Sluis vs Microsoft 365 Copilot for EU organisations

Microsoft 365 Copilot (Microsoft now calls it Microsoft Copilot, and both names appear in its documentation) is an AI assistant built into Word, Excel, PowerPoint, Outlook and Teams, grounded in content your people can already open. Sluis Workspace is a separate employee AI workspace, run from the EU, behind a policy gate: every model call is inspected, routed by residency policy and written to an audit chain. They answer different questions, and some organisations will use both.

This page is written by Sluis, so read our claims with suspicion. Every Microsoft statement comes from Microsoft's own documentation, checked on 1 October 2026 and listed under Sources. For the wider field, see European ChatGPT alternatives for organisations.

At a glance

	Sluis Workspace	Microsoft 365 Copilot
Operator	Sluis by SevenLab, legal entity 7Lab B.V., Amsterdam	Microsoft Corporation, headquartered in the United States
Hosting	EU-hosted managed service	Microsoft 365 tenant; EU Data Boundary service for EU customers
Routing control	EU-only by default, enforced per request: a request to a provider outside your allowed set is refused with a 403	Model calls go to the closest region and can reach others when capacity is tight; EU traffic stays in the EU Data Boundary
Provider ownership	Separate "EU-owned only" restriction	Admins can switch third-party model subprocessors such as Anthropic on or off; no EU-ownership filter is documented
Model choice	Several providers, allow-list per organisation, your own keys	Microsoft-managed router; OpenAI and Anthropic models as subprocessors
Personal data before the model	Detected and reversibly pseudonymised before dispatch	Permissions, sensitivity labels and Purview controls
Audit	Hash-chained ledger you can verify offline	Interactions kept for eDiscovery, retention and Purview
Price model	Provider list price plus 10%, no seat fee, prepaid	Per-user add-on to a qualifying Microsoft 365 licence
Certification we can cite	ISO 27001 certified	ISO 27001, ISO 42001 and others, per Microsoft

Where your data goes

Microsoft. Copilot is documented as an EU Data Boundary service: for EU users, traffic stays inside the boundary, and Microsoft says prompts and responses are not used to train foundation models. Two details need a close read. Model calls go to the closest data centres but can reach other regions during high utilisation. And models from Anthropic, a Microsoft subprocessor, are excluded from the EU Data Boundary. For EU, EFTA and UK tenants the Anthropic subprocessor setting is off by default, but a separate admin setting for Copilot in Word, Excel and PowerPoint is on by default for tenants created after 25 March 2026, and older tenants should check the Message Center. Microsoft's boundary documentation also notes limited circumstances in which data is still transferred out.

Sluis. The managed service is hosted in the EU, and routing defaults to EU-only. Allowing other jurisdictions is an explicit, audited decision that needs a transfer-terms acknowledgement. EU hosting and EU ownership are separate controls: a Google Vertex deployment in an EU region is still US-owned, so organisations that need EU ownership turn on the EU-owned-only restriction. Two limits on our side: Workspace web search queries leave the residency boundary, so keep web search off for an EU-only policy, and Agent Harness model traffic (local coding agents) is recorded with an unverified region rather than enforced. See security and compliance and residency and models.

The difference is the control point. With Copilot, residency is a contractual, tenant-level commitment you check against documentation. With Sluis it is a policy evaluated on each request.

Jurisdiction and the CLOUD Act

Storing data in the EU does not remove exposure to a non-EU legal order. The US CLOUD Act reaches data in a provider's possession, custody or control wherever it sits, so what matters is who controls the provider. Our CLOUD Act guide walks through an assessment.

Microsoft states that it is headquartered in the United States and serves Europe through European corporate entities. It has published a commitment to challenge government demands for EU public sector and enterprise customer data where it has a legal basis, and says it will compensate customers if it discloses data in violation of EU law. Read the commitment in your contract.

Sluis is a Dutch company, but that is not the whole answer: if your policy allows a US provider, that provider's exposure applies to what you send it. Sluis also pseudonymises personal data before dispatch, so a provider sees placeholders. Detection is not perfect, and using Sluis does not by itself establish GDPR compliance. See personal data in prompts.

