Question 1

Where does Microsoft Dragon Copilot store patient data?

Accepted Answer

Data at rest by customer location: US->US; Canada->Canada; UK->UK; France/Ireland/Belgium->France, EU; Germany/Austria/Netherlands/Switzerland->Germany, EU. Australia is not listed in the published data-at-rest table Published statement: "Microsoft Dragon Copilot stores Customer Data at rest as outlined below. … US | US · Canada | Canada · UK | UK · France, Ireland, Belgium | France, EU · Germany, Austria, Netherlands, Switzerland | Germany, EU" (source: https://learn.microsoft.com/en-us/industry/healthcare/dragon-copilot/whitepapers/privacy, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 2

Where does Microsoft Dragon Copilot process data?

Accepted Answer

US customer data replicated between two US data centres; Microsoft states data never leaves a geography Published statement: "In the US, data is replicated between two data centers to keep data current. However, data never leaves a geography." (source: https://learn.microsoft.com/en-us/industry/healthcare/dragon-copilot/whitepapers/security, checked 2026-09-25). EU customer data stored and processed within the EU Data Boundary (Dragon Copilot is an 'EU Data Boundary Service') Published statement: "Dragon Copilot is an “EU Data Boundary Service” and stores and processes Customer Data within the EU Data Boundary" (source: https://learn.microsoft.com/en-us/industry/healthcare/dragon-copilot/whitepapers/privacy, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 3

Which AI models does Microsoft Dragon Copilot use?

Accepted Answer

Microsoft states Dragon Copilot's AI/ML models are trained solely on anonymized data (customer data anonymized within 90 days in a designated research environment) Published statement: "Dragon Copilot's AI/ML models are trained solely on anonymized data." (source: https://learn.microsoft.com/en-us/industry/healthcare/dragon-copilot/whitepapers/privacy, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 4

What certifications does Microsoft Dragon Copilot publish?

Accepted Answer

Azure-platform compliance cited in Dragon Copilot security white paper: HITRUST CSF, HIPAA, ISO 27001/27017/27018, FedRAMP, SOC 1/2/3, GDPR, C5 (Germany), HDS (France), revFADP (Switzerland), Cyber Essentials Plus (UK) Published statement: "Microsoft Azure supports compliance efforts related to more than 65 national, regional, and industry-specific requirements governing the collection and use of individuals' data" (source: https://learn.microsoft.com/en-us/industry/healthcare/dragon-copilot/whitepapers/security, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 5

Which subprocessors does Microsoft Dragon Copilot name?

Accepted Answer

Disclosed in Microsoft's Health and Life Sciences Subprocessor list on the Service Trust Portal (servicetrust.microsoft.com) Published statement: "Microsoft uses subprocessors to process Customer Data on Microsoft's behalf in its provision of Dragon Copilot. These subprocessors are disclosed in in the Health and Life Sciences Subprocessor list." (source: https://learn.microsoft.com/en-us/industry/healthcare/dragon-copilot/whitepapers/privacy, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 6

What does Microsoft Dragon Copilot publish about TGA status?

Accepted Answer

Not found on public pages. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere. Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 7

Which practice management systems does Microsoft Dragon Copilot list as integrations?

Accepted Answer

EHR integration offered via 'Dragon Copilot embedded' (EHR partners integrate capabilities in their EHR); no specific PMS products named on checked pages Published statement: "Dragon Copilot embedded – EHR partners can integrate Dragon Copilot capabilities to record and review an encounter, surface information and automate tasks directly in their EHR." (source: https://learn.microsoft.com/en-us/industry/healthcare/dragon-copilot/whitepapers/security, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 8

Which Australian or New Zealand entity does Microsoft Dragon Copilot contract through?

Accepted Answer

Not found on public pages. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere. Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 9

What support hours does Microsoft Dragon Copilot publish?

Accepted Answer

Not found on public pages. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere. Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Microsoft Dragon Copilot

Data storage region

Data processing region

Model provenance

Subprocessors

Certifications

TGA status

PMS integrations

ANZ entity

Support hours

What Microsoft Dragon Copilot publishes — answered from the record

Something wrong or out of date?