Claude Enterprise Security Architecture: Data Handling, Encryption & Compliance 2026

Claude Enterprise Security Architecture: The Overview

Claude Enterprise security architecture is designed around three principles: no training on customer data by default, encrypted data in transit and at rest, and strict access controls through enterprise-grade identity management. This article gives CISOs, compliance teams, and security architects the technical detail they need to complete vendor risk assessments.

We run these security reviews as part of our Claude Security & Governance service — most enterprise organisations need 2-4 weeks to complete a full assessment. This guide gives you the factual foundation before that process starts.

Data Handling: What Anthropic Does and Doesn't Do with Your Data

This is the question every security team asks first. The answer for Claude Enterprise and API customers: by default, Anthropic does not use your conversations or data to train Claude models. This is a contractual commitment, not a default setting that can be toggled — it requires a DPA or API usage agreement that explicitly opts out of training data use.

Here is the breakdown by product tier:

• Claude.ai Free and Pro: Anthropic may use conversations to improve models unless you opt out in settings.
• Claude.ai Enterprise: By contract, conversations are not used for training. This is confirmed in the Enterprise DPA.
• Anthropic API (any tier): API data is not used for model training by default per the API Usage Policy.
• Claude via AWS Bedrock: Follows AWS data processing terms — data does not leave your AWS region, and AWS has confirmed no training use.
• Claude via Google Cloud Vertex AI: Governed by Google Cloud's DPA — no training use of customer data.

Encryption Standards

Data in transit: All API traffic between your application (or Claude.ai) and Anthropic's servers is encrypted using TLS 1.3. Older TLS versions (1.0, 1.1) are not supported on Anthropic's endpoints. Certificate pinning is not required but is supported for high-security API integrations.

Data at rest: Conversation data, when retained (see retention policy below), is encrypted using AES-256. Anthropic's infrastructure is hosted on AWS, which provides hardware-level encryption for EBS volumes and S3 storage objects.

Key management: Anthropic manages encryption keys using AWS KMS (Key Management Service). Enterprise customers with specific key management requirements should discuss Bring Your Own Key (BYOK) options during contract negotiation — this is available for some enterprise tiers.

Data Retention Policy

Retention policy varies by product and usage method. This is a common source of confusion in security reviews.

For organisations with strict data residency requirements, AWS Bedrock deployment is often the right architecture — data never leaves your AWS account and Anthropic has no access to it. Our Claude on AWS Bedrock deployment guide covers this architecture in detail.

Access Controls and Identity Management

Claude Enterprise includes the full identity management stack enterprises expect from SaaS vendors.

Network Security and Infrastructure

Claude Enterprise is hosted on AWS infrastructure in the US-East-1 and US-West-2 regions by default. European data residency options are available for organisations with GDPR Article 44+ requirements — confirm availability during contract negotiation.

Infrastructure hardening: Anthropic's AWS infrastructure uses VPC isolation, Security Groups with least-privilege rules, and no public internet exposure for backend services. The API endpoint is rate-limited and behind DDoS protection (AWS Shield Standard minimum; Shield Advanced for Enterprise SLAs).

Penetration testing: Anthropic conducts regular third-party penetration tests. Enterprise customers can request the executive summary of the most recent pentest as part of vendor due diligence.

Vulnerability management: Anthropic maintains a responsible disclosure programme and public CVE database. Critical vulnerabilities in the API surface are patched and disclosed per the security policy timeline.

For organisations deploying Claude via AWS Bedrock, your network security controls apply directly — VPC endpoints, PrivateLink, WAF rules, and CloudTrail logging are all available. This is the recommended architecture for organisations where network traffic must stay within an AWS private network.

Deploying via AWS Bedrock: Maximum Security Posture

For the most security-controlled deployment of Claude Enterprise, AWS Bedrock is the right architecture. It provides:

• Data stays in your AWS account: No data crosses to Anthropic's infrastructure. Your VPC, your logs, your data.
• AWS IAM integration: All access to Claude models is governed by IAM policies and roles — the same governance you use for the rest of your AWS workloads.
• CloudTrail audit logging: Every Bedrock API call is logged in CloudTrail with request metadata (but not prompt content unless you configure it).
• AWS Macie, Security Hub, GuardDuty: Your existing AWS security tooling monitors Claude interactions as part of your broader security posture.
• VPC endpoints: Claude API calls can traverse AWS PrivateLink — never touching the public internet.
• FedRAMP Moderate: AWS Bedrock with Claude is currently in FedRAMP Moderate scope (GovCloud), making it suitable for many government workloads.

GDPR and Data Residency

Claude Enterprise's GDPR posture is strong but requires active management from enterprise data owners.

Anthropic operates as a Data Processor when providing API or Enterprise services. The enterprise customer is the Data Controller. The DPA defines the processor-controller relationship, specifies sub-processors (AWS, and any other infrastructure providers), and includes Standard Contractual Clauses (SCCs) for data transfers to the US from the EU/EEA.

For organisations that cannot accept any US data transfers — some financial services regulators and certain EU public sector entities — the AWS Bedrock EU West (Ireland or Frankfurt) deployment keeps data within the EEA. The Anthropic API endpoint, however, routes through US infrastructure by default. Confirm regional endpoint availability with Anthropic's enterprise team during contract negotiation.

Data Subject Requests: For GDPR Article 17 (right to erasure) requests involving Claude conversation data, Anthropic supports deletion of Enterprise account data on request. Document this process in your internal data inventory and DPIA (Data Protection Impact Assessment).

Claude Cowork Security Considerations

Claude Cowork introduces additional security considerations because it operates as a desktop agent with file system access. The security model is worth understanding before enterprise deployment.

Permissions: Cowork requests access to specific folders and applications — it does not have unrestricted filesystem access. Users grant access per-session or persistently to defined directories. Admins can restrict which folders are accessible organisation-wide.

Local processing: Files that Cowork reads from your local machine are sent to Claude's API for processing. This means your document content traverses the network under the same encryption and data handling rules as API calls. If you have documents classified as Top Secret or above data classification, treat Cowork access accordingly.

MCP integrations: When Claude Cowork connects to external services via MCP (Salesforce, Jira, etc.), it acts with the credentials you provide. Review the principle of least privilege when configuring MCP server credentials — Cowork should only have the permissions it needs for its defined workflows.

Our Claude Cowork security guide provides a full permissions audit checklist for enterprise deployment.

Claude Code Security Considerations

Claude Code operates in your developer's terminal with elevated access — it can read files, execute commands, and modify code. The Claude Code Enterprise Security guide covers this in full, but key points:

• Code never stored: Code submitted to Claude Code via the API follows standard API data handling — not retained post-response.
• Command execution: Hooks and sub-agent commands execute on the developer's local machine or CI/CD pipeline. Review hook configurations before enterprise-wide rollout.
• GitHub integration: When Claude Code accesses GitHub for PR reviews, it operates under the OAuth scopes you grant — typically read access to repository content and write access to PR comments. Never grant admin repository access.
• CLAUDE.md governance: Use CLAUDE.md to define permitted and prohibited actions for Claude Code across your organisation. This is the primary policy control mechanism for Claude Code behaviour.

Security Assessment Checklist for Procurement

Our Claude Security & Governance service manages the vendor risk assessment process end-to-end — from information requests to DPIA completion and ongoing monitoring. We've run this process for organisations in financial services, healthcare, and legal services, and have the documentation templates ready.

Related Articles