Cost: seats versus usage

Microsoft's enterprise pricing page lists Microsoft 365 Copilot at US$30.00 per user per month on an annual subscription, excluding tax, as an add-on to a qualifying Microsoft 365 licence. Euro prices and bundles differ, so check your region. Copilot Chat with enterprise data protection is included for Entra users on an eligible subscription, so the add-on buys in-app features and organisation-wide grounding, not a chat window.

Sluis charges the provider's list price plus 10% for managed models, or €0.50 per 1M input and output tokens in Sluis fees with your own key (provider charges are separate). There is no subscription and no seat fee, and no free tier: self-service starts with at least €25 of prepaid credit, and payment-method surcharges apply. See pricing.

The arithmetic: if a person uses a given amount of model capacity at list price, Sluis costs that amount times 1.1. Against a US$30 seat, Sluis is cheaper when average monthly usage at list price is below roughly US$27, ignoring tax, currency and the Microsoft 365 licence you need either way. Heavy, uniform use favours the seat; light or uneven use, and teams with AI agents that need no licence per head, favour usage. A fixed seat price is also easier to budget.

Models, admin control and audit

Copilot's router picks a model per prompt, with Auto, Quick response and Think deeper modes. Its main strength is administration: it only surfaces content a user can already open, honours sensitivity labels, and admins use Purview for retention, content search and eDiscovery. If SharePoint oversharing is a problem, Copilot will surface it.

Sluis connects models from several providers, including EU-owned ones such as Mistral, Scaleway and Nebul. Owners allow the full catalogue or a chosen set, and set a monthly euro budget per member and which capabilities (attachments, document creation, web search, MCP tools, sub-agents) are on. Every call goes to a hash-chained ledger you verify offline, and content can be erased while the proof remains. Members sign in with Microsoft, Google or Apple, and owners can require two-factor authentication. Sluis has no SAML single sign-on or SCIM provisioning and no deep in-app integration with Word, Excel and Outlook. The desktop apps are alpha builds; Workspace itself runs in the browser.

When Microsoft 365 Copilot is the better choice

Pick Copilot if most of your work happens in Word, Excel, PowerPoint, Outlook and Teams and you want AI in those apps. Pick it if your content and permissions already live in Microsoft 365 and grounding on your own mail, files and meetings matters more than model choice. Pick it if Purview integration and a single vendor relationship are requirements, or if per-seat budgeting is. Pick it if a US-headquartered vendor with strong EU contractual commitments passes your assessment. Sluis is a young company with a young product; Microsoft has a track record we do not.

FAQ

Is Microsoft 365 Copilot GDPR compliant?

Microsoft states that Copilot complies with its existing commitments to Microsoft 365 commercial customers, including GDPR and the EU Data Boundary. Compliance for your own use depends on your configuration, contract and assessment. Sluis's documentation says the same about Sluis.

Does Copilot keep EU data in the EU?

For EU customers Microsoft documents EU traffic staying within the EU Data Boundary. Documented exceptions include Anthropic models, which are processed outside it, and capacity-driven routing that can reach other regions. Check your tenant's Anthropic settings.

Is Sluis a replacement for Copilot?

Usually not. Sluis is a standalone, model-neutral workspace and governed API gateway, and it does not put AI inside Word, Excel or Outlook. Many organisations keep Copilot for Office work and use Sluis for sensitive workloads, agents and API traffic.

Does Sluis expose me to the CLOUD Act?

Sluis is a Dutch company and its default routing allows only EU providers. Exposure depends on which providers you allow: a US-owned provider is reachable only after an explicit opt-in, and the EU-owned-only restriction excludes them even in EU regions.

What does Sluis cost compared with Copilot?

Copilot is listed at US$30 per user per month on an annual subscription. Sluis has no seat fee and charges provider list price plus 10%, which is cheaper below roughly US$27 of monthly list-price usage per person and dearer above it.