Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Copilot Keep Card Numbers It Sees on Screen?
Only in the conversation: Microsoft's page says Copilot can view your screen, so a card number on it reaches the model, and the page separates the image, which is not retained, from a stored transcript. Ask what that transcript holds and whether any control replaces the digits before the model reads them.
A card number sits in the middle of a page a person shares with Copilot, and the question the session leaves behind is whether the digits went with it. Copilot Vision exists to look at a screen or a camera feed and answer questions about what is there, so a card statement, a supplier invoice or a booking page that carries a card number is exactly the kind of page a person shares to get help reading it. Microsoft's page for the feature describes both halves: Copilot can view the screen, images are not retained, a transcript of the conversation is stored, and model responses are kept to monitor unsafe interactions. Those sentences answer different questions, and the distance between them is what a security team has to close before an agent is allowed near a payment page. The same split runs through Copilot in Edge at work, where page content used in a work profile may be stored under the organization's own data protection policies. For a card the stakes are specific: the number is the value a merchant's payment controls are built around, and a chat transcript that holds it is a store no cardholder-data review was asked about. What a buyer can settle is narrower than a promise that nothing is kept: which values the model received from the rendered page, who approved the action that followed, and what record can be produced months later.
Key findings
- For a card number on a shared screen to stay out of the session, the values on that rendered page would have to be replaced with consistent tokens before the model reads it, so the session holds CARD_001 and the real digits resolve only at an approved payment (What Is Render-Layer Tokenization?).
- It would also require a named person approving each payment or submission the session proposes, and a record of what the model received on every screen, kept where the security team can export it (Is Copilot Mode in Edge Safe to Use for Work?).
- The gap is the record: the Vision page names no per-screen log of what the model received, and a transcript shows what was said rather than which card numbers sat on the page (Microsoft, Vision, 2026).
- Microsoft's Copilot Vision page says Copilot "can view your screen or mobile camera feed", and the same page states "No images are retained, transcribed, or logged" (Microsoft, Vision, 2026).
- The Edge at work page puts prompts, responses and files inside the tenant when a work account signs in, and it adds that page content used "in a work profile" "may be stored and handled according to your organization's data protection policies" (Microsoft, Edge at work, 2026).
- GPT-4 and ChatGPT "reveal private information in contexts that humans would not" in 39% and 57% of cases, the rate at which a received value comes back out (Mireshghallah et al., 2024).
What does Copilot receive from a screen during a Vision session?
Take one record type: a card on a Copilot Vision session. The page shared might be a card statement, a supplier invoice with a card number in the remittance panel, or a booking page that shows the card on file. The number runs across the middle of the page, the expiry and security code sit in the panel below it, and a payee list and a balance sit beside it. The person sharing the screen asks one narrow question, such as what the amount due is or which reference belongs on the payment.
Microsoft's page describes the intake in plain terms: Copilot "can view your screen or mobile camera feed" (Microsoft, Vision, 2026). What reaches the model is the rendered view, not a parsed field list, so the card number arrives with every value drawn around it. A team that has governed only what a person types into a chat box has no control at this point, because the value was never typed.
That difference is why a substitution has to survive the model rather than stop at the source. Replacing identifiers with consistent pseudonyms and restoring them after the model has done its work keeps the task workable, and the record on masking reports that it cuts semantic utility errors by a factor of five against baseline techniques (Does Masking Data on Screen Break Browser Agents?).
| Piece of the shared page | What it holds | What the model receives |
|---|---|---|
| The card panel | Number, expiry, security code | The digits as drawn, in the viewport the task used |
| The statement block | Balance, due date, minimum payment | The amounts and the dates beside them |
| The payee list | Names and account references | Every row the page rendered |
| The conversation | The question and the answer | A transcript stored in the conversation history |
The task needs one value, the page renders a dozen, and the model receives the page.
What does the session keep after the screen is cleared?
Microsoft's page is explicit about the image. It states "No images are retained, transcribed, or logged", and it says that when the session ends "all shared context is cleared" (Microsoft, Vision, 2026). Those are the sentences a vendor review quotes, and they describe a real limit on the picture.
The same page does not stop there. It says "A transcript of your conversation with Vision is stored in your conversation history", and it adds one more store: "Model responses are being stored to enable monitoring of unsafe interactions" (Microsoft, Vision, 2026). A card number that appears in a question or an answer has a route past the session, while a number that stayed in the pixels does not. Which of the two happened is a fact about the conversation, and a person outside it has no way to tell.
The page reviewed is the consumer article as archived on June 25, 2026. The original address now redirects to a different Microsoft 365 Copilot vision article, so the quoted sentences belong to the archived copy. The article also describes the feature as something a person chooses to share into, which places the first decision with the person holding the screen rather than with a security team.
Two records follow, with different custodians. The image belongs to the session and is cleared. The transcript belongs to the conversation history, where the person can read it later and where the model responses sit beside it. A reviewer asking whether a card number survived has to ask about the second record.
