VoltageGPU vs Microsoft Copilot Studio

Copilot Studio in 2026 is Microsoft's answer to the agentic AI moment. The April 2026 release shipped expanded agent governance, the Microsoft 365 Agents Toolkit, and Agent 365 inside Purview, a coherent product story that lets a tenant administrator stand up vertical agents on top of M365 data, attach DLP and sensitivity labels, and audit agent activity through the same eDiscovery surface that already governs email and SharePoint. As a product release this is a serious piece of engineering, and as a corporate signal it confirms what most enterprise buyers already assumed: AI agents will become the dominant interface for business automation by the end of the decade.

What Copilot Studio governs is policy. Purview applies DLP rules to agent inputs, sensitivity labels propagate to agent outputs, audit logs capture which user invoked which agent on which document. This is the same governance model Microsoft built for Exchange, SharePoint, and Teams over the last fifteen years, applied to a new surface. It works the way enterprise IT expects governance to work, and for the majority of internal productivity automation it is more than sufficient.

What Copilot Studio does not govern is the hardware. Agents run on Azure tenant compute provisioned the same way any other Azure workload is provisioned. The host operating system, the hypervisor, and the underlying physical hardware are all under Microsoft administrative control. A Microsoft administrator with the right credentials, or a US government request served against Microsoft Corporation under the CLOUD Act, can technically reach into the workload memory where the agent is processing the prompt and the response. Purview policies are contractually binding; they are not cryptographically enforced.

VoltageGPU takes a different trade-off, and it is a partial one. Each Confidential Agent runs on our servers and sends its model calls to an Intel TDX enclave at our inference provider, where the model's memory is encrypted by the CPU with a key the host never sees. GET /v1/attestation returns the TDX quotes and NVIDIA GPU evidence of the serving instances, verifiable against the Intel root certificate; it proves those instances are TDX guests, not that a given response came from them. Our servers see the documents and prompts in clear while the agent works, and our inference provider is in the US. Policy-layer governance asks the buyer to trust the operator; our design narrows what has to be trusted to our relay, without removing it.

The first thing you give up is jurisdictional clean lines. Microsoft Corporation is a US Washington State entity. Even when European customers contract through Microsoft Ireland Operations Ltd. under the EU-US Data Privacy Framework that replaced Privacy Shield in 2023, the ultimate parent is US-incorporated and is bound by the CLOUD Act, US law enforcement can compel data production from a US controller regardless of where the data physically sits. The Data Privacy Framework reduces the regulatory friction of GDPR transfers but it does not extinguish the underlying extraterritorial obligation. For workloads regulated by French bar-association secrecy under RIN Article 2.2, by HDS for health data, by MiFID II for financial advice, or by the EU AI Act's high-risk classification, the processor's jurisdictional status is part of the technical-measures analysis a compliance team will run. VoltageGPU's inference provider and hosting are US companies too (listed on /legal/subprocessors), so this point does not split cleanly between us.

The second thing you give up is hardware isolation of the model. On Copilot Studio the agent context, the document the agent was asked to analyse, the prompt, the chain of tool calls, the final answer, sits in plaintext inside the Azure VM where the agent runs. A Purview administrator with the right scope can read that context through the audit surface. A Microsoft engineer with break-glass access to the host can in principle read it from the hypervisor side. The operator is contractually bound not to do so and Microsoft has invested heavily in compliance certifications that document the controls, but the technical capacity exists. On VoltageGPU the model's working memory sits inside a TDX guest at our inference provider, whose key stays inside the CPU's TDX module, and the attestation quote shows the serving instance is such a guest. The agent context itself passes in clear through our servers, so a VoltageGPU administrator is not technically excluded.

