Microsoft says it protects personal data with security technologies, limited access and encryption
Microsoft states it is committed to protecting the security of your personal data and uses a variety of security technologies and procedures to help protect it from unauthorized access, use or disclosure. As examples, it stores personal data you provide on computer systems with limited access in controlled facilities, and it protects highly confidential data, such as a credit card number or password, with encryption when transmitting it over the internet. These are described as help to protect, not a guarantee.
Supporting quotations
Microsoft is committed to protecting the security of your personal data and uses a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure.
we store personal data you provide on computer systems that have limited access and are in controlled facilities
When we transmit highly confidential data (such as credit card number or password) over the internet, we protect it through the use of encryption.
Qualifications & exceptions
The commitment is to "help protect"; it does not promise against all loss.
Encryption is stated for highly confidential data sent over the internet.
Security & Safeguards · Company practice
Other listed cookies store choices, authenticate sign-in, identify sessions and balance server load
The cookie list also includes MSCC, which holds user choices for most Microsoft properties; ESTSAUTH, ESTSAUTHLIGHT and ESTSAUTHPERSISTENT, which help authenticate you when you sign in with a Microsoft account; MS0, which identifies a specific session; MR, which resets or refreshes the MUID cookie; and several cookies for load balancing and routing a session to the same server. These are operational cookies and the statement does not tie them to advertising.
Supporting quotations
Contains user choices for most Microsoft properties.
Helps to authenticate you when you sign in with your Microsoft account.
Identifies a specific session.
Resets or refreshes the MUID cookie.
Identifies a gateway for load balancing.
Used for load balancing purposes and to ensure requests for a user session are handled by the same server.
Security & Safeguards · Company practice
Security cookies are listed; cookies of affiliates and partners such as LinkedIn and Xandr may be used
The cookie list includes security cookies (esctx, _RequestVerificationToken, .AspNetCore.Correlation and .AspNetCore.Nonce) that assist with the security of your website visit and stability of services by helping prevent fraud and malicious attacks. Microsoft says it may also use the cookies of other Microsoft affiliates, companies and partners, such as LinkedIn and Xandr.
Supporting quotations
Assist with the security of your website visit and stability of the services provided to you by helping prevent fraud and malicious attacks.
We may also use the cookies of other Microsoft affiliates, companies, and partners, such as LinkedIn and Xandr.
Qualifications & exceptions
Use of affiliates' and partners' cookies is stated as "may".
Security & Safeguards · Company practice
Password Monitor sends hashed, encrypted credentials to check for breaches and does not keep them after the check
If you turn on Microsoft's Password Monitor, your saved credentials are hashed, encrypted and sent to the Password Monitor service so Microsoft can warn you if they were detected in a malicious attack or breach. Microsoft states it does not retain this data after the check is complete.
Supporting quotations
If you have turned on Microsoft’s Password Monitor, your saved credentials are hashed, encrypted, and sent to the Password Monitor service so that we can warn you if your credentials were detected in a malicious attack or a breach.
We do not retain this data after the check is complete.
Qualifications & exceptions
Applies only if you turn on Password Monitor.
Security & Safeguards · Company practice
Device encryption backs up your BitLocker recovery key to your Microsoft account, and Microsoft says it does not use it
Device encryption uses BitLocker to encrypt the drive Windows is installed on and generates a recovery key. The BitLocker recovery key for a personal device is automatically backed up online and associated with your personal Microsoft account. Microsoft states it does not use your individual recovery keys for any purpose.
Supporting quotations
When device encryption is on, Windows encrypts the drive Windows is installed on and generates a recovery key.
The BitLocker recovery key for your personal device is automatically backed up online and associated with your personal Microsoft account.
Microsoft doesn't use your individual recovery keys for any purpose.
Qualifications & exceptions
Backup is automatic for personal devices signed in with a personal Microsoft account.
Security & Safeguards · User right or choice
The malware removal tool runs monthly and reports malware and device data to Microsoft unless you turn it off
The Malicious Software Removal Tool runs on your device at least once a month as part of Windows Update, checks for specific prevalent malware and helps remove it. During a malware check, a report with data about detected malware, errors and other data about your device is sent to Microsoft. You can turn off the reporting feature if you do not want to send this data.
Supporting quotations
MSRT runs on your device at least once per month as part of Windows Update
During a malware check, a report will be sent to Microsoft with specific data about malware detected, errors, and other data about your device.
You can turn off MSRT's reporting feature if you do not want to send this data to Microsoft.
Qualifications & exceptions
Reporting can be turned off.
Security & Safeguards · Company practice
SmartScreen and Smart App Control send web addresses and file names, hashes, locations and certificates to Microsoft
Microsoft Defender SmartScreen identifies threats from unsafe websites, apps and files, and when checking content it sends relevant data, including web addresses and, if needed, details about suspicious sites or apps, to Microsoft for security analysis. Microsoft says this data is used only for security purposes such as detecting and responding to security incidents, identity theft, fraud or other malicious activity. Smart App Control, where supported, starts in evaluation mode using data collected by SmartScreen (file names, hashes, download locations and digital certificates) to decide whether it suits your device, and is enabled automatically if the device qualifies. When either checks a file, data about the file, including its name, a hash of its contents, download location and digital certificates, is sent to Microsoft. You can turn SmartScreen and Smart App Control on or off in the Windows Security app.
Supporting quotations
When checking content, it sends relevant data—including web addresses and, if needed, details about suspicious sites or apps—to Microsoft for security analysis.
This data will only be used for security purposes in detecting, protecting against, and responding to security incidents, identity theft, fraud, or other malicious, deceptive, or illegal activities.
If your device qualifies, Smart App Control is automatically enabled for added protection; otherwise, it remains permanently off.
data about that file is sent to Microsoft, including the file name, a hash of the file’s contents, the download location, and the file’s digital certificates
You can turn Smart App Control on or off in the Windows Security app.
Qualifications & exceptions
Smart App Control is enabled automatically if your device qualifies; otherwise it stays off.
Data use is stated as for security purposes only.
Security & Safeguards · User right or choice
Microsoft Defender Antivirus sends malware reports and possibly suspicious files, asking before sending personal data
Microsoft Defender Antivirus automatically activates when no other antimalware software is running and scans for malware, unwanted software and harmful apps. When it is on or running, it automatically sends reports to Microsoft with data about suspected malware, unwanted software, potentially unwanted apps and other malicious content, and may also send files that could contain malicious content for further inspection. If a report may contain personal data, you are asked for permission before it is sent. You can choose to disable reporting and file sharing with Microsoft.
Supporting quotations
When Microsoft Defender Antivirus is turned on or otherwise running, it automatically sends reports to Microsoft with data about suspected malware and other unwanted software, potentially unwanted apps, and other malicious content.
It may also send files that could contain malicious content, such as malware or unknown files for further inspection.
If a report may contain personal data, you'll be asked for permission before it’s sent.
You can choose to disable reporting and file sharing with Microsoft.
Qualifications & exceptions
Reporting is automatic while Defender Antivirus is running, unless you disable it.
Permission is asked only for reports that may contain personal data.