Is Claude Code safe for work?
Low risk · 16Anthropic · Coding · facts (high-confidence)
Claude Code is low-risk for default at-work use (16/100): it trains on your data unless you opt out, and holds SOC 2 Type II.
16
Low risk
Watch out: Under commercial terms, Claude Code is not trained on, retains data 30 days by default (Zero Data Retention on qualified Enterprise), and rides Anthropic's SOC 2 and ISO 27001 with a BAA available. Consumer accounts are trained on when data-sharing is enabled and can retain data for 5 years.
Data and compliance facts
- Trains on consumer-tier data
- Opt-out
- Trains on business-tier data
- No
- Training opt-out available
- Yes
- SOC 2 Type II
- Yes
- ISO 27001
- Yes
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- Yes
- EU data residency
- Unverified
- SSO / SAML
- Yes
- Data retention
- Commercial: 30-day standard retention; Zero Data Retention available to qualified Enterprise accounts. Consumer: 5 years if data-sharing is on, otherwise 30 days.
- Safer tier
- Team, Enterprise or API (commercial terms): not the consumer Free, Pro or Max tiers
Why it scores 16 out of 100
- +16Trains on your data. Training is on by default on the consumer tier; you must find and set the opt-out.