What MS Duplex learns stays yours.
Separate, protected and under your control.
Each customer is kept separate, attacks and poisoned data are blocked, and you can review, correct or remove anything MS Duplex learns.
You choose what leaves the placement.
In your own agents, MCP + hooks bring MS Duplex in before each action runs: your rules apply first, and every step leaves a receipt.
MS Duplex rules govern what an agent actually runs, not only what a prompt asks of the model.
As the Agent Operating System your agents run on, MS Duplex holds the permissions: every action is checked, whichever agent or model asks.
Compare the two placements →Step 1 of 3: Inside
MS Duplex, your tools and their credentials run inside your placement.
Your control over what it learns.
Each customer’s learning is its own, and anything MS Duplex has learned can be reviewed, corrected, removed or restored.
Step 1 of 5: Separation
Each customer’s learning serves that customer alone, and inside your company, work areas keep teams apart.
Access, roles, encryption, credentials.
Your team signs in through your identity provider, each role gets its own access, and everything is encrypted.
Model and tool credentials stay inside the placement, out of the model’s reach.
Step 1 of 4: Sign-in
Your team signs in through your own identity provider, with OIDC, or SAML and SCIM where needed.
Runtime safety and oversight.
Every action an agent attempts is checked against your controls.
Step 1 of 6: The real action
MS Duplex checks the command the agent is about to run, so safety does not rest on the prompt.
What a security review asks.
Does MS Duplex send customer data to a model provider?
Only when you configure an outside model: that provider receives the request and its context for the turn. You can keep the model inside your boundary instead.
Is one customer’s learning shared with another?
Each customer’s inputs and history, and everything MS Duplex learns from them, serve that customer alone.
Can we remove learned information?
Yes. Remove anything MS Duplex has learned, or restore an earlier state, and the history shows the change.
When evidence is removed, does what MS Duplex learned from it go too?
Yes. Remove a result or an observation, and what MS Duplex learned from it is withdrawn with it, so nothing built on it lingers. The history shows the change.
Does MS Duplex learn personal data?
Only what you allow. Personal data can be redacted before MS Duplex learns from it, sends it to a model or shows it in the history, and what MS Duplex learns doesn’t need the original text.
How is the history protected?
It is append-only and tamper-evident, so an altered entry would show. Authorised users can export it.
Who can access a deployment in our cloud?
You control the infrastructure and identity. MatterSpace has access only when you delegate it.
Which certifications does MS Duplex hold?
None yet: MS Duplex is in private pilots, and independent certification is planned. Until then, the security brief sets out the controls in place today for the placement you are reviewing.
Which providers process our data?
The providers used for your deployment, and any subprocessor terms, are set out in your customer documents. In your cloud, you choose them.
Can we get a security brief, DPA or questionnaire response?
Yes. Write to us with the product, placement and your review deadline.
