Microsoft Copilot

The privacy dashboard offers 'Export all activity history' as a CSV download of prompts and responses, but there is no documented import or restore, in Copilot or in any runtime Microsoft does not operate.

• Manage your Copilot activity history in the privacy dashboard

The documented export is conversation text only: a CSV of 'the things you type in Copilot and the AI-assisted responses you receive'. No export is documented for memories, uploaded files, connector links or settings.

• Manage your Copilot activity history in the privacy dashboard
• Microsoft Copilot privacy controls

Copilot runs only as a Microsoft-hosted service and needs a Microsoft account. The Services Agreement lets Microsoft remove features or stop providing a service, and the Terms allow access to be revoked 'in our sole discretion, at any time and without notice'.

• Microsoft Copilot Terms of Use
• Microsoft Services Agreement

The owner picks only preset modes (Quick response, Think Deeper, Study and learn, Smart, Search), backed by Microsoft and OpenAI models. Users cannot select specific model versions, and no other or local models are supported.

• Conversation modes in Microsoft Copilot

Microsoft may 'limit, suspend, or permanently revoke' access at its sole discretion without notice. When an account is closed 'by you or us', access stops immediately, and Microsoft 'won't be able to retrieve Your Content or Data once your account is closed'. No post-termination export window or shutdown plan is documented.

• Microsoft Copilot Terms of Use
• Microsoft Services Agreement

Agent state (conversations, memories, files) is held on Microsoft servers and read through Copilot or the Microsoft privacy dashboard, both operated by Microsoft. There is no public schema, and the owner holds no keys.

• Manage your Copilot activity history in the privacy dashboard
• Conversation history in Microsoft Copilot

Both shortfalls. (1) The base system prompt and other provider-injected context are not shown to the owner. (2) The model in effect cannot be determined, because Smart mode uses 'a real-time router' to pick models and specific versions cannot be selected.

• Conversation modes in Microsoft Copilot

Conversation history has a disclosed 18-month retention. However, the Privacy Statement says Copilot data is also used for advertising and product improvement, gives no Copilot-specific retention, and applies only general criteria (purpose, sensitivity, legal obligations). Advertising data derived from conversations is not visible item by item.

• Privacy FAQ for Microsoft Copilot
• Microsoft Privacy Statement

Advertiser content is placed in the conversation below Copilot's answer, introduced by an 'ad voice' lead-in and chosen from 'the context of the entire conversation'. Sponsored links are stated to be clearly identified. On the free plan, however, ads cannot be switched off (the Terms say Copilot 'may include advertising' without a paid Microsoft 365 subscription), and the statement that commissions do not influence rankings is on a support page, not in binding terms.

• About ads in Copilot (Microsoft Advertising)
• Transforming audience engagement with generative AI (Microsoft Advertising blog)
• Shopping with Microsoft Copilot
• Microsoft Copilot Terms of Use

The only record is the conversation history, which is pruned after 18 months by default. No record is documented for provider-side or staff actions (for example human review), or for alerting the owner when recording fails. That is at least two shortfalls.

• Conversation history in Microsoft Copilot
• Privacy FAQ for Microsoft Copilot

No integrity data (hashes, signatures or checkpoints) is documented for the conversation or action record, so Microsoft as the record holder could change it without trace.

• Conversation history in Microsoft Copilot

The history is written by Microsoft's service, and no documented Copilot capability lets the assistant delete or edit it. However, no protection against the agent altering its record is documented, so the pass is withheld under G12.

• Conversation history in Microsoft Copilot

Every required component (the Copilot service, its orchestration and models) is closed and hosted by Microsoft. The Services Agreement also forbids using the AI services 'to discover any underlying components of the models, algorithms, and systems'.

• Microsoft Services Agreement

The agent has no identity of its own. It acts under the owner's Microsoft account, which Microsoft issues and can suspend or close.

• Microsoft Services Agreement
• Microsoft Copilot Terms of Use

No change history, attribution or rollback is documented for memories, settings, model or instructions. Memories can only be viewed, edited or deleted in their current state.

• Microsoft Copilot privacy controls

The consumer Copilot base instructions are fixed by Microsoft and cannot be viewed or replaced. The documented custom-instructions feature is for work/school Microsoft 365 Copilot Chat, not the consumer service.

• Customize how Microsoft Copilot responds to you (Microsoft 365 account)
• Conversation modes in Microsoft Copilot

Remembered items can be viewed, edited and deleted one by one, and 'Delete all Memory' is available. A second persistent store, 'Microsoft usage data' from Bing, MSN, Edge and other products (on by default), is only an on/off switch and is not itemised.

• Microsoft Copilot privacy controls
• Privacy FAQ for Microsoft Copilot

Tools are fixed. Connectors are limited to Microsoft's pre-integrated services (OneDrive, Outlook.com, Google Drive, Gmail, Calendar, Contacts), with no documented way to add custom tools or MCP servers.

• Connecting Microsoft Copilot to other services

Microsoft sets which protections apply, such as content safety and the built-in Copilot Tasks safeguards, which users 'cannot opt out of'. No owner-adjustable protection is documented. Because no exit route exists (criterion P), hosted-policy enforcement is not excluded from this test.

• Using Copilot Tasks
• Microsoft Copilot Terms of Use

Models are routed and changed server-side (for example, Smart mode's real-time router), with no pinning or opt-in. Microsoft reserves the right to 'remove or change features or functionality' of the service.

• Conversation modes in Microsoft Copilot
• Microsoft Services Agreement

Two or more shortfalls. Connector scope is on/off per service only, not per folder, recipient or sender. The spend dimension has no documented owner limit even though Copilot Checkout lets U.S. users buy on Copilot.com. No limit on instruction sources, such as injected web content, is documented.

• Connecting Microsoft Copilot to other services
• Conversations that Convert: Copilot Checkout and Brand Agents

The only documented approvals are fixed provider-chosen safeguards (purchases, submitting personal data, messages, account changes) in Copilot Tasks, a Microsoft 365 Premium feature. The owner cannot choose which action classes are gated.

• Using Copilot Tasks

Scheduled and recurring Copilot Tasks can be paused or stopped task by task in the Tasks view (Premium). No single global stop covering in-flight, scheduled and provider-side work is documented, and there is no documented guarantee that nothing resumes. Pass withheld under G12.

• Using Copilot Tasks

Training on text and voice conversations is on by default and is opt-out only. Personalized ads are on by default. Opting out of training does not exclude conversations from 'advertising, digital safety, security, and compliance' use. 'Opt-out of human review is not available.'

• Microsoft Copilot privacy controls
• Privacy FAQ for Microsoft Copilot
• Microsoft Privacy Statement

Connected services are listed and can be switched on or off one by one, and connected data is stated not to be used for training. Where the authorization tokens are held, how quickly revocation takes effect, and whether Microsoft keeps a copy afterwards are not disclosed, so the pass is withheld (G12).

• Connecting Microsoft Copilot to other services

Deletion takes several steps: 'Delete all activity history' and 'Delete all Memory' are separate controls, and full removal requires closing the Microsoft account. Closure deletes data only after a 30- or 60-day reopen window, and completion confirmation and backup deletion are not documented.

• Manage your Copilot activity history in the privacy dashboard
• Microsoft Copilot privacy controls
• How to close your Microsoft account