Claude Code data privacy: what Claude keeps, and how I keep client data home

TLDR; Claude Code data privacy starts with the login. On a Pro or Max plan, Claude Code runs under Anthropic’s consumer terms. Under them, a training switch sets how long Anthropic may keep your sessions: 30 days with it off, five years with it on. The plan decides what Anthropic may do with your data. Your setup decides what reaches the model: deny the agent your secrets, sandbox its commands, strip personal fields from what your tools return, and keep some work local.

When to check your Claude Code data privacy settings

• You run Claude Code on a client’s code or records. The login decides which vendor terms apply, and the client’s country decides which privacy law applies (Claude Code and privacy law in Australia, Japan and the UK).
• Your agents fetch personal data, such as CRM leads. Whatever a tool returns goes to the model.
• You use a personal plan for work. Free, Pro and Max run under Anthropic’s consumer terms.
• You share chats or artifacts. A shared link is a public page.
• Skip most of this for your own code with no secrets and no personal data, but still check the training switch.

How Claude Code data privacy works

The plan you sign in with sets three vendor terms: training, retention (how long the vendor keeps your data) and access to zero data retention. Under zero data retention, the vendor does not store prompts or responses once it has answered, except where the law requires it or a session is flagged for misuse. Claude Code follows the login, so the same tool runs under consumer terms on one machine and commercial terms on the next.

Your setup decides what reaches the model: your prompts, plus whatever the tools return, such as file contents and command output. No vendor removes personal information before the model reads it. The only redactions I found in Anthropic’s documentation apply to Claude Code’s feedback, survey and error-report uploads.

I checked the table below on 21 October 2026. These terms changed more than once since mid-2025, so read the linked pages before you rely on any row. If you also run Codex or ChatGPT, what Codex and ChatGPT keep, by plan covers the same ground.

Claude and Claude Code data retention, by plan

From 28 August 2025, Anthropic showed existing Free, Pro and Max users a prompt with the training toggle already switched on, and gave them until 8 October to choose. Its consumer terms let it train on chats “unless you opt out”. Anthropic has not published the default for a new sign-up. The terms apply “including when you use Claude Code from these accounts”, so a Max subscription running Claude Code over a client repository falls under them.

On the API (pay-per-use access for developers), Anthropic deletes inputs and outputs within 30 days by default. Zero data retention is available by agreement, except for Covered Models (Fable 5/5.1, Mythos 5/5.1), which require 30-day retention unless Anthropic expressly authorises zero retention for them. Even under zero retention, Anthropic keeps the results of its safety classifiers (models that screen for misuse). If a session is flagged for a policy violation, Anthropic may keep its inputs and outputs for up to two years.

An organisation on Enterprise zero data retention loses some Claude Code features: cloud sessions on the web and Desktop, /feedback, /bug, /share and Remote Control. Claude Code on the web clones your repository into a virtual machine Anthropic runs, and Anthropic stores the session’s transcript.

Data in Australia, Japan or the UK: only Bedrock can pin processing there

On Anthropic’s API, you choose where the model runs (inference) with inference_geo: global, or us at 1.1 times the price. Either way, the API stores data in the US. So do Anthropic’s commercial plans, which may route traffic through the US, Europe, Asia and Australia. Only API customers and usage-billed Enterprise plans can choose a routing location.

The exception is Claude on Amazon Bedrock, Amazon’s cloud service for AI models. AWS runs the model in its own accounts, and Anthropic has no access to the prompts or the model’s replies. A Bedrock inference profile sets which AWS Regions (data-centre locations) serve your requests. Its destinations depend on the Region you call from; check them with GetInferenceProfile. The au. and jp. profiles, and in-Region calls in London, keep requests to the models in the table below inside the country. The eu. profile does not keep UK data in the UK: it spreads requests across seven European Regions.

// CLAUDE THAT STAYS IN-COUNTRY

Where	Profile	Models
Australia (Sydney, Melbourne)	au.	Opus 5.5, Sonnet 5.5, Haiku 5.5
Japan (Tokyo, Osaka)	jp.	Opus 5.5, Haiku 5.5
UK (London)	None (in-Region call)	Opus 5.5

Zero retention on Bedrock is a setting per Region. New accounts start on inherit, under which AWS may keep data for abuse prevention; mode none writes nothing to storage. AWS has not yet published which modes the 5.5 models allow, so read data_retention.allowed_modes from the model endpoint, and set the mode in each Region you use.

