Is our data safe in Claude? Plan terms, model training, where data is stored and the settings owners control

The plan decides the data terms

Claude is sold under two sets of terms. Free, Pro and Max are consumer plans. Team, Enterprise and the API are commercial plans. The difference matters more than any feature list, because the training and retention rules are different on each side³.

On the consumer plans, each person chooses whether their chats can be used to improve future models. Anthropic changed its consumer terms in 2025 so that Free, Pro and Max users make that choice, and the change covers Claude Code used from those accounts too⁴. If the setting is on, Anthropic keeps the data for up to five years; if it is off, the standard retention is 30 days^3,4. A staff member can change the setting at any time under the privacy settings of their own account³.

Commercial plans start from the opposite position. Anthropic's Commercial Terms state that it may not train models on customer content from the services, and that the customer keeps its rights to its inputs and owns its outputs⁵. The Team and Enterprise pricing page repeats the point as no model training on your content by default². The words by default matter: an organisation can opt in to programmes that share data, such as the Development Partner Program for the API, and feedback a user sends deliberately is handled separately³.

• Consumer plans (Free, Pro, Max): training is a personal choice in each account⁴.
• Commercial plans (Team, Enterprise, API): no training on customer content under the Commercial Terms⁵.
• Feedback sent through the thumbs or the Claude Code feedback command follows its own retention rules, so tell staff what not to attach³.

What Team and Enterprise add for an administrator

Team is the plan most small and medium New Zealand businesses should look at first. It needs at least two members and supports up to 150 seats, with Standard and Premium seat types that can be mixed¹. It includes Projects, Claude Code, Cowork, connectors for tools such as Microsoft 365, Google Drive, Gmail and Slack, single sign-on with domain capture, role-based admin, and spend controls at organisation and user level¹.

Enterprise adds the controls a compliance or IT lead usually asks about: SCIM provisioning, audit logs, a Compliance API, custom data retention, IP allowlisting and network-level access control². Audit logs are exported from Organization settings, then Data and Privacy, and cover the past 180 days⁹. Custom retention is also set under Data and Privacy; the shortest period you can choose is 30 days, and without a custom setting conversations are kept indefinitely⁸.

That last point surprises people. On Enterprise, the default is not automatic deletion. If your records policy says client working notes should not live longer than a matter, set a retention period that reflects it, and record the decision⁸.

Where your data is processed and stored

For a New Zealand customer, the contracting party is Anthropic PBC, under California law; only customers in the EEA, Switzerland and the UK contract with Anthropic Ireland⁵. Anthropic's privacy policy says personal data is transferred internationally, including to the United States¹⁷.

Anthropic's data residency controls are, for now, a United States story. On the API, the inference geo setting accepts global or US-only processing, and the workspace geo, which decides where data is stored at rest, has a single available value: the US⁷. The documentation lists no New Zealand or Australian storage option for the API, and none for the Claude apps. If you reach Claude through Amazon Bedrock or Google Cloud instead, the processing region is set by the endpoint or inference profile you choose, not by Anthropic's settings⁷.

So the honest answer for a business that wants its prompts kept onshore is that Claude's own apps will not do that today. The Office of the Privacy Commissioner treats an overseas cloud provider that only holds or processes information for you, and does not use it for its own purposes, as your agent, which is not a disclosure under principle 12 of the Privacy Act 2020, but you stay responsible for how that provider handles it¹⁵. For most firms, the practical test is whether the contract and the controls are strong enough, not whether the server is in Auckland.

• Claude apps (Team, Enterprise): no New Zealand or Australian storage option in Anthropic's documentation⁷.
• API: US-only inference and storage are available; global routing is the default⁷.
• Cloud platforms: the region comes from the endpoint you pick, so check it with your cloud provider⁷.

