Is Claude Safe? Claude Privacy for Legal Teams

Is Claude Safe for Client Data?

Claude Team and Enterprise exclude customer content from model training under Anthropic’s commercial terms. On consumer plans, including Free, Pro and Max, training depends on the user’s privacy setting.

Paying for Claude Pro therefore does not establish that a client’s information has commercial-plan protections. Start with the account type, then assess retention and who can access its content. Approve connectors separately because they can retrieve material the user has never pasted into a prompt.

Anthropic’s Commercial Terms restrict training on customer content. Its commercial training guidance also describes a feedback exception. A submitted feedback report can include the conversation and be retained for up to five years. Team and Enterprise owners can disable “Rate chats” under Organization settings, then Data and Privacy.

For a hypothetical contract summary, an approved commercial workspace with a small de-identified extract presents a narrower exposure than a personal account connected to the solicitor’s entire mailbox. The commercial contract does not itself grant the solicitor permission to disclose every document they can access.

Does Claude Train on Your Data?

Anthropic can use consumer conversations for model training when the user allows it. The consumer choice introduced in 2025 applies to new or resumed chats after the setting is enabled.

Anthropic’s consumer-policy announcement distinguishes those accounts from services under commercial terms. The setting also covers coding sessions associated with consumer accounts.

To change it, open Settings, select Privacy and turn off “Help Improve our AI models”. Anthropic’s privacy-setting instructions say this stops previously stored and new conversations being used in future training runs. It does not remove their contribution to training already started or models already trained.

Consumer Retention Periods

Anthropic’s consumer retention policy separates ordinary chats from training data and safety records.

Consumer data	Retention described by Anthropic	Consequence for a firm
Saved chat without training permission	The chat remains under the user’s control, with back-end deletion within 30 days after deletion	Turning off training does not itself delete chat history
Training data when permission is enabled	De-identified data can remain in training pipelines for up to five years	Do not allow identifiable matter content into an opted-in account
Feedback and bug reports	Associated data is retained for five years	A feedback submission can disclose the conversation again
Content flagged as a usage-policy violation	Inputs and outputs can remain for up to two years	Safety retention is separate from the ordinary deletion window
Trust and safety classification scores	Up to seven years for flagged sessions	A classification record has a different lifetime from the chat text

The 30-day period is a back-end deletion window. A saved chat does not automatically disappear from the account 30 days after creation. Legal requirements and policy-enforcement exceptions can also extend retention.

A training opt-out does not stop every safety use. Anthropic says flagged conversations can still support trust and safety models and related enforcement work. Record both the training choice and the permitted retention when approving a consumer use.

Incognito Chats

Claude incognito chats stay out of the user’s chat history and memory, and are excluded from model training. Anthropic still retains them for a limited period.

The incognito documentation gives a 30-day default. Enterprise retention settings can keep them longer. Incognito conversations also remain included in organisational exports on Team and Enterprise and in the Enterprise Compliance API.

To start one, create a new chat outside a project and select the ghost icon. Confirm the “Incognito chat” label before entering material. Claude does not use existing memory in that conversation or add it to future memory.

Incognito is useful when an approved task needs no saved personal history. It does not replace a commercial plan’s terms or narrow a connector’s underlying permissions. Staff must follow the same rule for confidential material even when the chat has an incognito label.

Cowork, Connectors and Gmail Access

Claude connectors can retrieve data from the connected account, and some can change it. Cowork can take actions through connected services and work with folders the user grants it access to.

Anthropic’s Google Workspace connector instructions describe Gmail search and reading. Claude can also draft, send, reply to and forward email. Sending requires approval by default, although commercial workspace owners control whether members can permit actions without repeated approval.

Gmail access includes attachment metadata, while attachment content is not directly accessible through that connector. Google Drive has broader file access, including document retrieval and supported changes such as moving or trashing files. The connected user’s existing permissions apply.

