Is Claude Confidential? What Anthropic Can See, Store, and Train On (2026)

Short answer: It depends on which Claude you mean. Claude has some of the friendliest privacy defaults among the major AI assistants — prompts on paid consumer and business tiers are excluded from model training by default — but "confidential" in the sense a lawyer, clinician, or security team means it is a property of the tier and contract, not the chat window. On Claude.ai Free and Pro, your conversations are processed on Anthropic's US servers under a consumer agreement with no DPA or BAA, so nothing you type is confidential in a professional or regulated sense. On Claude Team, Enterprise, or the API — under a signed DPA, with zero data retention where eligible — Claude can be configured to a genuinely defensible confidentiality posture. And on a work-managed account, your employer may be able to see your chats, whatever Anthropic does. This guide walks through what actually happens to a Claude prompt, who can see it, what Anthropic can train on, and what to do with content that must never leave your device at all.

What "confidential" actually means for an AI chat

When people ask "is Claude confidential?", they usually mean one or more of four different questions:

1. Can other users see my chats? (No — conversations are private to your account, not visible to other Claude users, and not published anywhere unless you create a share link.)
2. Does Anthropic keep or train on what I type? (Depends on tier — details below.)
3. Can specific people — Anthropic staff, my employer, a court — access my chats? (Sometimes, through specific pathways — details below.)
4. Can I put legally protected material in it — privileged, PHI, trade secrets? (Only under the right tier and contract, and often not even then without extra controls.)

Confidentiality is the composite of all four. A tool can be "private" in sense 1 and still be the wrong place for a client name in sense 4. Keep the four questions separate and the honest answers get much clearer.

What happens to a prompt after you hit enter

The mechanics are worth understanding, because most confidentiality intuitions come from local software, and Claude is not local software:

• The prompt leaves your device. Claude runs on Anthropic's server-side infrastructure — as of this writing, US-based infrastructure on every tier, with no EU residency option (see our Claude EU data residency guide). Whatever you type is transmitted, encrypted in transit with TLS, to servers you do not control.
• It is processed to generate the response. The model reads the full conversation context — including files you have uploaded and any project or memory content in scope — to produce its output.
• It is retained according to your tier's terms. Consumer accounts keep conversation history per your settings, and like other major providers Anthropic applies an abuse-monitoring window, meaning content can persist for a period even after deletion. Business tiers put retention under admin control, and the API offers a zero-data-retention option for eligible customers. Exact windows change; verify Anthropic's current documentation for your tier rather than relying on any summary.
• Safety systems may examine it. Like every major provider, Anthropic operates trust-and-safety processes to detect abuse and policy violations. The precise mechanics — what is flagged, what is reviewed, and by whom — are governed by Anthropic's usage policies and change over time, which is exactly why regulated professionals should not assume "no human will ever see this."

None of this is unusual or sinister — it is how hosted AI works everywhere. But it means the correct mental model for a Claude conversation is "data sent to a vendor under a contract," not "notes in a private notebook."

Claude confidentiality, tier by tier

Three things stand out. First, the training default is genuinely favorable: on every paid and business tier, prompts are excluded from training by default — a posture some competitors only reach at the enterprise level. Second, the training default is not the whole story: Claude.ai Pro excludes training and remains a consumer contract with no DPA, which is why it fails the professional-confidentiality test anyway. Third, on business tiers the confidentiality question partly changes hands — from "can Anthropic see it?" to "can my organization see it?" (short version: assume yes; long version in Can My Employer See My Claude Chats?).

Does Claude train on your conversations?

The tier table above is the answer, but it deserves emphasis because it is the single most-asked sub-question:

• Claude.ai Free: conversations may be used for model training unless you opt out in your settings. If you use the free tier, check the data controls and make an explicit choice.
• Claude.ai Pro and all business tiers (Team, Enterprise, API): excluded from training by default. On DPA-covered tiers this is a contractual commitment, not just a settings default.

Two hedges worth stating plainly. Consumer settings and defaults have changed before, across the industry, and can change again — verify the current state in your own account settings rather than trusting a blog post, ours included. And "not trained on" is not "not retained": a prompt excluded from training still sits on Anthropic's servers under the applicable retention terms, still within reach of legal process served on Anthropic, and still visible through whatever safety-review pathways the terms permit. Training is one axis of confidentiality, not the whole of it.