What do the vendors themselves say?
Microsoft documents two surfaces, and they answer the retention question differently.
Copilot in Edge at work draws on page content. The page says a response can draw on "when allowed by your organization's settings, content from the current webpage", and that page content used "in a work profile" "may be stored and handled according to your organization's data protection policies" (Microsoft, Edge at work, 2026). It also says "you may see a consent dialog asking whether Copilot can access page content", which settles access rather than what is kept. Signed in with a work account, "Prompts, responses, and files stay within your tenant and aren't used to train foundation models" (Microsoft, Edge at work, 2026).
The consumer pages of two other vendors show what a retention term looks like when a vendor publishes one. Google's privacy hub says "Reviewed chats are retained for up to three years" and "Your activity is auto-deleted after 18 months" (Google, Privacy Hub, 2026), and it tells users "Please don't enter confidential information that you wouldn't want a reviewer to see", because "A subset of chats is reviewed by human reviewers". OpenAI's data controls page adds a limit that survives the switch: "Turning off Improve the model for everyone does not delete or hide saved chats" (OpenAI, Data controls, 2026).
| Question | Microsoft Copilot, per its pages | What to verify |
|---|---|---|
| What the model receives | The screen on Vision; permitted page content on Edge at work | Whether the whole viewport reaches the model |
| What happens to the image | "No images are retained, transcribed, or logged" | Whether the same holds for a work account |
| What is kept | A conversation transcript, stored model responses, work-profile content under organization policy | Which store holds a value that enters the exchange |
| Retention term | The Vision page states no term; the work profile defers to the organization | The term, in writing, for the tenant copy |
Read together, the pages describe a product that gathers the screen, keeps the conversation and hands the retention question to the organization in the work profile. The card number's fate depends on where it landed, which is not a question a consent dialog answers. The gap is not Copilot's alone: of the 86 AI security and data protection products in the October 2026 cross-vendor review, 36 describe a record of what the model was shown and 50 do not describe one in public documentation (How Many AI Security Products Control What an AI Agent Sees?).
What does the conversation record after the screen is cleared?
A transcript is a record of a conversation, not a log of a screen. It holds the question and the answer, and it does not hold the page as it rendered unless the exchange repeats it. That is how a session can clear the image and keep a card number: the number survives when the conversation touches it, and it goes with the pixels when the conversation does not.
What the transcript cannot do is answer the question an auditor asks, which is which values the model received on the page it read. That is the wall What Is the PII Wall? describes, where a workflow depends on a record the security team will not let a model see. A one-line exchange leaves the page's other values out of the record even though the model received them. The work profile adds a second copy under a different owner, held to the organization's own retention policy, and that is the copy an auditor can ask about (Microsoft, Edge at work, 2026).
Two further facts bear on what a session does with what it reads. EchoLeak, a zero-click exploit recorded against Microsoft 365 Copilot, established that a page can direct a request the client makes. Its authors describe a client that "automatically fetches the external image URL included by the attacker" (Reddy and Gujral, 2025). OpenAI's Atlas help page said the agent "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions" (OpenAI, Atlas, 2026), a confirmation that narrows where the agent acts without changing what the model read.
The difference between a session container and a per-screen log has a worked comparison on a retired product: Does OpenAI Dots Keep Screenshots of What It Did? reads the deletion path and the silence around images side by side.
What should a security team ask for in writing before a card is shared?
Ask in writing, because the pages reviewed separate access from retention, and a reader can easily take one for the other. Three questions cover the ground.
First, what does the model receive from a rendered screen, and is any value replaced before it reads? On the Microsoft pages the answer is the screen on Vision, or the permitted page content on Edge at work. Whether a control replaces the digits is a separate design question, and the record on masking shows that consistent placeholders leave the task workable (Does Masking Data on Screen Break Browser Agents?).
Second, which stores hold the exchange, for how long, and who can read them? Put the question to the Vision transcript, the stored model responses and the work-profile copy separately (Microsoft, Vision, 2026; Microsoft, Edge at work, 2026), then ask for the term, the access list and the export path for each one.
Third, does a browser reading the card page change the merchant's payment scope? PCI's FAQ on SAQ A eligibility limits the criterion to a merchant "with a webpage that includes a TPSP's/payment processor's embedded payment page/form", a scope that covers the embedded payment page and not the browser that reads it (PCI Security Standards Council, 2025). The scope question has its own record (Can ChatGPT Work Handle Cardholder Data Without Expanding PCI Scope?).
A written answer to those three questions is what a risk committee can act on. A consent dialog is a decision about access rather than a statement about retention.
What does a governed environment change?
A governed environment changes three things for a card on a rendered screen, and none of them is a promise about a vendor's goodwill.
