AI Vendor Security & Compliance Brief

Microsoft Copilot

Independent due-diligence summary · every fact links to the vendor's official source
5 source-cited facts
0 independently verified certs
28 legal documents tracked
Generated 2026-06-05

Compliance Posture vendor-stated · cited

FrameworkStatusSource
GDPR Stated by vendor https://learn.microsoft.com/en-us/compliance/regulatory/gdpr
HIPAA Stated by vendor https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech
ISO 27001 Stated by vendor https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-27001
SOC 2 Stated by vendor https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc
As published on the vendor's own trust/compliance pages — not independently audited. Independently verified attestations, when available, appear in the certifications section below. Request the underlying report before relying on these.

Data & Contract Facts deterministic · cited

AttributeValueSource
Sub-processors LinkedIn Corporation https://aka.ms/online-services-subprocessors

Security Posture authoritative · cited

Known Vulnerabilities (CVE / CISA KEV) Not determinable
Could not map this vendor to a software identity — abstained rather than guess.
Vulnerability Disclosure Policy (security.txt) None found
Queried the authoritative source; no records.
Email Spoofing Protection (DMARC) Protected
DMARC enforced and SPF present — spoofing well mitigated.
Web TLS Certificate Valid
Data Breach History (HIBP) None found
Queried the authoritative source; no records.
Supply-Chain Security (OpenSSF Scorecard) Not determinable
Could not map this vendor to a software identity — abstained rather than guess.
OFAC Sanctions Screening None found
Queried the authoritative source; no records.
SEC Cyber Incident Disclosures (8-K 1.05) Not determinable
Could not map this vendor to a software identity — abstained rather than guess.

Vendor-Claimed, Not Independently Verified treat as unconfirmed

SOC2 TYPE2 claimed_unverified https://learn.microsoft.com/en-us/answers/questions/5522218/use-soc2-as-proof-for-a-client
These appear on the vendor's site but we could not confirm an independent audit report. Request the underlying attestation before relying on them.

Tracked Legal & Policy Documents

DocumentURL
Ai Policy https://copilot.microsoft.com/ai-policy
Aup https://copilot.microsoft.com/aup
Baa https://copilot.microsoft.com/baa
Bcp https://copilot.microsoft.com/bcp
Caiq https://copilot.microsoft.com/caiq
Ccpa Compliance https://copilot.microsoft.com/ccpa
Cookie https://copilot.microsoft.com/cookies
Data Flow https://copilot.microsoft.com/data-flow
Data Retention https://copilot.microsoft.com/legal/data-retention
Dpa https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
Drp https://copilot.microsoft.com/drp
Gdpr Compliance https://copilot.microsoft.com/gdpr
Incident Response https://copilot.microsoft.com/incident-response
Kvkk Compliance https://copilot.microsoft.com/kvkk
Msa https://copilot.microsoft.com/msa
Offboarding https://copilot.microsoft.com/data-export
Oss Inventory https://copilot.microsoft.com/oss
Patch Mgmt https://copilot.microsoft.com/security/patch-management
Pricing https://copilot.microsoft.com/pricing
Privacy https://microsoft.com/privacy
Sbom https://copilot.microsoft.com/sbom
Security https://copilot.microsoft.com/compliance
Sig Questionnaire https://copilot.microsoft.com/sig
Sla https://copilot.microsoft.com/sla
Subprocessors https://copilot.microsoft.com/subprocessors
Tos https://microsoft.com/legal
Trust https://microsoft.com/trust
Vuln Mgmt https://copilot.microsoft.com/security/vulnerability

Monitor Microsoft Copilot — get alerted when this changes

This brief is a point-in-time snapshot. Vendors quietly revise their DPA, sub-processors, certifications and security posture — and disclose new CVEs. Get a priority email the moment Microsoft Copilot changes something that affects your risk. Built for procurement & security teams.

Free. One email per material change. Unsubscribe anytime. No sales spam.
Every data point above is extracted from the vendor's own official trust, security, or legal pages and links to its source. This brief contains no scraped sentiment, forum chatter, or AI-inferred opinion — only verifiable, deterministic facts. Verify each source before procurement decisions.