Enter

Keep identifiable client documents out of personal Copilot, including the free app, unless your brokerage has explicitly approved that exact service and disclosure. Use fictional or properly de-identified material for general drafting.

Your staff policy needs to exclude these items from personal Copilot:

• Passports, driver’s licences and other identity documents.
• Bank statements, payslips, tax returns and completed fact finds.
• Client names together with addresses, account numbers or application details.
• Health information, hardship explanations and credit reports.
• Passwords, banking credentials and one-time security codes.

Removing a name from a payslip doesn’t necessarily de-identify it. An employer, exact income and property address can still identify the borrower. Replace the whole example with fictional details when the real record isn’t needed.

For approved Microsoft 365 Copilot use, give staff a clear boundary around each client folder and the content they can copy into prompts. Permission to open a document doesn’t automatically mean that every use of it is appropriate. Keep credentials out of prompts across every plan.

Delete Copilot History

Delete personal Copilot chats through the app or privacy dashboard, and delete work-account activity through Microsoft’s My Account portal. Clearing visible history doesn’t override your organisation’s retention requirements.

Delete a personal Copilot chat

1. Sign in to the personal Copilot app and open the Chats list.
2. Find the conversation, open its More menu and select Delete.
3. For all activity, sign in to Microsoft’s privacy dashboard. Open Privacy, then Empower your productivity, Copilot, Your Copilot app activity history and Copilot apps.
4. Select Delete all activity history, then Clear in the confirmation dialog.

Microsoft documents individual chat deletion and memory controls separately. If you need to remove saved memories, open Settings, Personalization and Manage beside Saved memories. Delete the relevant memory or all memories there.

The privacy dashboard instructions distinguish personal Copilot app activity from activity in Microsoft 365 apps. Select the category containing the conversation you want to remove.

Delete work-account Copilot activity

1. Sign in to Microsoft’s My Account portal with your work account.
2. Open Data and Privacy, then Data options and Copilot activity history.
3. Select Delete, tick Microsoft Copilot in the dialog and submit the deletion request.
4. Close and reopen the affected app after the request completes, then check that the old activity is absent.

Microsoft’s work-account deletion instructions explain that deletion can take time. Saved documents containing Copilot output remain in place. Compliance copies can also remain under a retention policy or legal hold.

Uninstalling the Copilot app doesn’t perform these account-history steps. If someone enters a client record into the wrong account, record what was shared and alert your brokerage’s privacy contact. Delete the relevant activity and review access, while preserving any records your incident process requires.