Fable and Mythos have no Australian, Japanese or UK profile, so they route globally. AWS keeps their traffic up to 30 days for abuse detection, unless AWS or Anthropic has approved you for zero retention on Fable.

How to keep client data private in Claude Code

Is Claude Code safe for client code? On a commercial login and with the limits below, yes. The first two steps set the vendor terms; the rest limit what leaves your machine.

1. Sign in with a commercial login, and switch training off everywhere else

Client personal data belongs on a Team, Enterprise or API login (what each login costs), or on Claude through Bedrock. On Team, Enterprise and the API, the commercial terms apply, and so does Anthropic’s data processing addendum, a contract on how Anthropic handles personal data for you. The consumer plans come with no such contract. What the contract does under each country’s law is in the privacy-law guide. An admin can hold every developer to the organisation’s login with the forceLoginMethod and forceLoginOrgUUID settings.

On any personal plan you keep, switch off the model training setting under Settings, Privacy.

Don’t rate responses. On Claude’s consumer plans, rating a response keeps the whole conversation for up to five years, and Anthropic may train on it.

Check: you can name each machine’s login and its row in the table above, and every personal plan shows training off.

2. Check each feature against zero data retention

If you buy zero retention, check each feature your code calls against Anthropic’s list. Zero retention does not extend to the chat apps or to Claude Code on the web.

Anthropic’s API and data retention page lists the Files API (kept until deleted or expired), Message Batches (29 days) and code execution (container data up to 30 days) as outside zero retention. The API accepts those features without an error and keeps their data.

Check: every API feature your code calls is on the zero-retention list, and the Claude Console’s Data retention page (Settings, Privacy) shows zero retention.

3. Treat shared Claude chats as public: Google has indexed them

A shared chat is a public web page with an unguessable address, and search engines have found such links three times since mid-2025. In July 2025 a ChatGPT checkbox, “Make this chat discoverable”, let Google index shared chats about addiction, abuse and mental health. In August 2025 more than 370,000 Grok conversations became indexable with no warning. In July 2026 hundreds of shared Claude chats and published Artifacts (documents and small apps Claude builds in a chat) turned up in Google. They held crypto seed phrases, API keys, payroll spreadsheets and CRM exports (TechCrunch’s write-up).

Dropping out of Google does not end the exposure: in August 2025, 404 Media found more than 130,000 shared chats readable on the Wayback Machine.

As of 21 October 2026, Claude, ChatGPT, Gemini and Grok all mark their share pages noindex, a tag that asks search engines to leave a page out. Anthropic’s help article on shared chats still warns that it cannot guarantee every crawler honours the tag. It also warns that unsharing kills the link without touching copies, archives or caches. On Team and Enterprise, chats can be shared only inside the organisation, and a public artifact needs an Owner to switch on external sharing.

// SHARED CHATS THAT WENT PUBLIC

1. Jul 2025ChatGPTA “discoverable” checkbox let Google index shared chats
2. Aug 2025GrokMore than 370,000 conversations made indexable
3. Aug 2025Wayback MachineMore than 130,000 chats still readable
4. Jul 2026ClaudeHundreds of shared chats and Artifacts in Google
5. Oct 2026Vendors mark share pages noindexClaude, ChatGPT, Gemini and Grok, as of 21 October

If a link held anything private, revoke it under Settings, Privacy, Shared chats, Manage; unpublishing an artifact cannot be undone. Then rotate every credential that appeared in it, and ask Google to drop the cached copy with its “Remove outdated content” tool.

// AFTER A PRIVATE LINK LEAKS

1. Revoke itUnpublishing an artifact cannot be undone
2. Rotate credentialsEvery one in it, even after revoking
3. Ask GoogleTo drop the cached copy, via its “Remove outdated content” tool

Check: your shared-chats list holds nothing that touched client data.

4. Add Claude Code deny rules for .env files and other secrets

A project keeps its passwords and API keys in a .env file. Claude Code’s permission rules can deny reads of .env and of ~/.ssh, the folder that holds your SSH keys. Put them in your user settings, ~/.claude/settings.json, so they cover every project:

{
  "permissions": {
    "deny": [
      "Read(//**/.env)",
      "Read(//**/.env.local)",
      "Read(//**/.env.production)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)"
    ]
  }
}

//path is absolute, so Read(//**/.env) matches a .env anywhere on the disk. /path is relative to the settings file, and a bare Read(**/.env) matches only under the current directory. Claude Code has no .claudeignore; a file by that name does nothing. Name the .env variants: .env.* would also block the .env.example an agent needs. A deny at user level beats an allow at project level, so a cloned repository cannot loosen it.

