Guides › Claude Enterprise review

Claude Enterprise Security Review Checklist: Data Handling, Retention, Connectors and Admin Controls to Confirm

Hunter Moore, Founder and CTO · Updated October 18, 2026

A Claude Enterprise security review confirms six things: that organization content is excluded from training, what the retention period is and who set it, how identity and roles are enforced, how projects can be shared and with whom, which connectors are enabled and what they store, and what the audit logs and Compliance API give security and legal. Anthropic documents each of these for Claude Team and Enterprise and the API, and two of the defaults deserve attention because they are not what most reviewers assume: Enterprise retention is indefinite until an Owner changes it, and the API's zero data retention arrangement does not extend to the Claude Enterprise interface. This checklist lists the questions, the answer Anthropic's documentation supports as of October 2026, where to confirm it, and the exposures that remain after every setting is right.

The review in four lines

Training is excluded under the commercial terms. Get it as a term in the agreement rather than relying on the default.
Retention defaults to indefinite on Enterprise. An Owner can set a custom period of 30 days or more; projects are retained indefinitely by default and a project's retention governs its chats. Set it before the first upload.
Projects are small knowledge bases. Organization-wide sharing makes uploaded files readable by people who could not open the originals; Owners can disable sharing, and Enterprise can disable it by role.
ZDR is an API arrangement. It covers the Messages and Token Counting APIs per organization, excludes several features and the Covered Models, and does not apply to the Team and Enterprise interfaces.

Scope the review to the product you are buying

Anthropic's commitments split along two lines. Consumer plans run under consumer terms and are out of scope for a corporate review except as the shadow AI baseline employees already have. Claude Team and Enterprise and the Claude API run under the commercial terms and a data processing addendum, and within the commercial side the chat products and the API have different retention mechanics: the API does not retain conversation content by default with a stated exception, while Enterprise retains until an Owner says otherwise. Claude Code is included in Enterprise and has its own zero data retention offering. Several items, among them residency, HIPAA-readiness and the ZDR arrangement itself, are settled with the account team rather than on a settings page, which is where the review should go next when the documentation says to ask. The provider policy comparison places Claude beside ChatGPT, Copilot and Gemini on the same questions.

The checklist

Each row is a question to answer in writing, the position Anthropic's documentation supports as of October 2026, and where to confirm it. Where the documentation reviewed is silent, the row says so, and that is itself a question for the account team.

Area	Question	What Anthropic's documentation supports (October 2026)	Confirm in
Training	Is organization content used to train models?	Excluded under the commercial terms; retained data is never used for training without express permission.	Contract (as a term)
Retention	How long is content kept, and who set it?	Enterprise: indefinite unless an Owner sets a custom period of 30 days or more; projects indefinite by default, governing their chats. API: not retained by default except Covered Models at 30 days; flagged content up to two years.	Configuration
Zero data retention	Does it cover what we will build?	API only, per organization via sales; Messages and Token Counting APIs; excludes Files API, batch, code execution, MCP connector, Managed Agents, the chat interfaces, and Covered Models unless authorized.	Contract, and your integration's feature list
Residency	Where is data stored and processed?	Not stated on the pages reviewed.	Account team, then contract
Identity	How do users sign in and get provisioned?	SSO, domain capture, SCIM provisioning.	Configuration
Roles	Who can enable features and share?	Administrators manage permissions across the organization; Owners enable connectors and sharing; Enterprise can limit sharing by role.	Configuration
Projects	Who can reach uploaded knowledge?	Private, named members or groups, or organization-wide, at view or edit level; Owners can disable sharing and public projects.	Configuration and policy
Connectors	What do they reach and keep?	Google Workspace connectors retrieve on request under user permissions and store retrieved content with the chat; Owners enable connectors; custom MCP servers are not verified by Anthropic.	Configuration, plus your oversharing audit
Audit and compliance	What can security and legal see?	Audit logs and a Compliance API for visibility into usage; usage analytics; spend caps at organization and user level.	Configuration and contract
Healthcare and certifications	What agreements exist?	HIPAA-readiness available on request; certifications per Anthropic's trust documentation.	Trust portal and contract
Claude Code	Is it in scope, and under what retention?	Included with Enterprise; separate ZDR offering for Claude Code on Enterprise.	Contract

Configuration before go-live

The settings below are the ones that change the exposure, in the order they should be made. Most are Owner-level settings in the organization's admin pages; two are conversations with Anthropic.

Enable SSO and domain capture, then SCIM.Capture the verified domains so existing personal accounts under them come into the organization, and provision through the identity provider.
Set the retention period.Choose a custom period of 30 days or more at the organization level before the first project is created; the default is indefinite.
Set the project sharing policy.Decide whether organization-wide sharing is allowed at all, and for which roles; disable public projects unless there is a reason.
Decide the connector list.Enable only the sources that have passed an oversharing audit under sample identities; record the owner for each.
Scope ZDR, if the API is in use.List the endpoints, models and features the integration uses, compare against the exclusions, and get the arrangement in writing per organization.
Ask the account team the unanswered questions.Residency for storage and inference, HIPAA-readiness, and the audit feed's retention and schema.
Connect the Compliance API.Route the audit feed to the SIEM or eDiscovery tool and name who reviews it.
Run the refusal test.Under sample identities, ask Claude for content those users should not have through each connector and each shared project, count what returns, and keep the number with the approval.