Who can actually see your Claude chats?

• Other Claude users: no. Conversations are scoped to your account. The exception is share links you create yourself — treat a shared conversation URL as public.
• Anthropic personnel: narrowly, under its policies. Anthropic's terms, like every major provider's, permit limited access for purposes such as safety review, abuse investigation, legal compliance, and support. The realistic model is not "employees browsing chats" — it is "specific, policy-gated access pathways exist." If your threat model cannot tolerate any such pathway, the content should not be sent in identifiable form at all.
• Your employer: on a work-managed account, assume yes. Claude Team and Enterprise workspaces are administered by the organization; Enterprise's audit logs and admin controls exist precisely for oversight, and on a managed laptop endpoint monitoring can capture prompts regardless of which account you use. Deleting a chat changes what you see in your sidebar, not necessarily what the organization retains. The full pathway-by-pathway breakdown is in our employer-visibility guide.
• Courts and governments: through legal process. Data held by a US provider is reachable by subpoena and other legal process, and conversations on a work account are ordinary corporate records for discovery purposes. No AI vendor can contract this away; zero-data-retention configurations reduce what exists to be compelled.

Is Claude confidential enough for legal, health, or trade-secret material?

This is where "pretty private for a chatbot" and "confidential in the professional sense" part company.

Privileged and client material. Lawyers operate under a duty of confidentiality (ABA Model Rule 1.6 and its state analogues) that requires reasonable measures before client information goes to any third-party tool, and disclosure to a vendor can put attorney-client privilege itself at risk. Bar ethics opinions since 2023 have made the consumer-versus-enterprise distinction load-bearing: demonstrating reasonable measures on Claude.ai Pro is an uphill argument; demonstrating them on Claude Enterprise under a DPA with configured retention is tractable. The framework — and the workflow that survives bar scrutiny — is laid out in Can Lawyers Use ChatGPT?, and it applies to Claude unchanged.

Health information. Sending PHI to Claude without a BAA is an unpermitted disclosure under HIPAA, full stop — and Claude.ai Free and Pro are not BAA-eligible. Anthropic does offer BAAs for eligible customers via Claude for Work, the API, and Claude on AWS Bedrock or Google Vertex AI. The details are in Is Claude HIPAA Compliant?.

Trade secrets and proprietary code. Trade-secret protection depends on demonstrating reasonable secrecy measures. Pasting an M&A memo or proprietary source code into a consumer AI account is the kind of fact that opposing counsel enjoys finding. Business tiers under contract are the defensible route; secrets embedded in code (keys, credentials, internal hostnames) should be redacted before any prompt leaves the device regardless of tier.

The common thread: for professionally protected material, the consumer tiers are out, the business tiers are the entry ticket, and data minimisation — sending less in the first place — is what turns a defensible posture into a strong one.

Confidential is not the same as compliant

Even a perfectly confidential tool would not make a deployment compliant. Compliance regimes ask questions confidentiality does not answer: whether an Article 28 contract exists, what the lawful basis for processing is, how EU-to-US transfers are papered, whether a DPIA was done, how data-subject rights get honored. Claude's business tiers provide the raw materials — a DPA with Standard Contractual Clauses, disclosed sub-processors, training exclusion, retention controls — but the posture has to be assembled by you. If that is your actual question, start with Is Claude GDPR Compliant? and The Anthropic DPA Explained. The reverse is also true: a signed DPA does not make careless prompting confidential. The two properties are built with different tools.