The third thing you give up is pricing transparency on a single line. Copilot Studio licensing is composite: a Microsoft 365 E5 license per user (~$54/month at standard list), a Copilot Studio capacity component charged either through pay-as-you-go message packs at roughly $200 per 25,000 messages or through a tenant-wide reservation, and frequently a separate Azure consumption bill for connectors and Power Platform components that the agent calls. For a procurement team comparing the run-rate cost of an AI agent program against the projected business value, that composite structure makes it hard to answer the simple question "what does one agent cost per month". VoltageGPU is one line, $349 for the Starter plan, $1,199 for the Professional plan, contact sales for Enterprise, billed monthly, no per-message metering surprises, no per-seat license stack underneath.

The fourth thing you give up is Purview-or-nothing as the governance ceiling. Microsoft's governance story is excellent if the buyer is fully inside the M365 ecosystem and is happy to govern agents the same way email is governed. For buyers whose compliance framework requires technical measures enforced at the hardware layer rather than at the policy layer, Purview is the wrong tool for that part of the requirement, and stacking a separate hardware-enforced confidential agent on top of an M365 deployment is not a Microsoft-supported configuration. VoltageGPU covers the model part of that requirement and is interoperable with the rest of the M365 stack through the OpenAI-compatible API and the OpenClaw runtime: a customer agent can read documents out of SharePoint or Teams through standard Graph API calls, send them to a model in a TDX enclave through our API, then return results to the M365 surface without the prompt and the response sitting on Azure compute; they do pass in clear through our servers.

Microsoft wins on ecosystem integration and it wins decisively. Copilot Studio is a native surface inside Teams, SharePoint, Outlook, Excel, OneDrive, and the entire Power Platform. The agent can read a SharePoint document with the same authentication the user already has, post a result to a Teams channel, attach a sensitivity label that propagates automatically into the next document the agent touches, and surface its audit trail inside the same eDiscovery view the legal department already uses for email. For a buyer whose document gravity is fully inside Microsoft 365, and for most large European enterprises that is the truthful description of where their data lives, that integration depth is real, it is hard to replicate from outside, and it is the right reason to choose Copilot Studio for workloads where Cloud Act exposure and policy-layer governance are acceptable.

Microsoft also wins on enterprise procurement friction. Copilot Studio is part of the existing Microsoft Enterprise Agreement that the buyer's procurement team has already negotiated, the existing MSA covers the contractual posture, and the existing CISO sign-off on Microsoft 365 extends naturally to a new agent surface inside the same tenant. Adding a new vendor, even one with stronger hardware controls, means a fresh vendor risk assessment, a fresh DPA, a fresh penetration-test review, and a fresh procurement cycle. For a fast-moving internal automation program with limited compliance ambition, the friction cost of "yet another vendor" is non-trivial and Copilot Studio wins the moment the buyer decides the workload does not need hardware enforcement.

Microsoft does not offer hardware isolation here. Copilot Studio agents run on standard Azure tenant compute, the underlying host is administered by Microsoft, and there is no attestation surface for the agent. Azure has confidential VM SKUs with Intel TDX and AMD SEV-SNP, but Copilot Studio agents do not run inside those SKUs as of May 2026 and Microsoft has not published a roadmap commitment to put them inside that boundary. For workloads where the threat model treats the cloud operator as part of the attack surface, as many buyers do for client files under professional secrecy or patient records under HDS, Copilot Studio does not address it; VoltageGPU addresses it for the model's host, not for our own relay, which sees requests in clear.

Microsoft does not win on EU sovereignty without caveats, and neither do we. The Data Privacy Framework is a legal posture, not a hardware posture. It reduces the documentary friction of GDPR Chapter V transfers but it does not change the fact that the ultimate processor is US-incorporated and subject to US extraterritorial law. VoltageGPU is a French operator with a GDPR Article 28 DPA under French law, but our inference provider and our hosting are US companies (listed on /legal/subprocessors) and our relay sees requests in clear, so we do not remove CLOUD Act exposure either; what we add is the model inside Intel TDX, with an attestation of its instances. The honest summary: if your data is already in Microsoft 365 and Cloud Act exposure is acceptable, Copilot Studio is the path of least resistance and the right answer; if you want the model isolated in hardware with published monthly prices, VoltageGPU is worth evaluating, knowing where our relay and our providers sit.