Deny rules cover the file tools and the shell commands Claude Code recognises, such as cat and head. In the docs’ words, “They don’t apply to a command that reads files without naming them, such as grep -r pattern .… or to arbitrary subprocesses.” A script the agent writes can read .env straight past the rule. A hook (a script Claude Code runs before or after an action) can block a command before it runs. Only the sandbox in the next step limits what a script reads.

Check: in a test project with a dummy .env, ask Claude to read it. Claude Code refuses.

5. Turn on the Claude Code sandbox

The sandbox limits which files and network hosts a command can reach. The operating system (Seatbelt on macOS, bubblewrap on Linux) enforces those limits on every shell command Claude Code runs, including a script the agent wrote and anything that script starts. Claude Code merges your Read deny rules into the sandbox’s own. The sandbox wraps shell commands only. File tools, MCP servers (add-ons that connect Claude to other systems) and hooks run outside it, so keep the deny rules too.

Commands reach the network only through a proxy that checks each host against an allowlist, which starts empty. For any other host, the permission mode (how much Claude Code may do without asking you) decides: Manual mode prompts you, and Auto mode refuses unless the command names the host and its classifier approves it. dontAsk mode refuses, and bypassPermissions mode lets it through.

The sandbox is off by default. Run /sandbox, or set sandbox.enabled to true in ~/.claude/settings.json to cover every project. Then:

• Add your credential directories to filesystem.denyRead. By default the sandbox can read “credential files such as ~/.ssh and ~/.aws/credentials”.
• List in network.allowedDomains only the exact API hosts your tools call. The proxy checks the hostname and cannot see inside encrypted (TLS) traffic, so a broad domain such as github.com can let a request hide its real destination (domain fronting).
• Set failIfUnavailable: true, or Claude Code runs commands unsandboxed when the sandbox cannot start.
• Set allowUnsandboxedCommands: false. With it on, Claude Code can retry a blocked command outside the sandbox, and a matching allow rule such as Bash(curl *) approves that retry with no prompt.
• Put a tool that cannot run sandboxed, such as a deploy CLI, in excludedCommands as a narrow pattern (netlify deploy *). An excluded command “runs with your full access”, so list only tools you trust.
• Mask secret environment variables (values your shell passes to every program, often API keys) in the sandbox.credentials block of your user settings. Claude Code ignores mask entries in a repository’s settings. Masking needs network.tlsTerminate, which lets the proxy put the real value back for allowed hosts.

Check: in the test project, ask Claude to run python3 -c "print(open('.env').read())". The sandbox refuses the read.

6. Switch off telemetry and protect the transcripts on disk

Claude Code’s data usage page says its metrics never include code, prompts or file paths. On Bedrock, Claude Code turns off telemetry (usage data sent back to the vendor), error reports and bug reports by default. Elsewhere, these environment variables switch each upload off:

Your disk holds a full copy of every session as plaintext transcripts in ~/.claude/projects/. Claude Code keeps them for the number of days in cleanupPeriodDays (30 by default). If your home directory syncs to a cloud drive, they go with it, so exclude ~/.claude from sync. Turn on disk encryption (FileVault on a Mac) and encrypt backups.

Check: on a Mac, fdesetup status prints “FileVault is On.”, and you know your cleanupPeriodDays value.

7. Gate the data before the model sees it

Give an agent private data, untrusted content and a way to send data out, and instructions planted in the content (a prompt injection) can trick it into leaking the data. Simon Willison calls that combination the lethal trifecta. A filter that stops most attacks does not fix it. In his words: “95% is very much a failing grade.”

In May 2025 a malicious public GitHub issue led an agent to copy private-repository data into a public pull request. A prompt injection made Claude Code run auto-approved network lookup commands that leaked a .env file through DNS queries (CVE-2025-55284, fixed in June 2025). Remove any one leg and the attack fails. Private data is the leg you control best.

