AI tools and client data
Is Claude Code safe for client data?
Short answer: Whether Claude Code is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Free, Pro, Max and Ultra (consumer account), Anthropic says it trains its models on what staff type only when somebody turns the setting on; on Team, Enterprise and API (commercial terms), Anthropic says it does not train its models on what staff type, by default. Every fact on this page is Anthropic's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Anthropic’s own words
An assistant that works in the terminal: it reads files, edits them and runs commands, and it keeps a transcript of the session on the machine.
| What you are asking | Free, Pro, Max and Ultra (consumer account) | Team, Enterprise and API (commercial terms) |
|---|---|---|
| Trains the vendor's models by default | Only with the setting on, and Anthropic says that covers Claude Code used from those accounts.“We will train new models using data from Free, Pro, Max, and Ultra accounts when this setting is on” source, read | No, under commercial terms, unless the organisation opts in through a named programme.“Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms” source, read |
| How to turn training off | The same privacy setting as the Claude app; with it off, retention drops to 30 days.“Users who don't allow data use for model improvement: 30-day retention period” source, read | The opt-in an admin can make for the whole organisation is the thing to know exists.“An organization admin can expressly opt-in to the Development Partner Program for their organization.” source, read |
| How long data is kept | Five years with model improvement on, 30 days with it off.“Users who allow data use for model improvement: 5-year retention period” source, read | Thirty days as standard, with zero retention available to qualified Enterprise accounts.“Commercial users (Team, Enterprise, and API): Standard: 30-day retention period” source, read |
| What an admin can see or control | Not found in the pages we read. | An admin can reach the content itself: Anthropic says a Compliance API gives organisations programmatic access to usage data and customer content.“We are also introducing a new Compliance API, giving organizations programmatic access to usage data and customer content for better observability, auditing, and governance.” source, read |
| Single sign-on | Not found in the pages we read. | The same organisation sign-on as the Claude app, so a Claude Code seat arrives through the identity provider.“Single sign-on is available for Team plans, Enterprise plans, and Console organizations.” source, read |
| Business Associate Agreement | Not found in the pages we read. | The agreement sits at organisation level on an Enterprise plan, which is the same organisation the Claude Code seats belong to.“This offering includes a Business Associate Agreement (BAA), functionality, and safeguards designed to support an organization's HIPAA compliance requirements.” source, read |
| Where the data is processed | Not found in the pages we read. | Not found in the pages we read. |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Anthropic pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Anthropic before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. Anthropic publishes a BAA position for this product, which is where that conversation starts. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Anthropic’s own documentation. Each one is a change somebody can make this afternoon.
- Know that the session transcript sits on the laptop in plain text for 30 days, whatever the cloud setting says. On a client matter that is the copy that matters.“Claude Code clients store session transcripts locally in plaintext under ~/.claude/projects/ for 30 days by default” source, read
- Tell developers that /feedback, /bug and /share send the transcript and that it is kept for five years.“Transcripts shared via /feedback, or via /bug and /share, which report through the same path, are retained for 5 years.” source, read
Worth knowing
- An admin can push settings to every Claude Code user, which is where tool permissions and MCP servers get decided centrally.“Deploy and enforce settings across all Claude Code users to match internal policies, including tool permissions, file access restrictions, and MCP server configurations.” source, read
Questions we get asked
Is Claude Code safe for client data?
Whether Claude Code is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Free, Pro, Max and Ultra (consumer account), Anthropic says it trains its models on what staff type only when somebody turns the setting on; on Team, Enterprise and API (commercial terms), Anthropic says it does not train its models on what staff type, by default.
Every fact on this page is Anthropic's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Anthropic train its models on what our staff type into Claude Code?
On Free, Pro, Max and Ultra (consumer account), Anthropic says it trains its models on what staff type only when somebody turns the setting on; on Team, Enterprise and API (commercial terms), Anthropic says it does not train its models on what staff type, by default.
On Free, Pro, Max and Ultra (consumer account): Only with the setting on, and Anthropic says that covers Claude Code used from those accounts.
Anthropic's own words: "We will train new models using data from Free, Pro, Max, and Ultra accounts when this setting is on" (read 2026-11-02).
On Team, Enterprise and API (commercial terms): No, under commercial terms, unless the organisation opts in through a named programme.
Anthropic's own words: "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms" (read 2026-11-02).
How long does Anthropic keep what we put into Claude Code?
On Free, Pro, Max and Ultra (consumer account): Five years with model improvement on, 30 days with it off. Anthropic's own words: "Users who allow data use for model improvement: 5-year retention period" (read 2026-11-02).
On Team, Enterprise and API (commercial terms): Thirty days as standard, with zero retention available to qualified Enterprise accounts.
Anthropic's own words: "Commercial users (Team, Enterprise, and API): Standard: 30-day retention period" (read 2026-11-02).
Can an administrator read what our staff typed into Claude Code?
An admin can reach the content itself: Anthropic says a Compliance API gives organisations programmatic access to usage data and customer content.
Anthropic's own words: "We are also introducing a new Compliance API, giving organizations programmatic access to usage data and customer content for better observability, auditing, and governance." (read 2026-11-02).
Will Anthropic sign a Business Associate Agreement for Claude Code?
The agreement sits at organisation level on an Enterprise plan, which is the same organisation the Claude Code seats belong to.
Anthropic's own words: "This offering includes a Business Associate Agreement (BAA), functionality, and safeguards designed to support an organization's HIPAA compliance requirements." (read 2026-11-02).
A signed BAA is between your practice and Anthropic; we do not sign it for you, and we do not read a compliance badge as one.
How do we find out which version of Claude Code our staff are using?
Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.
Sources
Anthropic’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
- docs.claude.com/en/docs/claude-code/data-usage, read
- anthropic.com/news/claude-code-on-team-and-enterprise, read
- support.claude.com/en/articles/13132885-set-up-single-sign-on-sso, read
- support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans, read
All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is ChatGPT safe for client data?
General assistant · OpenAI
Is Microsoft Copilot safe for client data?
General assistant · Microsoft
Is Google Gemini safe for client data?
General assistant · Google