Projects and connectors are the data path

Project knowledge is a set of files, text and code uploaded to a project, and on paid plans Claude switches to retrieval over the knowledge when it approaches the context limit, expanding capacity by up to ten times. At that point the project is a retrieval system in the sense the AI knowledge base security guide uses, with the same four failure modes and none of the controls a built knowledge base carries. On Team and Enterprise a project can be private, shared with named members or groups, or shared organization-wide, with view and edit levels. A project shared organization-wide is readable by everyone in the organization regardless of whether they could open the original files, which is the single most common finding when a Claude Enterprise deployment is audited. Owners can turn off sharing and public projects, and Enterprise can turn sharing off for specific roles. Because a project's retention governs the chats inside it, and projects are retained indefinitely by default, the retention setting and the sharing policy need to be set together.

Connectors behave differently from projects and need their own line in the review. Anthropic's Google Workspace connectors retrieve on request under the user's permissions and store what they retrieved with the chat, so retrieved content falls under the chat's retention rather than the source's. Owners enable connectors for the organization, and custom MCP servers are code Anthropic has not verified, which the connector and MCP security page covers. The connector mirrors your permissions, which means it inherits every over-permission in Drive or SharePoint; audit each source under sample identities before enabling it, as the connection procedure describes.

Evidence to keep

Keep the agreement clauses on training, retention and, if negotiated, residency and HIPAA-readiness; an export of the organization settings for SSO, SCIM, domain capture, roles, retention, project sharing and enabled connectors, with the date; the connector inventory with each source's oversharing finding and owner; the Compliance API integration record showing where the audit feed lands and who reviews it; and the refusal-test result from the leakage self-test for each connected source. The framework crosswalk maps each item to the vocabulary your auditors use.

What the review cannot settle

Three exposures survive a correctly configured organization. Over-permissioned sources behind the connectors remain over-permissioned, because mirroring your permissions is a description of your tenant. Identifiers in prompts, uploads and retrieved content cross to Anthropic as written, under the training exclusion and whatever retention you set, but across the boundary, which is the first question a regulator asks. And the commercial terms attach to the organization, so an employee using a personal account is covered by none of them. The keep-sensitive-data guide covers the controls for all three, and the ChatGPT Enterprise and Microsoft 365 Copilot checklists apply the same structure to the platforms most reviews cover alongside Claude.

Where Hardshell sits

Hardshell governs the data path the organization settings do not reach. It connects enterprise data to Claude without migrating it, enforces each user's existing permissions at query time so over-permissioned sources do not become answers, substitutes stand-ins for real identifiers before content reaches Anthropic, and records every retrieval under opaque IDs. Before rollout it tests what the assistant can be made to disclose and maps each finding to MITRE ATLAS technique IDs. It deploys as a cloud service, in a private cloud, or as an offline bundle.

Frequently asked questions

Does Anthropic train on Claude Enterprise data?

No. Anthropic's commercial terms exclude customer content from training, and its documentation states that retained data is never used for training without express permission. Consumer plans are governed separately.

How long does Claude Enterprise keep our data?

Indefinitely, unless an Owner sets a custom retention period of at least 30 days. Projects are retained indefinitely by default and a project's retention governs the chats inside it. On the API, conversation content is not retained by default except for the Covered Models at 30 days, and flagged content may be kept up to two years.

Does zero data retention apply to Claude Enterprise?

No. Anthropic's ZDR arrangement is made per organization through sales for the Messages and Token Counting APIs, excludes the Files API, batch, code execution, the MCP connector, Managed Agents and the consumer, Team and Enterprise interfaces, and excludes the Covered Models unless authorized. Claude Code on Enterprise has a separate ZDR offering.

Can other employees see files uploaded to a Claude Project?

Only if the project is shared. Projects can be private, shared with named members or groups, or shared organization-wide at view or edit level; organization-wide sharing exposes the files to everyone regardless of source permissions. Owners can disable sharing and public projects, and Enterprise can disable sharing for specific roles.

What audit and compliance features does Claude Enterprise have?

SSO and domain capture, SCIM provisioning, role-based permissions, custom data retention, spend caps and usage analytics, and audit logs with a Compliance API that gives security and compliance teams visibility into usage. HIPAA-readiness is available on request. Residency is not stated on the documentation reviewed; confirm with the account team.

Is it safe to connect Google Drive or SharePoint to Claude?

The connector retrieves under the user's existing permissions and stores what it retrieved with the chat, so it is as safe as the source permissions are accurate and the retention setting is deliberate. Audit each source for oversharing under sample identities first, and keep regulated identifiers out unless substitution is in place.

Sources (accessed October 2026)

Anthropic, Commercial Terms of Service; API and data retention; Configure custom data retention controls for Enterprise plans; Claude Projects; Use Google Workspace connectors; Claude Enterprise, now available self-serve (12 February 2026).