// THE LETHAL TRIFECTA

• Untrusted contentA planted instruction, as in a public GitHub issue
• Outbound channelA pull request, a network call, a DNS query
• Private dataThe leg you control best (remove one leg and the attack fails)

So put the gate in the tool that fetches the data, where the model cannot talk its way past it. Give the agent a read-only tool that strips denied fields from every result. Have it reject a query that selects, filters or sorts on a denied field. Otherwise the agent can filter on an email address and infer it from which records come back. The core is a few lines:

// In the tool, before anything reaches the model
const DENY = new Set(["name", "email", "phone", "address", "date_of_birth"]);

function checkQuery({ select = [], where = [], orderBy = [] }) {
  const hit = [...select, ...where, ...orderBy].find((f) => DENY.has(f));
  if (hit) throw new Error(`Field "${hit}" is denied`);
}

const strip = (record) =>
  Object.fromEntries(Object.entries(record).filter(([k]) => !DENY.has(k)));

Keep the tool’s credentials in the operating system’s keyring, out of anything the model reads (building MCP servers covers credential handling for a server you write).

A deny list that starts empty fails open: every field flows until someone adds it. The real access control is the source system’s field-level security on the tool’s account; the deny list only stops fields reaching the prompt.

Check: ask the agent for a denied field, then to filter on one. Both are refused.

8. Run a local model when the data must not leave

Some work should not reach any vendor, whatever the plan. Run an open-weight model (one you download and run yourself) on your own machine, and retention terms and share links stop applying. A local model is smaller and slower than Opus or GPT (model selection compares them), so check its work more closely. Use it for records a client would not want sent offshore, and for cheap automated steps.

Your transcripts still hold everything a local model read, and the agent still needs the deny rules and sandbox.

Check: disconnect every network (Wi-Fi, Ethernet, phone tethering) and run the task again. It still completes.

Pitfalls

In practice

I’m a fractional CTO based in Japan, with clients there and in Australia and the UK. I run Claude Code on their work most days, with Codex as a second reviewer on an account whose terms I have checked. The agents read client repositories and pull leads from a client’s CRM. I check the vendor terms, but I rely on filtering what my tools return.

I build my own read-only command-line tools for my clients’ systems, and give the agent those instead of a broad API connection. Two hold personal data, and both filter it with deny lists:

• The first reads a CRM platform. Since 3 June 2026 each organisation on the platform can carry a deny list per record type. For one organisation the leads list denies 23 fields, among them names, email, phone numbers, address and date of birth. Its OAuth refresh token and client secret sit in the keyring, and its README opens with the fails-open warning.
• The second reads another client’s CRM. Its repository ships a recommended deny list for contacts: date of birth, address, phone, and health or disability notes, which privacy law protects in all three countries.

My analytics CLIs (Search Console, Google Analytics, Bing Webmaster Tools and DataForSEO) take a --format llm flag that strips URL origins and metadata. The model sees /pricing/ and its clicks without the client’s domain.

For local work I run Qwen models on oMLX on a 64 GB M5 Pro: Qwen3.6-35B-A3B for speed, Qwen3.8-27B for accuracy, and Apple’s on-device model when no server is running. The August write-up has the numbers, including where the model fell short.

For every client, the first test is the same. If the work touches personal information, it runs on a commercial login or a local model, through a tool with a written deny list, and the client knows which. I don’t rate responses in a session that has touched client data.

I build the same data gates into the agents I set up for Applied AI clients.

---

Related reading

• Claude Code and privacy law in Australia, Japan and the UK, the duties when client personal data reaches a prompt
• Model selection: Fable vs Opus vs Sonnet vs Haiku in Claude Code, where the local model sits in my routing
• Claude Code hook examples: turning mistakes into tested rules, hooks that block a command before it runs
• Skills, hooks, agents, and commands: how to use each, where hooks and permissions fit
• Local audio transcription with speaker labels in Claude Code, transcription that keeps the recording on your Mac
• A local 27B model shipped code through my dev workflow, the local-model numbers in full
• Building custom MCP servers for your workflow, credential handling for servers you write
• What Codex and ChatGPT keep, by plan, OpenAI’s terms and the Codex settings I change
• Codex reviews my Claude Code work, how I run Codex as a second reviewer

