Gemini for Google Workspace vs Microsoft 365 Copilot

Gemini for Google Workspace

There is a clear written statement that company data in Gemini 'is not used to train models', and the privacy notice covers Workspace with a dedicated GDPR section — the kind of commitment my council wants in writing. But we found no public information on retention periods for chats and files, on zero-retention options, on abuse-monitoring retention, or on the terms of the referenced Service Data Addendum.

Microsoft 365 Copilot

The product documentation states that prompts, responses and data reached through Microsoft Graph are not used to train foundation models, that Copilot services have opted out of abuse monitoring with human review, and that a downloadable Data Protection Addendum plus ISO 27001 and ISO 42001 certifications stand behind this. Stored prompts and responses are encrypted, personal data in system-generated logs must be pseudonymised, retention runs at the minimum time required per log type, users can delete their own Copilot history and admins manage stored data through Purview — pseudonymised logs are precisely what a works council needs. However, the general privacy statement says Microsoft may use your data to develop and train AI models, so the captured pages give different statements on training, and I found no public information on zero-retention terms with the named model providers.

Gemini for Google Workspace

Gemini is the named assistant across Gmail, Docs and Meet, but we found no public information on where inference runs or through which provider. 'Enterprise data regions' appears as a feature name on the pricing page with no stated EU processing commitment for the assistant or its models.

Microsoft 365 Copilot

OpenAI and Anthropic are named as model subprocessors, and EU tenants get storage and LLM processing inside the EU Data Boundary under commitments written into the Product Terms since March 2024. Against that, Anthropic models are excluded from the boundary, some data continues to be transferred outside it in limited circumstances, and models can be upgraded automatically — and I found no public information on an admin option to pin processing to the EU across all models, exclude a provider, or bring one's own key or cloud.

Gemini for Google Workspace

The tier pages document genuine governance levers — data loss prevention, context-aware access, endpoint management tiers, Vault for retaining and searching data, eDiscovery — which is more than a simple team workspace. But we found no public information on single sign-on and provisioning, group-level control over which AI agents colleagues may use, audit logs, or usage reporting that can be aggregated or pseudonymised for a works-council agreement.

Microsoft 365 Copilot

Retrieval honours the individual user's view permissions in both the Semantic Index and grounding, tenants are isolated through Entra authorization and role-based access control, and admins decide which agents and connected experiences staff may use, with Microsoft 365 usage reports available through PowerShell. I found no public information on single sign-on with SCIM provisioning stated in so many words, group-level permissions per agent or connector, exportable audit logs, or usage reporting documented as aggregatable or pseudonymised for a works-council agreement — the last point is where a co-determination conversation would start.

Gemini for Google Workspace

The assistant is embedded across the suite's own applications — Gmail, Meet, Chat, Calendar, Drive, Docs and more — with Office file interoperability, a migration tool and a no-code app platform with advanced integrations. We found no public information on connectors to third-party knowledge systems, sync behaviour, a documented API for the assistant, or how answers cite their sources.

Microsoft 365 Copilot

The Copilot connectors framework brings external systems into Microsoft Graph through a documented five-step build, a connectors API, SDKs, code samples and a quick start, with change notifications and Teams bots to embed the assistant in other tools. Grounded answers carry citations, and the stored data explicitly includes citations to the sources used, so staff can see where an answer came from.

Gemini for Google Workspace

Workspace Studio is marketed as automating the workday with 'intelligent AI agents' on every plan, and an add-on promises more automations — but that is a tagline, not documentation. We found no public information on run logs, testing before release, stated failure limits, or a human approving consequential actions, which are exactly the written rules a council needs before agents touch colleagues' work.

Microsoft 365 Copilot

Agents are built without code on a visual canvas in Copilot Studio and the Agents Toolkit, run across Copilot, Teams and third-party messaging channels, and admins control which agents are allowed, with jailbreak and cross-prompt-injection classifiers and content filters as guardrails. But I found no public information on human approval before consequential actions, a log of each run, triggers or schedules, or the vendor's own statement of what agents must not be trusted with — a human approving what an agent does to a colleague is my condition for signing off, and nothing captured addresses it.

Gemini for Google Workspace

Google LLC of Mountain View, USA is the vendor, and the captured privacy pages name Google itself as processor while flagging US Cloud Act exposure; no EU contracting entity such as an Irish subsidiary is stated anywhere captured. A privacy notice exists with a GDPR section, but hosting location is not confirmed on the vendor's own captured pages and the model providers behind the product are not named in a subprocessor list.

Microsoft 365 Copilot

EU storage and processing inside the EU Data Boundary is a Product Terms commitment covering Microsoft 365 Copilot on Azure regions, with OpenAI and Anthropic named as model subprocessors and a downloadable Data Protection Addendum offered. Against that stand the US parent in Redmond, a contracting entity whose jurisdiction the captured pages do not state, the exclusion of Anthropic models from the boundary, and continuing transfers outside it in limited circumstances.

Gemini for Google Workspace

Three tiers are publicly priced — Starter €6.80, Standard €13.60 and Plus €21.10 per user per month, with a stated 50% off for 3 months, a 300-user cap on those plans and a 16% annual-commitment saving — so much of the bill is computable. But add-ons such as AI Expanded Access and Assured Controls are 'sold separately' without prices, we found no public information on an Enterprise price or on overage and AI usage rates beyond daily audio-overview limits, and paid support upgrades are listed without figures.

Microsoft 365 Copilot

The licensing pages name the eligible base plans, an add-on for organisations up to 300 users with an annual commitment, and education and government purchasing channels, but no captured page states a price per seat, usage limits, or what scales the cost. A company cannot compute its annual spend from these pages alone.