The first is what the model receives. The page is drawn, and the values a policy names are replaced with consistent tokens before any model reads the screen, so the session holds CARD_001 where the card number sat. The task stays intact because the token is stable: the same CARD_001 appears on the statement, the payee row and the confirmation page, so the model can compare and reconcile without holding the digits.
The second is where the real value resolves. The digits are released only at an approved destination, at the moment a named person approves that payment. The session keeps the token, the destination receives the number, and the two records stay separate by design.
The third is the record. Every screen the model read, every action, and every approval with a name is exported to the organization, so a reviewer can answer the question a transcript cannot.
None of this depends on the consumer feature's retention term, and it does not ask the organization to trust that an image was deleted. It moves the question from what a vendor keeps to what the model was allowed to receive. A comparison page sets that against the browser controls Microsoft ships: RedactSure vs Microsoft Edge Copilot Mode walks through where each control sits.
What the record shows
The control that settles the title sits before the model reads the screen: values replaced on the rendered screen with consistent tokens, a named person approving the action that follows, and an exported record of what the model received on each page. Against that standard the Microsoft pages answer one half of the question well and leave the other half open. The image is not retained and the shared context is cleared, a real limit on the picture. The transcript and the stored model responses are kept, which is where a card number goes if the exchange touches it, and no page reviewed describes a per-screen log of which values were on the page. A security team can test this on its own tenant: open one card-bearing page in a Copilot session, ask one question that does not mention the number, then read the resulting conversation history beside the tenant's retention policy. The team should treat what that transcript holds as data the organization keeps.
Methodology and limitations
The page rests on public documentation: Microsoft's archived Copilot Vision support article and its Copilot in Edge at work article, OpenAI's data controls and Atlas help pages, Google's Gemini Apps privacy hub, the PCI SSC FAQ on SAQ A eligibility, and two research records, EchoLeak and a contextual-integrity study of model disclosure. Those pages were read between October 21, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
The products on this page are described from documentation and none was tested for this page. "Not described" means the pages reviewed, and vendor features change, so a buyer should re-read the pages before relying on them. RedactSure is deploying now with enterprise and government customers. The example describes a record type, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Copilot keep a card number it sees on screen?
Only in the conversation. Microsoft's Vision page says Copilot "can view your screen or mobile camera feed", so a card number on that screen reaches the model while the session runs, and the page says images are not retained and shared context is cleared when the session ends (Microsoft, Vision, 2026). What survives is the transcript and, separately, the model responses stored for monitoring. A number that never enters the exchange stays in the pixels and goes with them.
Is the screen image deleted when a Vision session ends?
Microsoft says it is. The page states "No images are retained, transcribed, or logged", and that when the session ends "all shared context is cleared" (Microsoft, Vision, 2026). That covers the picture. It does not cover the conversation, because the same page says a transcript is stored in the conversation history and that model responses are being stored. Read the two statements together and the session ends with its text intact.
Does Copilot in Edge at work keep the page content it reads?
The organization's policy decides. Microsoft says page content used "in a work profile" "may be stored and handled according to your organization's data protection policies", and that with a work account "Prompts, responses, and files stay within your tenant" (Microsoft, Edge at work, 2026). The tenant becomes the container, so the retention term is the one in your own agreement rather than a term on the consumer page.
What does the stored transcript actually contain?
The question and the answer, not the page. A transcript records what a person asked and what the model said, so a card number appears in it only if the exchange repeats the number (Microsoft, Vision, 2026). Values the model read but never mentioned stay out of the text, which is why a transcript cannot tell an auditor which values were on the screen during the session.
What should a security team ask for in writing about retention?
The store, the term, the reader and the export, asked about each store separately. Put the question to the Vision transcript, the stored model responses and the work-profile copy by name, then ask who can read each one and how it is deleted (Microsoft, Vision, 2026; Microsoft, Edge at work, 2026). A single answer that nothing is retained covers one store at most, and a consent dialog covers access rather than retention.
Can the card digits be replaced before the model reads the page?
Yes, when the control sits at the render layer. The page is drawn with consistent tokens such as CARD_001 in place of the number, the model works on the token, and the real digits resolve only at the destination a named person approved. The session then holds a placeholder, the payment still reaches the card it was meant for, and the record shows both sides of that exchange.
How RedactSure Keeps a Card Number Out of the Session Record
A card that renders on a shared screen sits in the model's context for the whole session, and the pages reviewed describe no step that replaces it there. Microsoft's page says the Vision transcript is stored in conversation history.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the shared screen rendered the card number, the model received the viewport, and the number stayed in the session. Inside a governed environment the page renders CARD_001 in place of the number before any model reads it, and the real digits resolve only at the payment a named person approved. The record shows the screen as tokens and the approval with a name.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A card that renders on a shared screen stays in the model's context for the run. Bring one page from your own workflow and see, with test values, what the model reads, who approves the payment, and what the record holds. Book a demo