Microsoft 365 Copilot: Is Customer Data Used to Train Foundation Models? Teams Meeting Data Privacy, Retention, and What Lawyers Should Know

Published October 28, 2026

October 28, 2026 · 11 min read

Short answer up top: According to Microsoft's own documentation, Microsoft 365 Copilot customer data — including prompts, responses, and Microsoft Graph data such as Teams meeting transcripts — is not used to train the foundation large language models behind Copilot. That is confirmed in Microsoft's official Copilot privacy page, which states the stored data "isn't used to train foundation LLMs, including those used by Microsoft Copilot." But "not used to train" is a much narrower promise than "private." Teams meeting transcripts, recordings, Intelligent Recap summaries, and Copilot prompts/responses are still processed in the Microsoft 365 cloud, retained inside your tenant for a configurable period, and discoverable through Microsoft Purview eDiscovery. For a lawyer evaluating whether to use Teams Copilot on a privileged client call — or an executive weighing it for a board meeting — the training question is only one of several. This guide walks through what Microsoft actually commits to, where the cloud-retention risks remain, how Zoom AI Companion compares, and where on-device tools like Basil AI fit for calls that must never leave the device.

What Microsoft Officially Says About Copilot and Foundation-Model Training

The clearest statement sits on Microsoft's Data, Privacy, and Security for Microsoft Copilot page: "The data is encrypted while it's stored and isn't used to train foundation LLMs, including those used by Microsoft Copilot." Microsoft is also explicit that personal data from connected experiences in Microsoft 365 isn't used to train LLMs either.

A separate Microsoft Tech Community post on how Microsoft deploys foundation models puts it even more plainly: "Regardless of the specific foundation model used, we never use your customer data to train those models." And a Microsoft Q&A thread on Copilot Chat privacy confirms the same for organizational data accessed through Copilot.

So the first question — the one that drove you to this page — has a direct answer: Microsoft 365 Copilot customer data is not used to train foundation models. That commitment applies to Microsoft 365 Copilot, Copilot Chat with enterprise data protection, and Microsoft Graph data (which is how Copilot sees your Teams meeting transcripts, emails, SharePoint files, and OneDrive content).

Where the "No Training" Promise Stops

This is where buyer-intent research usually ends and the real compliance work begins. As a clear-eyed Ajaia analysis of Microsoft's commitments puts it: "'Not used to train foundation models' does not mean 'not processed, retained, logged, or governed.'" That same analysis notes that under enterprise data protection, prompts and responses can be logged and retained for audit, eDiscovery, and Microsoft Purview capabilities.

Three things remain true even with Microsoft's training pledge in place:

• Your meeting content is still processed in the Microsoft 365 cloud. Audio is transcribed on Microsoft servers; Copilot analyzes the transcript server-side; summaries and action items live in your tenant.
• Your meeting content is still retained. By default for 120 days for recordings, transcripts, and Intelligent Recap — potentially years under Purview retention or litigation hold.
• Your meeting content is still discoverable. Transcripts, Copilot-generated summaries, and even Copilot prompts and responses are indexed by Microsoft Purview eDiscovery.

Copilot in Teams Meetings: The Transcript Is the Record

For Copilot to deliver its post-meeting recap, action items, and "what did Jennifer say about the pricing concession?" queries, it needs a transcript. A thorough WindowsForum analysis of Teams Copilot licensing and transcripts is blunt about the dependency: "Copilot in Teams is a Microsoft 365 service, governed by the user's license, the meeting organizer's settings, tenant policies, permissions, and — often — whether a transcript exists."

When transcripts are enabled, that same analysis notes they "create a governed data artifact that must fit retention rules, eDiscovery requirements, sensitivity labels, regional data practices, and employee expectations." The transcript is the record. Everything downstream — the recap, the action items, the Purview audit log — comes from it.

Teams Meeting Retention Changed on October 6, 2026

Many IT teams are still running on outdated assumptions. The default retention for Teams meeting recordings and transcripts was 60 days for years, then bumped to 120 days in 2022. As of October 6, 2026, per a University of Washington IT announcement of the Microsoft Teams retention policy change, "new Microsoft Teams meeting recordings, transcripts, and AI-generated summary (Intelligent Recap) content will be retained for 120 days by default" — and critically, Intelligent Recap AI summaries are now covered by the same auto-expiration policy.

Microsoft's own Teams recording expiration policy documentation confirms the 120-day default and makes clear that "meeting recordings and transcripts have a default expiration time of 120 days" — but admins can set anywhere from 1 day to effectively indefinite (via PowerShell).

