Microsoft Copilot data privacy comes down to what Microsoft documents: prompts and responses sit under enterprise data protection and are not used to train foundation models. This page gathers those answers and shows what the open-source Kortix changes by running the work where you control it.
Microsoft Copilot is a hosted Microsoft service that runs on the Microsoft 365 plans an organization already buys. Microsoft splits the experiences by what each can reach: Copilot Chat (Basic) is included with eligible Microsoft 365 plans and grounds answers in web data plus content you paste or upload; Microsoft 365 Copilot (Basic) adds Copilot inside Word, Excel, PowerPoint and OneNote; Microsoft 365 Copilot (Premium) is the paid add-on, and it grounds answers in work data automatically through Microsoft Graph and Work IQ (Microsoft's Copilot overview).
Signing in with a work or school account applies Enterprise Data Protection (EDP) to all three. Microsoft states that EDP carries the same contractual terms it uses for Exchange email and SharePoint files, with Microsoft acting as a data processor under its Data Protection Addendum, and that it covers prompts and responses (Microsoft's EDP page). Web search queries are the exception: those go to the Bing search service under a separate agreement.
The product itself is covered in our Microsoft Copilot primer. The question a security reviewer asks next is narrower, and it has a documented answer.
The training sentence is Microsoft's, and it is specific: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot" (Data, privacy, and security for Microsoft Copilot). Optional customer feedback is not used to train those models either.
Storing is a separate thing from training. Microsoft keeps each prompt and response as Copilot activity history, handled with your organization's other Microsoft 365 content and encrypted at rest. Admins can search and set retention on that history with Microsoft Purview, and users can delete their own activity history from the My Account portal (Copilot Chat data protection).
Microsoft also states that its Copilot services opted out of the human abuse review available in Azure OpenAI. Prompts, Bing queries triggered by prompts, and responses in Copilot Chat are logged, and an IT admin can view them with Microsoft's search and audit tools. The accurate reading is narrow: Microsoft does not train foundation models on your prompts or Graph data, and it does not read them through an abuse-monitoring program. It does store them, and your admins can search them.
Connector credentials are brokered server-side and never enter the machine.Kortix-managed models run on zero-data-retention endpoints.Secrets are encrypted at rest with a key per project.One isolated sandbox per session. Each session has its own isolated machine and branch.Every action is recorded in the audit log. The log keeps 90 days of events live, and the archive keeps them up to 365 days.Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.Quoted from the Kortix docs, checked October 2026.
Every Microsoft Copilot tier described here runs in Microsoft's environment. That is the design, and it is the one thing a self-hosted alternative changes: who holds the machine the data lands on, not which model answers. The open-source AI Operating System is what Kortix is, and its answer to the deployment question is the short one: run it on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free. The self-hosting guide walks through the three commands.
On the Kortix side the data facts are files and settings a reviewer can read. Connector credentials are brokered server-side and never enter the machine. Secrets are encrypted at rest with a key per project. One isolated sandbox per session. Each session has its own isolated machine and branch. Per-resource permissions for people and agents. Roles, groups, and an audit trail.
Where a Kortix agent touches company systems it reaches them through connectors with rules set down to the arguments of each call, behind approval gates you set, off until you set them. Against Copilot's single vendor boundary the trade is plain: Microsoft runs a finished service under EDP, while Kortix runs an open-source system you can put on your own infrastructure. The wider field of open-source options is compared lane by lane in the alternatives guide, and short answers to the common questions sit in the FAQ.
Kortix puts the deployment on your side of the wall; Copilot runs in Microsoft's environment.
Microsoft stores the prompt and the response as Copilot activity history, handled like your organization's other Microsoft 365 content, and admins set retention policies with Microsoft Purview. Users can also delete their own activity history from the My Account portal.
Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models, and that optional customer feedback is not used to train them either.
Microsoft states Copilot is compliant with its privacy, security and compliance commitments for Microsoft 365 commercial customers, including the GDPR and the EU Data Boundary. Two things sit outside that boundary: web search queries, and Anthropic-provided models.
You choose where it runs. Run it on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free. Connector credentials are brokered server-side and never enter the machine.
Start with one job and grow from there.