Microsoft and Anthropic both say they don't train their models on business customers' data. The safer setup is the one that reaches only the information a task needs, can't take actions you haven't approved, and runs on terms you've checked.
For a firm that already runs on Microsoft 365, Copilot is usually the lower-effort choice. It uses the permissions your IT provider already manages, and IT already supports it, which is a good reason to start there. Fix overshared SharePoint and Teams folders first: Copilot can find anything a user already has permission to open, so a folder shared with the whole company becomes easy for anyone to search. Claude's business plans can be equally safe when each connection is limited to what the task needs.
The choice is often about the interface and its settings more than whose model sits underneath. Microsoft says Anthropic's Claude models are available in Microsoft Copilot features such as Researcher and Copilot Studio. It turns them on by default for most commercial customers outside the EU and UK, and admins can switch them off.
This article compares business Copilot, used with a work account, with Claude Team and Enterprise. Consumer versions and individual Claude plans need their own review.
Five questions to compare
| Question | What to find out | Why it matters |
|---|---|---|
| Will what we put in train their models? | The terms for the exact business product | Training is only one part of how data is handled |
| What can it read? | The files, systems and permissions the person or connection can reach | Broad access can expose more than the task needs |
| Can it change anything? | Which actions are switched on, and what needs approval | Drafting a message is different from sending one |
| What's kept afterwards? | Chat history, how long it's kept and who in your company can see it | Data kept out of training can still be stored |
| Where is information processed? | The agreement and settings that apply to you | A Canadian office doesn't mean processing stays in Canada |
Answer these for both setups and compare the answers. Brand names don't answer any of these.
Training on your data
Microsoft says business Copilot information is not used to train the underlying AI models. Anthropic says commercial Claude data is not used for training unless the customer joins its Development Partner Program, which is optional. Check whether your company has joined.
These promises have limits. They don't make a particular client file appropriate to upload, and they don't mean every connected service follows the same terms.
Personal accounts are the bigger risk
The bigger everyday risk is staff using personal or free accounts that sit outside company controls. The business-plan promises above don't cover those accounts.
On personal ChatGPT accounts, a setting called Improve the model for everyone decides whether new conversations can be used to train OpenAI's models. Anthropic announced on August 28, 2025 that users of its Free, Pro and Max plans choose whether their chats can be used to improve Claude. In both cases the employee makes that choice, and your company can't see or change it. Giving staff an approved business account removes the reason to use a personal one.
What it can reach
Microsoft says Copilot follows each user's existing permissions. Before you switch it on, ask IT to list the SharePoint sites and Teams shared with everyone in the company, and tighten any that hold client, HR or financial files.
Claude's custom connectors can read information and take actions. Some connections use each employee's own permissions. Others use one shared login, which can let everyone reach every file that login can see. Check how each connection is set up.
Take a made-up example: preparing for a client meeting. The assistant needs the approved agenda and recent project notes. It doesn't need other clients' folders. Start with only the records the task needs, then check that the assistant flags missing information instead of filling it in.
The same goes for actions. A drafted follow-up is useful while a person still presses send. Decide where that line sits and check that the settings enforce it.
Storage and location
Copilot keeps a history of interactions under Microsoft's documented data-handling terms. For either product, check how long data is kept on your plan and who in your company can see it. A statement about model training doesn't answer that.
Treat Canadian data residency the same way. Get the terms for the service and setup you chose. Ask where information is stored and processed, and whether any connected service changes that.
The client confidentiality checklist helps you prepare that review with your IT provider and whoever owns your client obligations.
Start small
Our advice: pick one useful task, limit the information and actions it gets, and check the results before you widen access. For a client brief, success means every fact traces back to a source and no unsupported promises get in.
If you haven't picked a task, try the free AI Opportunity Map. For the wider choice of tools, read Copilot vs ChatGPT vs Claude: which is safer?
To talk it through, bring one task. We'll work out what access and actions it needs, and which questions your IT provider has to settle. A description of the information involved is enough, so there's no need to send files.
Sources checked October 12 and 16, 2026. Microsoft privacy documentation updated August 18, 2026; Microsoft's Anthropic models page updated September 18, 2026; Anthropic commercial-data guidance dated March 16, 2026. Other product pages may change.