AI tools and client data

Is Claude safe for client data?

Short answer: Whether Claude is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Free, Pro and Max (consumer account), Anthropic says it trains its models on what staff type only when somebody turns the setting on; on Team and Enterprise, Anthropic says it does not train its models on what staff type, by default. Every fact on this page is Anthropic's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in Anthropic’s own words

Anthropic's assistant, in a browser, a desktop app and a browser extension, able to read connected drives and MCP servers when someone sets them up.

What you are askingFree, Pro and Max (consumer account)Team and Enterprise
Trains the vendor's models by defaultOnly if the person says yes. Anthropic frames training on consumer chats as a choice, and a safety review as the exception.“We will use your chats and coding sessions (including to improve our models) if: You choose to allow us to use your chats” source, read No, under commercial terms, unless the organisation chooses to hand data over through a named programme.“Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms” source, read
How to turn training offPrivacy Settings, Model Improvement. Incognito chats are excluded even when it is on.“Your Incognito chats are not used to improve Claude, even if you have enabled Model Improvement in your Privacy Settings.” source, read There is an opt-in an admin can make for the whole organisation, which is worth knowing about before someone does.“An organization admin can expressly opt-in to the Development Partner Program for their organization.” source, read
How long data is keptA deleted conversation goes within 30 days; allowing model improvement extends it to five years in the training pipeline.“Deleted from our back-end storage systems within 30 days” source, read Thirty days as standard on commercial plans, with zero retention available to qualified Enterprise accounts.“Commercial users (Team, Enterprise, and API): Standard: 30-day retention period” source, read
What an admin can see or controlNot found in the pages we read.Enterprise roles control which features and connectors a group may use. This page does not say whether an admin can read conversations.“Set connector permissions on each role to control which connectors, and which tools on those connectors, the role can use.” source, read
Single sign-onNot found in the pages we read.Team and Enterprise, with SCIM for joiners and leavers.“Single sign-on is available for Team plans, Enterprise plans, and Console organizations.” source, read
Business Associate AgreementNot found in the pages we read.Enterprise plans only, switched on from organisation settings; Anthropic says the offering includes the agreement itself.“This offering includes a Business Associate Agreement (BAA), functionality, and safeguards designed to support an organization's HIPAA compliance requirements.” source, read
Where the data is processedNot found in the pages we read.Not found in the pages we read.

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Anthropic pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Anthropic before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. Anthropic publishes a BAA position for this product, which is where that conversation starts. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From Anthropic’s own documentation. Each one is a change somebody can make this afternoon.

  • Check Model Improvement on every consumer account that touches client work, and use Incognito for anything sensitive.“Your Incognito chats are not used to improve Claude, even if you have enabled Model Improvement in your Privacy Settings.” source, read
  • Tell staff the thumbs up or down button stores the whole conversation for five years.“we will store the entire related conversation … in our secured back-end for up to 5 years” source, read
  • Know what a connector pulls in. Anthropic says connector content is excluded from training unless it is copied into the chat.“It does not include raw content from connectors (e.g. Google Drive), including remote and local MCP servers” source, read

Worth knowing

  • On Enterprise the organisation can read the content itself through a Compliance API, not only manage who has access.“We are also introducing a new Compliance API, giving organizations programmatic access to usage data and customer content for better observability, auditing, and governance.” source, read

Questions we get asked

Is Claude safe for client data?

Whether Claude is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Free, Pro and Max (consumer account), Anthropic says it trains its models on what staff type only when somebody turns the setting on; on Team and Enterprise, Anthropic says it does not train its models on what staff type, by default.

Every fact on this page is Anthropic's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does Anthropic train its models on what our staff type into Claude?

On Free, Pro and Max (consumer account), Anthropic says it trains its models on what staff type only when somebody turns the setting on; on Team and Enterprise, Anthropic says it does not train its models on what staff type, by default.

On Free, Pro and Max (consumer account): Only if the person says yes. Anthropic frames training on consumer chats as a choice, and a safety review as the exception.

Anthropic's own words: "We will use your chats and coding sessions (including to improve our models) if: You choose to allow us to use your chats" (read 2026-11-02).

On Team and Enterprise: No, under commercial terms, unless the organisation chooses to hand data over through a named programme.

Anthropic's own words: "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms" (read 2026-11-02).

How long does Anthropic keep what we put into Claude?

On Free, Pro and Max (consumer account): A deleted conversation goes within 30 days; allowing model improvement extends it to five years in the training pipeline.

Anthropic's own words: "Deleted from our back-end storage systems within 30 days" (read 2026-11-02). On Team and Enterprise: Thirty days as standard on commercial plans, with zero retention available to qualified Enterprise accounts.

Anthropic's own words: "Commercial users (Team, Enterprise, and API): Standard: 30-day retention period" (read 2026-11-02).

Can an administrator read what our staff typed into Claude?

Enterprise roles control which features and connectors a group may use. This page does not say whether an admin can read conversations.

Anthropic's own words: "Set connector permissions on each role to control which connectors, and which tools on those connectors, the role can use." (read 2026-11-02).

Will Anthropic sign a Business Associate Agreement for Claude?

Enterprise plans only, switched on from organisation settings; Anthropic says the offering includes the agreement itself.

Anthropic's own words: "This offering includes a Business Associate Agreement (BAA), functionality, and safeguards designed to support an organization's HIPAA compliance requirements." (read 2026-11-02).

A signed BAA is between your practice and Anthropic; we do not sign it for you, and we do not read a compliance badge as one.

How do we find out which version of Claude our staff are using?

Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.

Sources

Anthropic’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.