Not if you use a business account. On Claude Team, Claude Enterprise and the API, the commercial terms bar Anthropic from training models on customer content. There's one exception few people know about: if someone rates a response, that conversation may be used and kept for up to 5 years, and admins can switch it off. On personal accounts, each user makes the call.
But "doesn't train on my data" isn't the same as "doesn't keep my data." That's the part worth reading before you sign.
What does Anthropic say about training on your data, plan by plan?
As of October 2026:
| Account type | Is your data used for training? | What to know |
|---|---|---|
| Free, Pro and Max (personal) | Only if the user allows it | If allowed, data is kept up to 5 years; if not, 30 days. The organization controls nothing |
| Team and Enterprise | Not by default | The commercial terms prohibit it. Exception: feedback, which admins turn off with the Rate chats setting |
| API (developers) | Not by default | Same commercial terms. Anthropic says retained data is never used for training without express permission |
How long does Anthropic keep your data?
This is what almost nobody checks. Not training on your data doesn't mean not keeping it:
| What | How long, per Anthropic |
|---|---|
| API inputs and outputs | Deleted within 30 days, unless otherwise agreed |
| Team and Enterprise conversations | Kept in the product for history; on Enterprise, indefinitely unless an admin sets a period, with a 30-day minimum |
| Deleted conversations | Gone from history immediately, and from back-end storage within 30 days |
| Feedback (thumbs up or down) | Up to 5 years |
| Content flagged for usage policy violations | Up to 2 years |
| Trust and safety scores on flagged conversations | Up to 7 years |
The law can also require data to be kept longer, for example under a legal hold.
What is zero data retention (ZDR)?
An arrangement under which Anthropic doesn't store prompts or responses after the response is returned. Three things to know:
- You ask for it; it isn't included. It's enabled per organization through Anthropic's sales team.
- It doesn't cover everything. It applies to eligible API features and to Claude Code used with commercial API keys. It doesn't cover the Team and Enterprise apps (Claude Code on Enterprise has a separate ZDR offering for qualified accounts), the developer Console, personal plans or third-party integrations.
- It has exceptions. The models Anthropic designates as "Covered Models" (Claude Fable 5.1, Mythos 5.1, Fable 5 and Mythos 5) require 30-day retention and aren't available under ZDR unless Anthropic expressly authorizes it. And even under ZDR, content flagged by safety systems can be kept for up to 2 years.
In practice, ZDR matters most when you build your own system on the API that processes customer data, such as a service assistant or a document review workflow.
Where is the data stored and processed?
Anthropic says commercial data is stored in the US and that traffic may be routed to select countries in Europe, Asia and Australia, as well as the US. Enterprise customers on usage-based billing can ask for US-only processing.
If you use Claude through AWS or Google Cloud, the cloud provider is the data processor and its own terms apply, not Anthropic's ZDR arrangement.
What does this mean for a regulated organization?
- Business accounts only. That's what puts the commercial terms in effect.
- Turn off feedback with the Rate chats setting.
- Set retention on Enterprise to match your records policy.
- Ask for ZDR for your own API-based systems that process customer data, and pick a model that allows it.
- Remember your own records duties. Zero retention on the vendor side doesn't remove yours. If a conversation is a business record, keep it in your own systems.
- Review the contract and data processing addendum with compliance. For banks, the interagency guidance on third-party relationships (OCC Bulletin 2023-17) covers the whole vendor lifecycle, from due diligence and contract negotiation to ongoing monitoring and termination, and data retention and return belong in that review.
An honest caveat: these terms change. Anthropic updates its privacy and retention pages often, so check them again before every renewal, not just at signing.
How do we handle it at Andes?
We work with Claude every day and roll it out for companies: we configure retention, feedback and logging, and document which data goes into each tool. To compare with Gemini and other options, see the table in what data employees can put into AI tools, and for the step-by-step, the Claude Enterprise setup checklist.
Do you know what your AI vendor keeps, and for how long?
If the answer is "we think nothing," it's worth checking. See our AI for regulated institutions service and let's review your configuration and your contract.
Sources
- Anthropic, Commercial Terms of Service: https://www.anthropic.com/legal/commercial-terms
- Claude Privacy Center, Is my data used for model training?: https://privacy.claude.com/en/articles/7996868
- Claude Privacy Center, How long do you store my organization's data?: https://privacy.claude.com/en/articles/7996866
- Claude Privacy Center, Configure custom data retention controls for Enterprise plans: https://privacy.claude.com/en/articles/10440198
- Claude Developer Platform, API and data retention: https://platform.claude.com/docs/en/manage-claude/api-and-data-retention
- Anthropic, Updates to our Consumer Terms and Privacy Policy (August 2025): https://www.anthropic.com/news/updates-to-our-consumer-terms
- Claude Privacy Center, Where are your servers located?: https://privacy.claude.com/en/articles/7996890
- OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management: https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html