Is Microsoft Copilot safe?
Microsoft Copilot’s small print, four lines that matter to a business, and the one sign-in that changes the rules.
Copilot is already in your taskbar, in Edge and in Word. Nobody in the office installed it on purpose, and somebody has probably pasted a customer’s email into it this week to tidy it up.
Microsoft Copilot runs under two different sets of rules: personal terms when you sign in with your own email, and your business contract when you sign in with a work account your firm pays for.
So the honest answer to “is it safe” is that it depends which email you are signed in with. I read the terms on screen, the whole thing on video, twelve minutes.
How do you tell which Copilot you are using?
Most people think it’s Microsoft, same as Outlook, so it must be fine. But the two versions look almost the same and sit under completely different rules.
Click your profile picture in the corner of Copilot and read the email address. Your own Hotmail or Outlook address means the personal terms apply, even inside Word. Your work address means the business rules apply. Then open the terms and press Control F (Command F on a Mac) to jump to each line below. Here is the line near the top that splits them.
These Terms do not apply to users who sign in with a work, school, or organisational account.
Same app, home rules and school rules. Check the date at the top of the page too. Mine said 18 August 2026, so if yours is newer, something may have moved.
Can someone at Microsoft read your Copilot chats?
On a personal account, yes, they might. Search the page for “important disclosures”.
Copilot may include both automated and manual (human) processing of data. You shouldn’t share any information with Copilot that you don’t want us to review.
Think of it as a postcard. Most postmen won’t read it, but they could. The line above it says that if you don’t pay for Microsoft 365, you may see adverts. If it’s got ads on it, you are the product.
So a customer’s complaint email doesn’t go in as it stands. Swap their name for “customer” and leave out dates of birth and addresses. It does the job just as well.
Does Copilot own what you type into it?
No, but it can still use it. Search for “ownership”.
We get to decide whether to use your content. We don’t have to pay you, ask your permission, or tell you when we do.
Content means what you type, what you upload and what it writes back. They can copy, edit, translate and reformat it, and pass those rights to people working for them. Still your bike, but they can ride it where they like.
Get Bedrock Ry’s stories in your inbox
Join Medium for free to get updates from this writer.
To be fair, the next sentence says that doesn’t mean any use they want. Switch off what you can anyway. Open Settings, then Personalization, and turn off ads personalisation and shared experience, which lets your chats shape what you see on Bing, Edge and MSN. Turn off saved memories too if you don’t want it remembering details about your customers.
Who pays if Copilot gets something wrong?
You do. Search for “professional advice”, then “indemnify”.
You agree to indemnify us and hold us harmless.
Posh word, simple meaning. If someone takes you to court over something Copilot wrote, you pay, and you pay Microsoft’s bills too. Like copying your mate’s homework, it’s your name on the page.
So if it writes a page for your website and lifts a paragraph from a competitor, that’s yours to sort out. Read everything before it goes out, and check anything with a number, a date or a legal point somewhere else.
How do you get Copilot under your business rules?
Sign in with your work account. If your business already pays for Microsoft 365, Microsoft says Copilot Chat comes with it at no extra cost as of September 2026, and a lot of owners pay for it without knowing.
Signed in that way, what you type gets the same protection as your work emails and files, and Microsoft’s enterprise data protection page says it won’t use your data except as you instruct, and it isn’t used to train the models underneath. One catch, a web search still goes to Bing under Microsoft’s normal rules, with your name taken off first.
Where would you not use Copilot at all?
This isn’t legal advice. It’s me reading Microsoft’s own pages and saying what I’d do.
On any account, some things never go in. Bank details, anything medical, passwords, customer names and addresses, and anything you’ve signed to keep private. If you have no Microsoft 365, the settings above are as protected as you get, so be choosy.
Even on a work account, keep private details out of anything that sends it off to search the web.
This week, walk round the office and click the picture in the corner of everyone’s Copilot. Most owners I speak to have no idea which account their staff are on, and it’s usually a mix.
If you’d rather sort this yourself, The Business Brain is the do-it-yourself pack that stops you starting from a blank page every time you open one of these tools.
More on finding the tools your team already use: how to find shadow AI in your business.
