// Trust & Security Report
Power Automate
by Microsoft Corporation
Microsoft Power Automate (part of Microsoft Power Platform, alongside Power Apps, Power BI, and Power Pages). Sub-products: Power Automate Free/Community, Power Automate Premium (cloud flows + attended desktop flows), Power Automate Process (unattended desktop flows / RPA bots), and Power Automate as bundled in Microsoft 365 / Dynamics 365 plans. Includes Copilot-powered natural-language flow creation.
Certifications held
9
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on learn.microsoft.com“ISO/IEC 27001:2022 specifies the requirements for implementing, maintaining, monitoring, and continually improving the ISMS.”
Verify on learn.microsoft.com“For links to audit documentation, see Audit reports and certificates.”
Verify on learn.microsoft.com“These documents demonstrate that Microsoft online services in scope for the audit have incorporated ISO/IEC 27018 controls for the protection of PII.”
Verify on learn.microsoft.com“Once mapped, the ISO/IEC 27701 operational controls are implemented by privacy professionals and audited by internal or third-party auditors resulting in a certification and comprehensive evidence of conformity.”
Verify on learn.microsoft.com“Services in scope... Azure, Dynamics 365, Microsoft 365, Power Platform. ... The Azure PCI DSS audit documentation covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services.”
Verify on learn.microsoft.com“Cloud services in audit scope Global CIS Benchmarks CSA STAR Attestation CSA STAR Certification CSA STAR Self-Assessment ISO 20000-1 ISO 22301 ISO 27001 ISO 27017 ISO 27018 ISO 27701 ISO 9001 SOC 1 SOC”
Verify on learn.microsoft.com“Microsoft in-scope cloud platforms and services ... Power Automate cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite ... Microsoft offers its covered entity and business associate customers a Business Associate Agreement that covers in-scope Microsoft services.”
Verify on learn.microsoft.com“While the alignment between ISO/IEC 27701 and GDPR is evident, an ISO/IEC 27701 certification shouldn't be taken as evidence of GDPR compliance or official GDPR certification until regulatory decisions are finalized.”
> Show 2 unconfirmed / not-held certifications
source: learn.microsoft.comMicrosoft AI services in scope for ISO 42001 certification: GitHub Copilot, Microsoft 365 Copilot, Microsoft Copilot Health, Microsoft Copilot Studio, Microsoft Dragon Copilot, Microsoft Dragon Copilot (Radiologist), Microsoft Foundry, Microsoft Security Copilot. [Power Automate / Copilot in Power Automate is not on this list.]
source: learn.microsoft.comApplicability: Azure, Azure Government. ... For a list of Microsoft online services in scope for the FedRAMP High P-ATO in Azure and Azure Government, see Cloud services in audit scope. [Power Platform / Power Automate commercial service is not named as an applicable scope on this offering page; only Azure/Azure Government infrastructure is, with Dynamics 365 U.S. Government covered by a separate agency ATO.]
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Power Platform environments are pinned to a tenant-selected geo; Microsoft may replicate data to other regions within that geo for resiliency but does not move data outside the geo except for narrow legal/support exceptions.
Microsoft Learn states, specific to Copilot in Power Automate cloud flows: 'We don't use your customer data to train Copilot or its AI features, unless you provide consent for us to do so' and prompts/responses 'are NOT used to train or improve Microsoft AI models, unless your tenant admin opts in to sharing data with us.' A separate opt-in 'Data sharing for Dynamics 365 Copilot and Power Platform Copilot AI Features' setting is disabled by default; if a tenant admin enables it, Microsoft may capture and manually review inputs/outputs/telemetry to improve its models, retained for 30 days within the tenant's geographic boundary. Default posture: no training.
// Security controls
Encryption in transit
Connections between customers and Microsoft datacenters are encrypted; all public endpoints use TLS, with TLS 1.2 or higher required for server endpoint access. Data through the on-premises data gateway is also encrypted.
learn.microsoft.comEncryption at rest
All Dataverse environments use SQL Server Transparent Data Encryption (TDE) for real-time encryption at rest; Microsoft manages database encryption keys by default, with a customer-managed key option available to admins.
learn.microsoft.comAudit logging
Power Automate events (flow created/edited/deleted, permission changes, trial activity) are searchable in the Microsoft Purview compliance portal Audit Log, retained for 90 days and exportable as CSV.
learn.microsoft.comTrust Center / Service Trust Portal
Public Microsoft Trust Center covers Power Apps, Power Automate, and Power BI; the authenticated Service Trust Portal hosts downloadable SOC, ISO, and PCI DSS audit reports and certificates.
learn.microsoft.com// Products & data scope
Data it handles: Standard (non-premium) connectors only; same underlying Power Platform compliance and data-location boundary as paid tiers.
Entry tier for individual users; limited connector access.
Data it handles: Adds premium connectors, process mining, and attended (user-driven) desktop flows.
Primary paid consumer/business tier, ~$15/user/month billed yearly per public pricing on the vendor site.
Data it handles: Licenses a bot for unattended desktop flows or cloud flows usable by unlimited organization users.
~$150/bot/month billed yearly per public pricing on the vendor site; used for large-scale RPA.
Data it handles: Inherits the licensing suite's data boundary and is separately confirmed in-scope for the Office 365 HIPAA BAA table (as 'Power Automate' under Office 365 Microservices).
Distinct compliance in-scope listing from the standalone Power Automate cloud service, though both are covered.
Data it handles: Uses an on-premises data gateway to reach local data sources; gateway traffic is encrypted, but this introduces a customer-managed component outside Microsoft's direct cloud boundary.
Relevant for data-residency and self-hosting questions; the orchestration/management plane itself remains Microsoft's cloud service.
// What to watch
- SOC 2, ISO 27001/27017/27018/27701, PCI DSS, and CSA STAR are shared Azure/Dynamics 365/Power-Platform-wide audits, not a Power-Automate-specific standalone audit; Power Automate is covered because it is part of the 'Power Platform' service group named in each offering's 'Services in scope' list.
- ISO/IEC 42001 (AI management system) does not list Power Automate or its Copilot features in scope; Microsoft's ISO 42001 certification currently covers Copilot Studio, Microsoft 365 Copilot, GitHub Copilot, Security Copilot, Microsoft Foundry, and Dragon Copilot only.
- FedRAMP High P-ATO scope, per the Azure FedRAMP offering page, names Azure and Azure Government infrastructure; Power Platform/Power Automate is not listed as an in-scope service and is not FedRAMP-authorized as a commercial product.
- AI training posture is conditional, not absolute: Copilot in Power Automate does not train Microsoft's models on customer data by default, but a tenant admin can opt in to a data-sharing program that allows Microsoft to review and use inputs/outputs/telemetry (30-day retention) to improve the models.
// At a glance
Pricing model
Freemium plus per-user (Premium, ~$15/user/month) and per-bot (Process, ~$150/bot/month) subscriptions, also bundled into Microsoft 365 and Dynamics 365 suite licensing.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Microsoft Corporation's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
microsoft.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.