Common misconceptions

• "Claude doesn't train on my data, so it's confidential." Training exclusion is one axis. Retention, safety review, legal process, employer visibility, and the absence of a DPA are the others. Pro's no-training default coexists with a consumer contract unsuitable for client or patient data.
• "Deleting the chat removes it." Deletion controls your sidebar. Abuse-monitoring windows, admin-configured retention on business tiers, legal holds, and anything already captured by endpoint monitoring are outside your delete button's reach.
• "Incognito mode makes it private." Browser modes change what your browser remembers, not what Anthropic receives or what a managed device logs.
• "Anthropic is a safety-focused company, so my data is safe." Anthropic's safety orientation is real and its defaults reflect it — but confidentiality is a matter of contract and configuration, not corporate reputation. Evaluate the tier you are actually on.
• "The API is automatically confidential." The API has strong defaults and a ZDR option, but the application built on it — its logging, its database, its operator — is its own confidentiality surface. Ask what the application retains, not just what Anthropic does.

What to do about genuinely sensitive content

For content that must stay confidential, the reliable strategy has two layers, and they are not substitutes for each other:

Layer one: the right tier and contract. Business use belongs on Claude Team, Enterprise, or the API under a signed DPA — with a BAA where PHI is involved, zero data retention where eligible, and consumer endpoints blocked so staff cannot drift onto personal accounts with work data (the shadow AI problem).

Layer two: keep the sensitive parts out of the prompt entirely. The only data that is unconditionally confidential is data that never leaves your device. This is the layer where Sonomos Locke operates: it runs locally — in the browser, and as a desktop app — detects sensitive entities such as names, contact details, account numbers, health terms, and code secrets on-device, and replaces them with one-way placeholders before the prompt is sent. Claude receives a coherent prompt with placeholders instead of identifiers; the underlying sensitive data never reaches Anthropic's infrastructure — or Sonomos, because detection happens entirely on the device. Reversible tokenization is planned shortly after 1.0.

Two honest boundaries on that claim. Locke is not a compliance guarantee — it is a data-minimisation and pseudonymisation control that strengthens a posture whose contractual and governance layers remain your responsibility. And it does not hide your Claude usage from an employer or network — it changes what is in the prompt, which is the problem most people asking "is Claude confidential?" actually need solved.

Frequently asked questions

Is Claude private?

Private from other users, yes. Private from Anthropic, no — prompts are processed and retained on Anthropic's servers under your tier's terms, with training excluded by default on paid tiers. Private from your employer: only if the account, the device, and the network are all genuinely personal. "Private" is three different questions; Claude's answers are good-for-the-category on the first two and entirely situational on the third.

Is Claude safe for confidential information?

For genuinely confidential information — client matters, patient data, trade secrets — Claude is safe only in the configured sense: a business tier under a DPA (plus a BAA for PHI), retention configured, workforce kept inside the covered tenancy, and ideally a local masking layer removing identifiers before prompts leave the device. On Claude.ai Free or Pro, the answer for that class of information is no — not because Anthropic's security is weak, but because the consumer contract offers none of the commitments professional confidentiality requires.

Is Claude's default training posture more private than ChatGPT's?

By default, for consumer accounts, yes — Claude excludes paid-tier prompts from training by default where ChatGPT's Free and Plus tiers require an opt-out. At the enterprise level the two are broadly comparable, and the deciding factors are configuration and contract rather than vendor. The full four-axis comparison — training, retention, BAAs and DPAs, and workflow surfaces — is in ChatGPT vs. Claude for Confidential Work.

Does Claude keep my conversations after I delete them?

Assume some window of persistence: consumer tiers carry an abuse-monitoring window, business tiers retain per admin policy, and legal holds can override deletion entirely. Zero data retention on the API is the strongest posture Anthropic offers. Check Anthropic's current retention documentation for your specific tier — retention terms are among the things vendors revise most often.

Can I make Claude.ai confidential enough for work by changing settings?

No. Settings can improve the posture — opting out of training on Free, disabling optional features — but no setting adds a DPA or BAA to a consumer account. If the work involves other people's personal data or anything your organization treats as confidential, the tier has to change, not just the toggles.

Related reading

• ChatGPT vs. Claude for Confidential Work: Which Is More Private in 2026?
• Can My Employer See My Claude Chats?
• Is Claude GDPR Compliant?
• Is Claude HIPAA Compliant?
• The Anthropic DPA Explained
• Claude EU Data Residency in 2026
• Can Lawyers Use ChatGPT? Confidentiality, Privilege, and AI
• How to Protect Sensitive Data in ChatGPT, Claude, and Gemini