"Only During the Meeting" Mode: The Hidden Prompt Retention Trap

This is the single most-missed detail in Teams Copilot buyer research. Microsoft lets you run Copilot in a mode where no persistent transcript is created — but Copilot prompts and responses can still be retained.

From Microsoft's own support article on using Copilot without transcribing a Teams meeting: "While meeting transcripts are not created when transcription is turned off, Copilot prompts and responses may be retained in accordance with your org's Microsoft Purview retention policies."

A detailed WindowsForum breakdown of Teams Copilot prompt retention summarizes the operational consequence: "No saved transcript does not necessarily mean no retained AI interaction." The practical implication, the same analysis argues, is that a retention inventory must distinguish temporary processing data, saved transcripts, and Copilot prompt-response records as three separate categories.

Consider what that means for a law firm. An associate asks Copilot during a client intake call: "Summarize the objections to the restructuring plan." The firm has transcription turned off. There is no saved transcript. But — as a Summit AI Notes explainer on retained Copilot data without transcripts walks through — the prompt itself, and Copilot's answer, may sit in the compliance substrate indefinitely under Purview policy. That answer likely contains a condensed version of the privileged conversation.

Microsoft 365 Copilot vs. Zoom AI Companion vs. On-Device: The Data Flow Comparison

Buyers evaluating options for privileged or confidential meetings usually have both Microsoft 365 and Zoom licenses already. Here is how the three realistic choices compare on the dimensions that matter for compliance and privilege.

Dimension	Microsoft 365 Copilot (Teams)	Zoom AI Companion	On-Device (Basil AI)
Processing location	Microsoft Azure cloud (tenant-isolated)	Zoom cloud + sometimes third-party models (e.g., Perplexity, OpenAI)	Local Apple Neural Engine; audio never leaves device
Used to train foundation LLMs?	No (per Microsoft documentation)	No (per Zoom's post-Aug 2023 terms)	No cloud = no training vector
Default retention of transcripts/recaps	120 days (as of Oct 6, 2026); extendable	Up to 365 days for Meeting Summaries; 30 days for service data	Zero cloud retention; you own the file
Discoverable via vendor eDiscovery?	Yes (Microsoft Purview)	Yes (Zoom admin tools)	No — files exist only on your device
Prompts retained even if transcript is off?	Yes (compliance substrate)	Varies; depends on retention setting	N/A — no prompts sent to anyone's cloud
Third-party model exposure	Microsoft-controlled subprocessors	Third-party models may process U.S.-side regardless of customer region	None
Works offline?	No	No	Yes
Admin can access without user knowledge?	Yes (tenant admin + Purview)	Yes (Zoom admin)	No — file is on user's Mac/iPhone

Zoom AI Companion: Same Training Pledge, Similar Retention Trade-offs

Zoom made the same core commitment Microsoft did, but only after a public backlash. The Record covered Zoom's August 2023 terms-of-service reversal, in which Zoom confirmed it "does not use any of your audio, video, chat, screen sharing, attachments, or other communications like customer content" to train its or third-party AI models. NBC News coverage of the Zoom AI terms controversy reported the same commitment.

Zoom's current AI Companion security and privacy documentation reiterates: "Zoom does not use any customer audio, video, chat, screen sharing, attachments, or other communications-like customer content (such as recordings, transcripts, and survey results) to train Zoom's or its third-party artificial intelligence models." Zoom also states it retains content used to provide the service for up to 30 days for debugging purposes.

So on the training-data question specifically, Microsoft and Zoom now hold the same line. The differentiators are retention windows, admin-access models, and third-party sub-processor exposure.

What ABA Formal Opinion 512 Means for Lawyers Using Teams Copilot or Zoom

If you landed here because you run a small firm and are weighing Teams Copilot for client intake, this section is the one that matters. On July 29, 2024, the American Bar Association issued ABA Formal Opinion 512, the profession's first formal ethics guidance on lawyer use of generative AI.

The National Conference of Bar Examiners' analysis of Opinion 512 highlights the core confidentiality rule: "Before lawyers input information relating to the representation of a client into a GAI tool, they must evaluate the risks that the information will be disclosed to or accessed by others outside the firm."

A separate rule-by-rule reading of Opinion 512 in The Legal Prompts notes that for self-learning tools, informed client consent is required, and "boiler-plate is not enough." That is not Microsoft 365 Copilot's situation (it does not self-learn on your data), but the broader duty to evaluate retention, access, and reuse risk still applies.

