Is Microsoft 365 Copilot safe for business? Copilot vs seef

What does Microsoft 365 Copilot do with company data?

Copilot works inside your own Microsoft 365 tenant, within each user's permissions. With a licence it searches mail, calendars, Teams chats and files in SharePoint and OneDrive automatically. Microsoft states that prompts, responses and that data are not used to train the language models. They fall under the same data processing agreement as your mail and files. Copilot keeps prompts and answers as activity history, and admins set its retention in Microsoft Purview.

The free Copilot Chat does not search your company data by itself. It answers from the web and from whatever you upload or have open in Outlook and Teams.

What is the Copilot oversharing risk?

Copilot can surface any document an employee has access to. A salary sheet in a folder open to the whole organisation used to go unnoticed; with Copilot it can turn up in an answer. Microsoft's Copilot deployment blueprint starts with fixing oversharing for that reason.

Before a wide rollout:

• Find sites and folders open to everyone in the organisation, for example through “Everyone except external users”, and narrow them.
• Limit discovery of sensitive sites for now with Restricted Content Discovery, part of SharePoint Advanced Management, which comes with a Copilot licence. Existing access stays in place.
• Protect sensitive files with Microsoft Purview sensitivity labels that apply encryption; Copilot respects the usage rights they grant.
• Start with a pilot group and check the audit logs for what Copilot surfaces.

Does Copilot keep data in the EU?

Largely, yes. For EU customers Copilot is an EU Data Boundary service: Microsoft stores and processes the data within the EU and EFTA, apart from limited documented transfers. The exceptions to check:

• Flex routing lets the model run in the US, Canada or Australia at peak load. It is on by default for eligible tenants created after 25 March 2026; older tenants should check the setting.
• Claude models from Anthropic sit outside the EU Data Boundary. In the EU the general setting for them is off by default, but a separate setting for Word, Excel and PowerPoint is on by default for tenants created after 25 March 2026, and older tenants may have it on too, so check both.
• Web searches go to Bing, where Microsoft acts as an independent controller, not as your processor.

Is Microsoft 365 Copilot GDPR compliant?

No tool is compliant on its own, but Copilot has been examined closely. Privacy Company assessed the paid licence in a DPIA for the Dutch government (SLM Rijk, E5 setup). The second update of 27 May 2026 finds 2 medium and 9 low risks, down from 4 high risks in 2024. The medium ones: possibly inaccurate personal data in answers, and insufficiently justified retention of pseudonymised diagnostic data for up to 18 months.

The report advises switching off web search through Bing and lists central blocking of the free Copilot Chat as a mitigation. Your lawful basis, records and, where needed, your own DPIA remain your work.

How much does Microsoft 365 Copilot cost per user?

Copilot Chat is included at no extra cost in eligible Microsoft 365 plans. Copilot in Word, Excel, Outlook and Teams, with access to your company data, costs per user per month, excluding VAT:

• Copilot Business, added to a Business plan of up to 300 users: €18.20 billed annually, €21.84 monthly. Promotion: until 31 December 2026, existing customers on an eligible Business plan pay €15.60 in the first year of an annual plan.
• Business Standard and Copilot Business as a bundle: €20.36 billed annually, €24.43 monthly.
• Microsoft 365 Copilot on enterprise plans: €26.00 billed annually.
• Advanced features such as Cowork: billed by usage, on top of the licence.

Is Copilot safer than ChatGPT Business?

That depends more on your setup than on the brand. By default neither Copilot nor ChatGPT Business trains on your data, and both come with a data processing agreement. Copilot can process EU customers' data within the EU and EFTA; with ChatGPT that takes Enterprise. Copilot sits in Outlook, Teams and Word and reaches everything a user can open, while ChatGPT is a separate workspace that reaches only what people upload or connect. seef, compared below, works from a knowledge base you fill.

How is seef different from Copilot?

seef answers from a knowledge base you fill on purpose, so AI reaches only the documents you chose.

When is Copilot the better choice?

When your company already works in Microsoft 365 and the gain is in mail, meetings and documents. Copilot summarises Teams meetings, drafts in Word and Outlook and searches across all your sources. There is no new vendor, and the standard service runs under the Microsoft agreement you already have.

Copilot follows the permissions you already have in SharePoint, OneDrive and Exchange. That works well when those permissions are in good order.

When does seef fit better?

When you want a private AI assistant for your company's knowledge, with a clear boundary around what it can reach. In seef, AI answers from a knowledge base you fill from SharePoint or Google Drive. Only what you put in is reachable, so a folder shared too widely elsewhere in Microsoft 365 stays out of reach, and you can start without first fixing permissions there.

People sign in with their Microsoft 365 or Google Workspace account, and answers from the knowledge base show the documents behind them. Beyond search, seef summarises, prepares recurring work and runs agents your team shares. You choose the model with us, including models hosted in the EU, and you decide when to move to a newer one.

Need a knowledge base per team, processing only in the EU or hosting on your own servers? We set it up that way and record it in the data processing agreement. seef is a service of Timformatie, certified to ISO 27001:2022 and NEN 7510-1:2024. Pricing is per user, by quote, and you usually start with a small group. The security page describes the standard setup.