Sources

• Updates to our consumer terms, Anthropic, the prompt rolled out from 28 August 2025 with the training toggle switched on; coverage of Claude Code on consumer accounts. Product announcement
• API data retention, Anthropic Privacy Center, 30-day deletion of API inputs and outputs. Documentation
• Covered Models retention, Anthropic Privacy Center, 30-day retention for Fable and Mythos on every platform. Documentation
• Is my data used for model training?, Anthropic Privacy Center, consumer training and up-to-five-year retention of rated conversations. Documentation
• Consumer Terms of Service, Anthropic, training “unless you opt out”, effective 8 October 2025. Terms
• Zero data retention, Anthropic Privacy Center, per-organisation approval and what is still kept. Documentation
• Commercial training exceptions, Anthropic Privacy Center, the feedback and bug-report exception for Team and Enterprise. Documentation
• Data location, Anthropic Privacy Center, US storage and routing. Documentation
• API and data retention, Claude Developer Platform, feature-by-feature zero-retention eligibility. Documentation
• Zero data retention, Data usage, Permissions, Sandboxing and Security, Claude Code Docs. Login terms, telemetry switches, deny-rule limits and sandbox settings. Documentation
• Data processing addendum, Anthropic, the contract that comes with the Commercial Terms. Terms
• Shared chats, Claude Help Center, what a share link exposes and how to revoke it. Documentation
• Your public ChatGPT queries are getting indexed by Google, TechCrunch, July 2025. News
• xAI published hundreds of thousands of Grok chatbot conversations, Forbes Australia, August 2025. News
• More than 130,000 Claude, Grok, ChatGPT and other LLM chats readable on Archive.org, 404 Media, August 2025. News
• Tons of people’s Claude chats and creations are exposed on Google, 404 Media, July 2026. News
• PSA: your Claude shared chats and artifacts may have ended up on Google, TechCrunch, July 2026. News
• The lethal trifecta for AI agents, Simon Willison, private data, untrusted content and external communication. Independent practitioner
• GitHub MCP exploited, Invariant Labs, private-repository data leaked through a public issue. Security research
• Claude Code data exfiltration via DNS requests, Embrace The Red, CVE-2025-55284. Security research
• Data residency, Claude Developer Platform, inference us or global and US-only workspace storage. Documentation
• Data protection, Data retention and Abuse detection, Amazon Bedrock User Guide. Provider access, retention modes per Region, 30-day retention for Fable. Documentation
• Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 model cards, Amazon Bedrock. Australian, Japanese and London Regions. Documentation

Common questions

Does Claude Code train on my code?

It depends on how you sign in. With a Free, Pro or Max account, Claude Code runs under Anthropic’s consumer terms. These let Anthropic train on your sessions unless you turn the model training setting off, and with it on, Anthropic can keep data for up to five years. With a Team or Enterprise plan or an API key, the commercial terms apply. Anthropic then does not train on your content, except for feedback and bug reports you choose to send.

Is Claude Code safe for client code?

On the right login and with limits, yes. Sign in with a Team, Enterprise or API account so the commercial terms and Anthropic’s data processing addendum (its contract for handling personal data) apply. Deny reads of secrets, turn on the sandbox, and keep personal data out of what the agent can fetch. Claude Code sends Anthropic your prompts and whatever the session’s tools return, such as the files it opens and command output. The limits on what those tools return are the limits on what leaves your machine.

Which Claude plans have zero data retention?

None of the chat plans. Under zero data retention, Anthropic does not store prompts or responses once it has answered, except where the law requires it or a session is flagged for misuse. Anthropic’s sales team approves zero data retention for an API organisation, and it covers Claude Code used with that organisation’s API key. Claude Code on Enterprise has a separate zero-retention offering. Even under the arrangement, the Covered Models (Fable 5 and 5.1, Mythos 5 and 5.1) require 30-day retention unless Anthropic expressly authorises otherwise. Features such as the Files API keep data until you delete it.

Are shared Claude chats visible on Google?

Hundreds were in July 2026, including chats holding API keys and CRM exports. As of October 2026, Claude’s share and published-artifact pages tell search engines not to index them. Anyone with the link can still read the chat, and copies may sit in archives. Unshare it under Settings, Privacy, Shared chats, and rotate any credential that appeared in it.

Can I keep Claude data in Australia, Japan or the UK?

For Claude, only through Amazon Bedrock. Its Australian profile keeps Opus 5.5, Sonnet 5.5 and Haiku 5.5 in Sydney and Melbourne. Its Japanese profile keeps Opus 5.5 and Haiku 5.5 in Tokyo and Osaka. In the UK, only Opus 5.5 can stay in London. Fable and Mythos route globally. Anthropic’s own API and apps store data in the US.