OneDrive is Microsoft's cloud file-storage service, governed by the Microsoft Privacy Statement, which states that files uploaded are processed to deliver the service, retained until the user actively deletes them, and that Microsoft retains, accesses, transfers, discloses and preserves personal data -- including the content of files in OneDrive -- when it has a good-faith belief this is necessary to comply with applicable law or valid legal process. For organisational tenants, Microsoft's OneDrive privacy documentation states customer data is not used to train AI models and remains within the tenant. Microsoft Corporation is a public SEC filer, and its cloud identity platform was the subject of the 2023 Storm-0558 incident in which a stolen signing key enabled access to customer email in Microsoft-hosted services.
TRACK RECORD
1 ENFORCEMENT ACTION
[2023-07-12]
The U.S. Cybersecurity and Infrastructure Security Agency and the FBI published a joint advisory (AA23-193A) on the Storm-0558 activity, providing detection guidance for the malicious access to Microsoft-hosted cloud email services.
The Microsoft Privacy Statement, updated July 2026, states that Microsoft uses data to operate and deliver its products, such as processing files uploaded to OneDrive so the user can access, edit and manage them, and that a document stored in OneDrive is maintained until the user actively deletes it.
Microsoft Corporation, OneDrive's operator, files audited annual reports with the U.S. Securities and Exchange Commission under CIK 789019; its most recent Form 10-K appears on the SEC's EDGAR filing index.
The Microsoft Privacy Statement states that Microsoft retains, accesses, transfers, discloses and preserves personal data, including the user's content such as the content of emails in Outlook.com or files in OneDrive, when it has a good-faith belief that doing so is necessary to comply with applicable law or respond to valid legal process.
In July 2023 Microsoft's Security Response Center disclosed that the China-based actor it tracks as Storm-0558 had acquired a Microsoft account consumer signing key and used forged authentication tokens to access customer email in Microsoft-hosted cloud services -- an incident in the identity layer shared by Microsoft's consumer cloud products.
The U.S. Cybersecurity and Infrastructure Security Agency and the FBI published a joint advisory (AA23-193A) on the Storm-0558 activity, providing detection guidance for the malicious access to Microsoft-hosted cloud email services.
Microsoft's OneDrive privacy, security and compliance documentation, updated 2026-05-18, states that none of an organisation's data is used or transferred by Microsoft to train AI models, large-language models, or any other models, and that the data remains securely within the organisation's tenant; OneDrive adheres to the Microsoft Privacy Statement and the Microsoft EU Data Boundary.