Is Claude Safe for Confidential Information? Consumer, Team, Enterprise, API and Claude Code

Is Claude safe for confidential information? On Team, Enterprise and the API, yes for most business data: Anthropic does not train on commercial data by default, deletes API inputs and outputs within 30 days and offers API customers zero data retention by agreement. On Free, Pro and Max, chats can train its models unless you turn Model Improvement off, and your employer gets no contract or audit trail. No version of Claude runs on-premises.

Anthropic sells the same Claude models under two sets of terms. Consumer Terms cover the Free, Pro and Max plans, including Claude Code signed in with those accounts. Commercial Terms cover Team and Enterprise, the Claude API, Claude Gov and Claude for Education, and Claude reached through cloud platforms such as Amazon Bedrock and Google Cloud carries those platforms’ terms as well. Nearly every answer below follows from which terms apply.

Sources were checked on 14 October 2026: Anthropic’s privacy policy, Privacy Center and help center, the API and Claude Code documentation, and the security advisories Anthropic publishes on GitHub. Our zero data retention explainer compares Anthropic’s retention terms with other providers, and the ChatGPT confidentiality guide answers the same question for OpenAI.

Claude plans side by side

On Anthropic’s own services, one exception runs across the whole table: if trust and safety classifiers flag a conversation, its inputs and outputs can be kept for up to two years and the classification scores for up to seven.

Is Claude safe for confidential information on Free, Pro or Max?

Not for anything your employer or your clients would call confidential, and the reasons are as much legal as technical.

In August 2025 Anthropic changed its consumer terms. Free, Pro and Max users, including when they ran Claude Code from those accounts, had to choose whether their chats and coding sessions could train future models, with 8 October 2025 as the deadline for existing users. Saying yes extended retention for new or resumed chats to five years. Anthropic’s privacy policy, effective 10 September 2026, now puts it plainly: inputs and outputs may be used to train its models unless you opt out in your account settings, and conversations flagged for safety review or reported through feedback are used even after an opt-out.

The controls sit under Privacy in Claude’s settings. With Model Improvement off, neither new nor past chats are used for future training, although data already inside a training run stays there. Incognito chats are never used for model improvement, whatever the setting. Deleted conversations vanish from your history immediately and from Anthropic’s back end within 30 days. The policy says data goes to servers in the United States or other countries outside the EEA and UK, relying on adequacy decisions or standard contractual clauses for the transfer.

Even with training off, a personal account is the wrong home for client or company secrets. There is no data processing agreement with your employer, no admin control and no audit trail. Courts are also starting to look at consumer terms. In United States v. Heppner, decided on 13 February 2026, Judge Rakoff of the Southern District of New York held that an executive’s own conversations with Claude were not privileged. Orrick’s summary of the ruling says the court relied on Anthropic’s consumer privacy policy, which allows training and disclosure to third parties, to find no reasonable expectation of confidentiality. Anthropic’s guidance for legal work notes that the decision did not consider enterprise tools. Questions of privilege belong with your own counsel.

Is Claude Enterprise safe for confidential information?

For most confidential business data, yes, and it is the strongest of Anthropic’s own offerings. Team and Enterprise run under the Commercial Terms, where Anthropic does not train on inputs or outputs unless the customer reports feedback or opts in. What Enterprise adds, according to Anthropic’s plan description dated 1 September 2026, is the evidence and control layer that Team lacks:

• Audit logs that owners can export for the previous 180 days. They record events, not chat content.
• A Compliance API with programmatic access to activity logs, chat histories and file content, filtered by user and time range.
• Custom data retention, SCIM provisioning and customer-managed encryption keys, with the key held in your own cloud provider.
• US-only inference and an optional HIPAA-ready configuration with a business associate agreement for eligible organisations.

Anthropic’s guidance on privileged and confidential work, dated 26 August 2026, also says who at Anthropic can see retained commercial data. Automated safety systems process it; only flagged content can reach a human reviewer; serious-harm reviews are limited to a small safeguards team under confidentiality obligations, with two-person approval for regulated data categories; and every human read is logged. For its commercial products, Anthropic lists SOC 2 Type I and Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023.

Team is a step down. It has SSO with domain capture, just-in-time provisioning, role-based permissions and spend controls, but audit logs are Enterprise-only, and Anthropic’s Team description does not list the Compliance API or custom retention. Organisations on Microsoft 365 may also meet Claude inside Copilot, where Anthropic works as a Microsoft subprocessor; our Copilot guide covers that route.

Is Claude secure for confidential information through the API?

The API offers Anthropic’s tightest data handling. By default, inputs and outputs are deleted within 30 days. Zero data retention (ZDR), arranged through Anthropic’s sales team and enabled per organisation, means prompts and responses are not stored once the response has been returned. ZDR is a list of eligible features rather than a blanket switch:

• Covered: the Messages and Token Counting APIs for eligible features, Claude Code used with API keys from a commercial organisation, and Claude Platform on AWS.
• Not covered: the Files API, batch processing (kept for 29 days), code execution, the MCP connector, Agent Skills, Managed Agents, the Console, and the Claude apps, Team and Enterprise included. Claude Code on Enterprise has its own, separate ZDR offering.
• Models that require retention: Claude Fable 5 and 5.1 and Claude Mythos 5 and 5.1 need 30-day retention and are unavailable under ZDR unless Anthropic authorises otherwise.
• Kept regardless: even under ZDR, flagged inputs and outputs can be retained for up to two years.

Health data has its own route. Eligible organisations can accept a business associate agreement in the Console and switch on HIPAA readiness, after which the API rejects requests that use non-eligible features. It does not extend to Claude Code, Claude Platform on AWS or Microsoft Foundry.

