Vendor record · microsoft.com
What Microsoft promises about your data.
Where Microsoft publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Microsoft lists its sub-processors at learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subprocessor-overview. We last read it on October 16, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between September 10, 2026 and September 16, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
We quote its clause on new sub-processors from www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx (read October 1, 2026), but it names no number of days.
- Window
- —
- Pages
- 11
- Copies
- 36
no window we can quote yet
pages we watch
dated copies of all its pages, since August 31, 2026
Microsoft DPA
Microsoft's data processing agreement is at www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA; we last read it on October 16, 2026. Microsoft's data processing agreement has a clause on new sub-processors, but it states no single number of days for every new sub-processor. Here it is, from our October 1, 2026 copy:
“Microsoft will give Customer notice and, as applicable, update the website and provide Customer with a mechanism to obtain notice of that update of any new Subprocessor at least 6 months in advance of providing that Subprocessor with access to Customer Data or for subprocessors that support artificial intelligence functionality, 30 days’ notice with the ability to disable use of that subprocessor until at least 6 months after notice.”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Microsoft published it.
www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx · read 2026-10-01 · fingerprint 74eab0c1ba8c85fc…
Microsoft sub-processors
Microsoft publishes a sub-processor list at learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subprocessor-overview; we last read it on October 16, 2026. We could not read named entries out of it. The public record holds no change to the list read before September 16, 2026. A change we read after September 16, 2026 is published 30 days after we read it.
Every public change we have recorded · Where vendors publish their lists
How long Microsoft keeps your data
Microsoft's data processing agreement (www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx, in the copy read October 1, 2026) says: “Except for free trials and LinkedIn services, Microsoft will retain Customer Data that remains stored in Online Services in a limited function account for 90 days after expiration or termination of Customer’s subscription so that Customer may extract the data.”
Training on customer data
“We may eventually expand model training and opt-out controls to users in certain countries where we do not currently use conversation history for model training (see What data is excluded from model training?).”
support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot · read 2026-10-15
Training on customer data
“Important Your prompts (inputs) and completions (outputs), your embeddings, and your training data: - are NOT available to other customers. - are NOT available to OpenAI or other providers of Models sold by Azure. - are NOT used by providers of Models sold by Azure to improve their models or services. - are NOT used to train any generative AI foundation models without your permission or instructi…”
learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy · read 2026-09-30
Training on customer data
“Once you’ve updated that conversation, the full conversation will be viewable in Copilot, again as read-only. ### Is my Microsoft 365 Copilot data used to train Copilot models? No. Conversations from Microsoft 365 Copilot remain read-only for you and are not used to train Copilot’s generative AI models. ### Can I control or turn off the visibility of Microsoft 365 Copilot conversations within Cop…”
support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot · read 2026-10-15
Training on customer data
“You can upload your own data for use with certain service features (e.g., fine-tuning, assistants API, batch processing…”
learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy · read 2026-09-30
Training on customer data
“The file itself and any conversations you have about the file will be treated just like any other conversation, subject to your choices about whether to permit model training and personalization, and which you can delete at any time. ### What happens to the images I capture and share with Copilot? When you use Copilot Vision, Copilot helps safeguard your data and protect your privacy.”
support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot · read 2026-10-15
Training on customer data
“Prompts, responses, and your file contents when using Copilot in Microsoft 365 apps aren't used to train foundation models.”
support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy · read 2026-10-15
Training on customer data
“Microsoft shall provide periodic and mandatory data privacy and security training and awareness to its employees with access to Customer Data, Professional Services Data, and Personal Data in accordance with applicable Data Protection Requirements and industry standards.”
www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx · read 2026-10-01
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
International transfer notice · United States
“For Previews that allow Personal Data processing, all terms in this DPA apply subject to following: Preview Data may be transferred to, and stored and processed in, the United States or any other country in which Microsoft or its Subprocessors operate.”
www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx · read 2026-10-01
Retirements announced · every vendor's retirements
undated
At deployment retirement, inference and deployment return error responses.
undated
Fine-tuned models follow a separate retirement schedule for training and deployment.
undated
Fine-tuned models retire in two phases: training and deployment.
2026-12-15
Fine-tuned models retire in two phases: training and deployment.
2026-05-14
Fireworks models on Standard (Per-Token) inference offerings are subject to a 15-day notice period prior to model retirement.
undated
For example, a model that the docs list as "Deprecated" (still works, blocked for new customers) appears in the API as lifecycleStatus: "De…
The pages' own stamps: effective 2018-05-25 · Last updated 2026-08-18 · Last updated 2026-07-24 · Last updated 2026-07-28 · Last updated 2026-05-19 · Last updated 2026-05-19 · Last updated 2026-05-22 · Last updated 2026-09-23 · version 2024-05-13 · version 2025-04-14
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Deprecation schedule
learn.microsoft.com/en-us/azure/foundry/openai/concepts/model-retirements2026-10-16
Deprecation schedule
learn.microsoft.com/en-us/azure/foundry/openai/concepts/retired-models2026-10-16
Deprecation schedule
learn.microsoft.com/en-us/azure/foundry/openai/concepts/model-retirement-schedule2026-10-16
Data processing agreement
www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA2026-10-16
Data processing agreement
www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx2026-10-15
Privacy policy
support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot2026-10-15
Privacy policy
support.microsoft.com/en-us/privacy/copilot-in-microsoft-365-apps-for-home-your-data-and-privacy2026-10-15
Sub-processor list
learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subprocessor-overview2026-10-16
Where we get nothing
What Microsoft does not publish where we can read it
Of the 11 public pages we watch for Microsoft, these give us nothing right now.
Trust and security
the page at that URL is not that document
microsoft.com/trustBefore you conclude anything
This only means we couldn’t read it on a public page. Microsoft may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Microsoft. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Microsoft? With an email at microsoft.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Microsoft in your product? Hear the morning we read a change.
You get the lines that moved, in Microsoft’s own words, and the date any window closes. No card. Nothing to cancel.