According to https://hackerone.com/bing
If you have found a security vulnerability in any of Microsoft’s
online services, please send e-mail to email@example.com. We will
respond to your submission within 24 hours and start working right
away to remediate the vulnerability. To help our engineers identify
the potential vulnerability, please include as ...
Is it possible that they copy our server data and use it somewhere
else? In other words can they clone our server?
Using Thunderbolt for example ?
They will have physical access to it so everything is possible.
The question is: how much do you trust the client ? If you trust them enough you could work out another arrangement, for example deliver software ...