Location is the other variable. The inference_geo parameter accepts only global, the default, or us, which costs 1.1 times the standard token price on Claude 4.6 and later models, and the only workspace geography for data at rest is the US. An organisation that needs inference in Europe has to look at Amazon Bedrock or Google Cloud, where the endpoint or inference profile sets the region, and confirm which regions offer the model it needs.

Is Claude Code safe for confidential information?

Claude Code runs on the developer’s machine, but the model does not. Anthropic’s documentation states that every prompt and model output crosses the network, encrypted with TLS 1.2 or later, and the contents of any file Claude reads become part of that conversation. Which rules apply depends on how the developer signs in:

• Free, Pro or Max account: the consumer training choice and retention apply, 30 days with Model Improvement off and five years with it on.
• Team, Enterprise or a commercial API key: no training on code or prompts, 30-day standard retention, and ZDR for qualifying accounts.
• Amazon Bedrock, Google Cloud’s Agent Platform, Microsoft Foundry or Claude Platform on AWS: usage metrics, error reports and /feedback uploads are off by default.

Three details tend to surprise a security review:

1. Local transcripts. Sessions are saved in plaintext under ~/.claude/projects/ for 30 days by default so they can be resumed. The cleanupPeriodDays setting shortens that.
2. Feedback carries code. The /feedback, /bug and /share commands send the conversation, code included, to Anthropic, which keeps it for five years.
3. One check ignores the provider. Before fetching a web page, Claude Code sends the hostname to api.anthropic.com for a safety check, whatever model provider you use. The skipWebFetchPreflight setting turns it off.

An organisation can set quieter defaults centrally in a managed settings file, or a developer can add them to ~/.claude/settings.json:

{
  "env": {
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
  },
  "cleanupPeriodDays": 7
}

That variable switches off telemetry, error reporting, the feedback commands and release notes, and also automatic updates, so patching becomes your job. It matters: Anthropic’s Claude Code repository on GitHub lists more than 30 published security advisories. One of them, CVE-2026-54316, published on 13 June 2026, let injected instructions leak data through requests to a pre-approved Hugging Face domain in versions before 2.1.163; standard auto-update delivered the fix.

If the code itself must not leave your network, our guide to Claude Code with a local model covers what changes when inference moves onto your own hardware.

Is Claude Cowork safe for confidential information?

Claude Cowork lets Claude carry out multi-step work on a computer. It is available on Pro, Max, Team and Enterprise, in Claude Desktop for macOS and Windows and, depending on plan, on the web, mobile and in Chrome. In a local session, Claude works on the user’s machine, running code inside an isolated virtual machine; it can read, write and, with the user’s approval, permanently delete files in connected folders, read email and documents through connected apps, and operate the screen through computer use. Cloud sessions, in beta, run on Anthropic’s infrastructure instead.

What a security review needs from Anthropic’s help center:

• Defaults. Cowork is on by default for Team and Enterprise organisations; owners can switch it off or, on Enterprise, enable it only for chosen groups. HIPAA-enabled organisations start with it off. Cloud sessions are on by default for Team and off for Enterprise.
• Where history lives. Local sessions keep conversation history on the user’s computer, and admins cannot centrally manage or delete it. Enterprise admins can retrieve local sessions through the Compliance API, and Anthropic’s retention documentation says those transcripts are stored for six years by default unless the organisation sets a finite retention period.
• Regulated data. On a HIPAA-ready Enterprise plan, the BAA covers Cowork only in local mode with Anthropic’s HIPAA configuration applied; without it, Cowork is available but not covered.
• Prompt injection. Anthropic says the risk is not zero, recommends connecting a dedicated working folder rather than sensitive files, and advises against using its browser for anything involving sensitive information.

The advisories show why. GHSA-v234-4jrq-mgg6, rated high and published on 25 September 2026, described how a file placed in a Cowork folder by a compromised or prompt-injected agent could run commands on a Mac if the user opened it from Claude Desktop; version 1.15962.0 fixed it. Microsoft 365 Copilot has a separate feature also called Cowork; this section is about Anthropic’s.

What to do when the data must not leave your infrastructure

Every supported way to use Claude ends at a hosted service: Anthropic’s apps and API, Claude Platform on AWS, Amazon Bedrock, Google Cloud or Microsoft Foundry. Anthropic’s terms can make that a sound processor arrangement, but no contract changes where inference runs. Choose by the rule your data actually carries:

• “No training, short retention”: Team, Enterprise or the API under the Commercial Terms, with ZDR on the API where the features you need are eligible.
• “Only through our existing cloud provider”: Claude on Amazon Bedrock or Google Cloud, where that provider acts as processor and the endpoint you call sets the region.
• “Never leaves our network”: an open-weight model on your own hardware. Claude cannot be deployed that way, so this means a different model, tested on your own tasks before it replaces anything.

Write the outcome into your AI acceptable use policy, so staff know which Claude account, if any, each data class may enter. For the replacement route, see our self-hosted Claude comparison; for seat costs on the other side, our Claude Enterprise pricing breakdown.

How VDF AI fits

VDF AI covers the last of those rows. It is a self-hosted platform for chat, private retrieval over company documents and governed agents, running on-premises, in a private cloud or air-gapped, with conversation history and audit logs in storage you control.

Claude does not have to disappear. In VDF AI Chat the model is chosen per agent, and VDF AI Router registers on-premises model deployments alongside approved cloud models. An agent for non-confidential drafting can call Anthropic’s API where policy allows, while agents for contracts, client files or health records stay on open-weight models you host; in air-gap mode, the router keeps every request local. For developers, VDF Code provides IDE assistance on models you run yourself. On-premises, staff sign in with native Microsoft Entra ID single sign-on, and role-based access control applies on every plan.