The security commitments in the contract

Anthropic's Data Processing Addendum is part of the Commercial Terms⁵. Under it, Anthropic acts as your processor and you remain the controller⁶. It commits to tell you about a security breach without undue delay and within 48 hours of discovering it, to give notice before adding sub-processors with a 15-day window to object, and to delete customer data within 30 days after the contract ends unless the law requires otherwise⁶.

The same addendum describes AES-256 encryption at rest, TLS 1.2 or later in transit, multi-factor authentication and role-based access for staff, with annual independent assessments whose reports, including SOC 2, are published through Anthropic's trust centre⁶. Ask for those reports during procurement. Prompt notice from the vendor matters because a breach likely to cause serious harm must be reported to the Privacy Commissioner and to affected people as soon as practicable, and you cannot report what you have not been told¹⁸.

Settings to check in the first week

Most of the protection sits in Organization settings. Work through these in order with whoever owns your Microsoft 365 or Google Workspace tenant. A small firm can get through the list in an afternoon, and it is the step most often skipped.

• Verify your domain and turn on single sign-on. Add the domain under Organization settings, publish the TXT record that begins anthropic-domain-verification, then choose invite-only, just-in-time or SCIM provisioning (SCIM on Enterprise)^2,10.
• Decide on memory. Owners on Team and Enterprise control it under Organization settings, then Capabilities; switching it off for the organisation deletes all existing memory data straight away¹¹.
• Review web search and enterprise search under Capabilities. Enterprise search only shows results a person can already open in the source system, except where a connector uses one shared credential¹⁴.
• Enable connectors one at a time under Organization settings, then Connectors. The Microsoft 365 connector needs a Microsoft Entra Global Administrator to grant tenant consent, and write tools stay blocked unless you turn them on¹³.
• Explain incognito chats. They are not saved to history or memory and are not used for training, but they are kept for 30 days and appear in organisation data exports¹².
• On Enterprise, set a retention period under Data and Privacy, and note who can export audit logs^8,9.

The real risk: staff on personal accounts

In practice the weak point is rarely the Team plan. It is the staff member who signed up for Pro with a work email last year and still pastes client material into it. That account sits under consumer terms, and whether those chats feed model training depends on a toggle only that person can see⁴.

Take a generic example: a Hamilton accounting firm with about a dozen staff finds that three staff already pay for personal Claude accounts. Moving to Team does two things. Domain capture, which Anthropic lists as part of Team, lets the firm claim its email domain so that work sign-ups land in the managed organisation rather than in separate personal accounts¹. And the commercial terms then govern the work, with no training on customer content⁵. The firm should also ask the three staff to export anything they need and delete client material from the old accounts, because consumer data already shared for training is not recalled by moving plans⁴.

The NCSC's AI guide for small businesses makes the wider point about public generative AI tools: decide what information goes in before anyone starts typing¹⁶. That rule applies to Claude just as much.

Developers and Claude Code

Claude Code sends prompts and the code it reads to Anthropic over TLS. On commercial plans, the standard retention is 30 days, and zero data retention is available to qualified Enterprise accounts after the account team confirms eligibility³. The client also stores session transcripts in plain text on the developer's machine, under the .claude/projects folder, for 30 days by default³. Treat developer laptops as holding source code and secrets, because they do.

If your developers use Claude Code through Amazon Bedrock or Google Cloud, telemetry and error reporting to Anthropic are off by default, and the data sits under your cloud contract³. That route suits a business that already runs its systems in one of those clouds.

A decision checklist for owners

Bring these questions to the meeting where you decide. If you cannot answer one, that is the next task, not a reason to stall the whole rollout.

• Which plan are staff actually using today, including personal accounts paid on a company card⁴?
• Do the Commercial Terms and the Data Processing Addendum cover the work you plan to do^5,6?
• Is United States processing acceptable for this data, and have you recorded why^7,15?
• Who is the Primary Owner, and who else holds Owner rights in Organization settings⁹?
• Which connectors will you enable first, and who granted the Microsoft or Google consent¹³?
• On Enterprise, what retention period matches your records policy⁸?