Vendor profile
Microsoft M365: where is customer data stored and processed?
Microsoft's own privacy page states that customer data can be stored and processed within the EU under the EU Data Boundary, but this is general and not confirmed specifically for M365. The M365-specific data location is therefore not verified beyond that general statement. Lists of other possible storage countries (including Australia, Austria, Brazil, Canada, Finland, France, Germany, Hong Kong and India) are general datacentre lists and are not confirmed for M365. Telemetry, logs and analytics are described generally as possibly processed in the USA, without M365-specific confirmation. Customer group is not stated, and no data processing agreement, sub-processors or certifications were found in the pages retrieved.
See the map and sourcesWhere data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|---|---|
| Storage | Europe (country not stated), Austria, Finland, France, Germany, Ireland, Luxembourg, Netherlands | – |
| Processing | Europe (country not stated) | – |
| Login and user account | Europe (country not stated) | – |
| Logs and telemetry | – | USA |
| Analytics and metadata | – | USA |
Ownership and agreements
| Headquarters | USA |
|---|---|
| Data processing agreement | Not found on the vendor's website |
| Certifications | None found |