What a lawyer evaluating Teams Copilot or Zoom AI Companion for privileged calls has to assess under Opinion 512, as summarized in a GC AI breakdown of Opinion 512's six duties:

• Who inside the vendor can access the transcript (Microsoft support staff? Zoom engineers?)
• How long the vendor retains it (120 days for Teams; up to 365 for Zoom Meeting Summaries)
• Whether the firm's own IT admins can pull transcripts without the handling attorney's knowledge
• Whether opposing counsel could subpoena the cloud-stored transcript in later litigation
• Whether a tenant breach would expose the content (encryption at rest is strong but not infallible)

None of those risks are eliminated by Microsoft's "no training" pledge. They are governance questions about who else can see this, and the honest answer for any cloud AI meeting tool is: more people than can see a local file on your laptop.

The GDPR, HIPAA, and FINRA Angle: Retention Isn't Just a Legal-Industry Issue

Enterprise buyers in healthcare, finance, and EU-regulated industries face the same cloud-retention question. EPC Group's 2026 analysis of Copilot in Teams security risks notes that Microsoft Purview Audit (Premium) supports 7-year retention for HIPAA/FINRA tenants and 10-year retention for SEC Rule 17a-4 broker-dealers, and that "all Microsoft Copilot prompts + responses logged" fall under that scheme.

That is a feature for compliance — but it is also a risk surface. Every Copilot prompt from every meeting becomes a durable, searchable artifact. For an M&A deal team, a healthcare privacy officer discussing a specific patient complaint, or a financial advisor talking a client through a trade recommendation, that retention is not neutral. It is a decision about how long sensitive content exists outside the room where it was spoken.

Under Article 5 of the GDPR, data minimization requires that personal data be "adequate, relevant and limited to what is necessary." A cloud-retained AI transcript of every meeting is hard to defend as the minimum necessary when a transient local transcript would accomplish the same business goal.

How Basil AI Solves This: Zero-Cloud, Zero-Retention Meeting Capture

Basil AI is a different architecture than Teams Copilot or Zoom AI Companion. Audio from the meeting is captured locally on your Mac or iPhone. Transcription runs on Apple's on-device Speech Recognition framework, which executes on the Apple Neural Engine. Summaries and action items are generated locally. The resulting file lives in Apple Notes or on your device — governed by whatever retention policy you set, not Microsoft, not Zoom.

What this changes for the buyer questions this page answers:

• Training on your data: Impossible. The content never leaves the device, so no vendor can train on it even accidentally.
• Retention: You control it. There is no 120-day default, no Purview retention policy, no admin override.
• eDiscovery exposure: The transcript isn't in anyone's cloud. It is on your device, under your sole possession — the strongest posture for attorney-client privilege.
• Third-party sub-processors: None. There are no OpenAI, Perplexity, or Azure OpenAI handoffs because there is no cloud call.
• Works offline: Yes — including on a plane, in a SCIF-adjacent room, or on a client site with restricted Wi-Fi.

For a deeper technical look at how this works, see our walkthrough of on-device transcription with Whisper and Apple frameworks, our breakdown of AI companion privacy, security, and meeting-data training/retention trade-offs, and our side-by-side with Microsoft's own tool in Microsoft Copilot Meeting Recorder: Enterprise Privacy Concerns.

What Buyer Should Choose What: A Decision Tree

• You run a small law firm doing client intake and depositions: Use an on-device tool for anything involving privileged content. Teams Copilot's "no training" pledge is real but doesn't address Purview retention, eDiscovery, or admin access to transcripts. Opinion 512 asks you to evaluate those exact risks.
• You're an executive handling board meetings and M&A deliberations: On-device for the sensitive meetings; Teams Copilot is fine for routine internal syncs where discoverability isn't a concern.
• You're a healthcare provider: Any discussion involving PHI is a reason to prefer on-device. Microsoft's cloud is HIPAA-eligible under BAA, but minimizing cloud-side PHI is the stronger posture.
• You're a financial advisor on a regulated-rep platform: You likely need durable retention anyway (FINRA 4511, SEC 17a-4). Teams Copilot with Purview may be the right fit — but you should be deliberate about what's recorded vs. what runs transcript-off.
• You're a general knowledge worker: Teams Copilot, Zoom AI Companion, and on-device tools all deliver useful recap and action-item functionality. Pick based on your existing stack and preferred retention posture.

Ready to Try an On-Device AI Notetaker?

Basil AI runs 100% on your Mac or iPhone. No cloud. No retention we control. No question about who else can see the transcript — because the answer is: nobody.