Anthropic excludes retrieved Gmail, Drive and Calendar connector data from training. A consumer account with training enabled can still supply training material by copying that content into a chat, including a Claude response containing connector information. Retrieved content is retained with its associated chat.

The Microsoft 365 connector reaches permitted Outlook mail and calendar data, OneDrive, SharePoint and Teams through a work account. Administrators can enable write tools, including email sending and file changes. Read access can include shared mailboxes the user can open.

Microsoft 365 does not support a connector allowlist of selected SharePoint sites. It searches content the connected user already has permission to access. Asking Claude to search only one matter is a task instruction, not a change to those permissions.

Limit Access Before Connecting

1. Have the firm approve the commercial workspace and each connector. Staff using unapproved connections create shadow AI exposure even if their purpose is legitimate.
2. Review the source account’s actual permissions, including shared mailboxes and document sites. Use an account whose access matches the approved work.
3. Keep unneeded connectors off. For Microsoft 365, use Customize, then Connectors, select Microsoft 365 and disable unneeded tools under Tool permissions.
4. Retain approval for sending and other changes. Test access using a non-confidential task before permitting matter work, and confirm that the account cannot reach excluded material.

For Gmail, selecting a label or naming one matter in a prompt does not prove the connection is restricted to that correspondence. If the account can reach other client files, assess that wider access before authenticating it. Where the required boundary cannot be enforced, keep the mailbox disconnected and supply an approved extract instead.

Cowork File Access

Anthropic’s Cowork guide describes sessions running in an isolated cloud environment. On desktop, Claude can read and write files in folders the user connects. It can organise documents and create or change files through the granted access.

A folder permission is therefore permission to work with its contents. Connect a task-specific folder containing approved copies instead of the firm’s complete matter directory. Keep source originals outside that folder and review proposed changes before allowing them.

Cloud execution also means that a desktop interface does not establish local-only processing. Apply the same approval to connected services, network access and scheduled work that can run after the initial instruction.

Where Claude Stores Data

Anthropic’s commercial location guidance says data is stored in the US. Default processing can route through selected countries in the US, Europe, Asia and Australia.

Its server-location policy separates those functions. Processing can also occur where Anthropic or its affiliates operate for support, safety review and incident response. The consumer Privacy Policy likewise describes international transfers to US and other overseas servers.

Usage-based Enterprise organisations can enable US-only inference. That setting limits where the model processes requests. It does not change storage location or the infrastructure used by a third-party connector.

Anthropic’s Australian expansion announcement describes exploration of local compute capacity. It does not establish an Australian-only storage and processing commitment for an ordinary Claude account.

For a firm requiring Australian sovereignty, global processing that includes Australia is insufficient. The approval needs an explicit contractual boundary covering storage, processing and permitted overseas access. A Sydney office or an Australian billing address supplies neither.

API retention is a separate configuration decision. Use the zero data retention guide when reviewing a supplier’s API arrangement instead of applying chat-app settings to its service.

Claude Security Incidents

Publicly reported Claude incidents need to be separated by what was exposed. A source-code release and an agent accessing another organisation’s systems have different consequences for client information.

In 2026, Claude Code leaked internal source code. Anthropic told Axios that sensitive customer data and credentials were unaffected.

Anthropic also reported three cybersecurity-evaluation incidents in 2026. Models reached real systems through an evaluation environment that unexpectedly allowed internet access. The reported impacts included extracted credentials and access to a database containing several hundred rows of another organisation’s production data.

Anthropic says those evaluations used dedicated infrastructure separate from its sensitive internal systems and customer data. The report concerns unauthorised actions against outside systems, rather than evidence that legal teams’ ordinary Claude conversations were leaked.

If a provider notice could affect the firm, identify the accounts and client material involved before deciding the response. Preserve the notice and have the incident lead assess containment and any notification duties. Disconnect affected integrations where necessary, remembering that this does not itself erase content already retrieved into chats.

A matter-analysis comparison belongs in FinTrace vs Claude. Before connecting the firm’s correspondence, approve the account terms and enforce the permitted access in the connected systems.