Vendor profile
Microsoft Copilot 365: where is customer data stored and processed?
Copilot 365 is a business product, and customer groups are not stated in the data provided. Customer content and pseudonymised personal data are documented as stored and processed in the EU/EFTA for services within the EU Data Boundary, though the countries are not stated. The data processing agreement allows transfer and storage in the USA and other countries, but US storage or processing for Copilot 365 is not confirmed. Logs and telemetry are documented as stored and processed in the EU/EEA. AI models from OpenAI are included in the EU Data Boundary with exceptions, and OpenAI is a subprocessor whose operating location, and any non-EU locations, are not stated.
Checked 15 October 2026 · based on the vendor's own public documents
See the map and sources
Where data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|
| Storage | Europe (country not stated) | –
Only for customers in other regions: USA |
|---|
| Processing | Europe (country not stated) | –
Only for customers in other regions: USA |
|---|
| Login and user account | Europe (country not stated) | – |
|---|
| Logs and telemetry | Europe (country not stated) | – |
|---|
| AI features | Europe (country not stated) | – |
|---|
Ownership and agreements
| Headquarters | USA |
|---|
| Data processing agreement | Found and read |
|---|
| Certifications | ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27017, ISO/IEC 27701, ISO/IEC 20000-1, ISO 9001, ISO 22301, HITRUST |
|---|
Sub-processors (1)
| Name | Country | Purpose |
|---|
| OpenAI | – | AI-modeller (GPT) driftet av OpenAI |
Sources