What 'Uploading to AI' Actually Does
Uploading an Excel file to a cloud AI usually means the file’s contents are processed on the provider’s servers — and in some cases used for training unless you opt out. Only a small group of tools process locally: your file never leaves your Windows machine. This guide explains exactly what each approach exposes, and how to verify it.
An upload is not a single act — it is a chain: the file is transmitted over the network, stored on the provider's infrastructure, processed, and in some configurations kept long enough to be reused. Each link in that chain is a separate place where exposure can happen, which is why the privacy question has no single-word answer.
The two approaches are the two halves of the how Excel AI works picture: a cloud tool needs your file to reach its server, while a local tool never has to send it.
Cloud Tools: What They See and Store
| Provider | Training default | Retention | Region | Policy source |
|---|---|---|---|---|
| OpenAI (ChatGPT) | On by default for personal chats; off for the API | ~30 days after deletion | US; EU option on business plans | openai.com policies |
| Anthropic (Claude) | On for personal plans unless you opt out; off for business/API | ~30 days after deletion; up to ~5 years (de-identified) if training allowed | US | anthropic.com legal |
| Microsoft (Copilot, M365) | Off for commercial contracts; personal chats may be reviewed | ~18 months for consumer Copilot; admin-configurable for business (e.g. 30 days) | Region options for business | microsoft.com privacy |
| Google (Gemini, Workspace) | Off for Workspace business data unless enabled | Configurable | Region options for business | policies.google.com |
These defaults and retention figures are as each policy states them at the time of writing, and they change by plan, region, deletion, and training opt-in — the sources below are what to verify against. The same four tools appear in the data upload in the comparison of the main Excel AI tools.
The training default is the first question because it is the difference between your formulas being read once to answer a prompt and being folded into a model that reproduces them later. Tools that are off by default still store the file to process the request, so the distinction is never trivial — it changes what your data can become.
OpenAI privacy policy — ChatGPT’s training opt-out and retention terms.
Anthropic privacy policy — Claude’s training default and the opt-out for personal and business plans.
Microsoft privacy statement — the Copilot and Microsoft 365 terms.
Google privacy policy — Gemini and Workspace data handling.
Local Execution: What Never Leaves Your Machine
Local execution means the workbook is processed on your device: no workbook upload, no subscription, no training pool. The workbook never leaves your machine, which removes the exposure at the source — there is nothing on a server to breach or reuse.
Local does not mean the tool is inert: the local engine reads your cells, evaluates the request, and writes results — but the workbook itself stays on one machine. The network activity is the model conversation and the software's update checks, and none of that traffic carries the workbook.
Mica’s security & privacy page documents exactly what the local-first approach processes and how you can verify it yourself — the plan review and instant local response make the claim something you can confirm in everyday use.
How to Check a Tool's Data Policy
- Find the training default: does your plan allow your data to be used for model training by default, and can you switch it off?
- Check retention: how long are uploads stored, and what happens when you delete a chat or file?
- Ask about region: which servers hold your data, and can you choose the region on your plan?
- Separate execution from advice: does the tool run in your file (deeper access) or only generate text you paste — and if it executes, does it do so in the cloud or on your machine?
- Test it yourself: run a task and confirm the workbook changed on your machine, or watch the plan step before anything executes — the policy and the behavior should match.
For Sensitive Data or Restricted Regions
If your workbook contains client, financial, or regulated data, cloud upload carries a risk no checkbox fully removes — a breach or a policy change is out of your hands. For users in regions with restricted cloud access there is a sharper version of the same problem: cloud AI services can require an account, a stable connection, or a server region that complicates compliance.
For regulated work the practical test is simple: if a file must not leave the building or the region, a tool that never sends it is the only option that satisfies the constraint structurally rather than contractually. That is why the local-first category exists — not as a feature preference, but as the answer for data you cannot move.
global availability and regional use covers the account, connectivity, and regional picture in detail.
Frequently Asked Questions
Is it safe to upload financial data to ChatGPT or Copilot?
It depends on your plan and the policy in force — business plans generally exclude your data from training and offer region choice, while personal chats default differently. The check-the-policy steps above apply.
Does a local tool like Mica upload anything?
No. Mica processes your workbook on your device; no workbook file is uploaded, and there is no subscription or training pool.
Can I use cloud Excel AI offline?
No — a cloud tool needs your file to reach its server, which requires a connection. A local tool like Mica keeps the workbook on your machine and needs a connection only for the model conversation; the file itself is not uploaded, which is the property the local approach is built for.