#Can your employer see your Claude chats?
On a Team or Enterprise account, partly. The Primary Owner can export the organisation's data, conversations included, and incognito chats are part of that export. Content a member deleted before the export started is left out. On Enterprise, owners can also export audit logs for the past 180 days: sign-ins, file uploads and conversations created or deleted, but not the titles or content of chats. The Compliance API, which only the Primary Owner can switch on, gives access to chat data and file content.
On a personal Free, Pro or Max account there is no organisation above you, so no admin in Claude can read your chats. That cuts both ways: work done there leaves the organisation with no record of what was shared. Our article on whether an admin can read your AI chats compares this with ChatGPT, Gemini and Copilot.
#Claude Code and Cowork: what they can reach
In a chat, Claude works mostly with what you paste or upload. Claude Code and Cowork open files and take actions themselves, so the question shifts from what someone typed to what the agent can reach.
Claude Code is the coding agent for the terminal and code editors. It comes with Pro and Max, with every Team seat and with Enterprise, and it also runs through the API. It works in the folder where you start it: it reads code, edits files and runs commands, within the permissions you or your organisation set. Cowork brings the same way of working to tasks beyond code. It is available on Pro, Max, Team and Enterprise and reaches the folders you connect through the Claude desktop app. Through connected apps it reads email and documents and can take actions in them. It can also work in a browser, either the one built into Claude Desktop or Chrome through Claude in Chrome, where it sees the pages you have open, including pages behind a login.
Anthropic's own advice in Use Claude Cowork safely is direct. Do not give Cowork access to sensitive local files such as financial documents, and work from a dedicated folder. Switch to manual approval for sensitive files and for actions that are hard to undo, such as sending messages. Give it internet access only to sites you trust. For the browser, Anthropic strongly advises against using it for anything involving sensitive information. For Claude Code, its security guidance asks you to review proposed commands and changes before approving them, and to run work involving untrusted content in a virtual machine or dev container.
The terms follow the account, not the tool. On Free, Pro and Max, the consumer terms also cover Claude Code: coding sessions are used for training when the setting is on and are then kept for up to five years. Under the commercial terms of Team, Enterprise and the API, Anthropic does not train on code or prompts sent to Claude Code. Two of the incidents below, the Cowork file exfiltration and the espionage campaign, show what an agent with access does when it follows the wrong instructions.
#Six ways data leaks into Claude
1. Pasting to summarise. This is the most common scenario. An employee pastes a support ticket, client complaint, HR note, legal draft or intake form and asks Claude to summarise it. For a useful summary, the model rarely needs the real name, email address, account ID, health details or full transaction history. Employees paste the whole text because that is quicker than going through it and removing the details they see as secondary.
2. Drafts with client details built in. Employees use Claude to sharpen draft emails, write proposals and tighten meeting notes. If the draft already mentions a client name, a deal value, a project codename or a pending regulatory issue, the prompt carries commercially sensitive material as well as any personal data. The employee is thinking about the writing, not about the details that came along with it.
3. Personal accounts used for real work. In most organisations this is the quietest risk. Claude is already open in the employee's personal browser profile, so work ends up there. A personal account has its own settings and its own training controls, with no central offboarding or audit trail. The organisation has no contractual data protection and no view of what was sent.
4. Code and configuration shared for debugging. Developers and IT teams paste code, configuration files, log extracts and system descriptions into Claude to review and debug them. These prompts often contain internal API endpoint names, employees' email addresses in log lines, environment variable formats and details of the system architecture. The disclosure matters even if nobody pastes a credential. With Claude Code, the agent reads the repository itself, so the same details reach Claude without anyone pasting them.
5. Incognito mistaken for zero retention. Incognito is useful: it keeps a chat out of history, memory and model training. Employees who discover it may start using it for sensitive work, assuming the conversation disappears once it is closed. Anthropic keeps incognito chats for 30 days for safety review; on Team and Enterprise they are included in the organisation's data export, and on Enterprise also in the Compliance API. Incognito is also unavailable inside projects, which is exactly where employees tend to keep their work context.
6. Project context and knowledge bases in managed workspaces. Claude Enterprise lets organisations build knowledge bases from uploaded documents, project summaries and company information that Claude can draw on. That helps a team stay consistent, but sensitive documents added to the workspace stay there until someone deletes them. When employees leave, their project uploads are not removed automatically; the files stay in the system.
#What a mistake here costs
Under the GDPR, a Claude prompt that identifies a person counts as processing personal data. The organisation needs a lawful basis under Article 6, a processor relationship set out in a DPA with Anthropic, proportionate data minimisation and the practical means to handle subject access and erasure requests.
Consumer accounts cause the hardest compliance problem. If an employee uses a personal Claude account for work without the organisation knowing, there is no DPA, no log of what was processed and no audit trail. The organisation carries the liability but has nothing to answer with.
For UK organisations, the UK GDPR's requirements on processor contracts and appropriate technical measures apply in the same way as in the EU: an organisation is expected to show what data went where, and on what terms.
The consequences go beyond regulation. A pasted draft contract may contain deal terms that should not leave a controlled environment. A post-incident report may reveal a security weakness before it has been fixed. An HR note may contain special category data. Under Article 83 of the GDPR, fines for failing to implement appropriate technical measures can reach 2% of global annual turnover.
#Incidents involving Claude, with sources
January 2024: Anthropic customer data exposed through a service provider. Anthropic confirmed that one of its service providers had accidentally sent a file with a subset of Anthropic customer information, including open credit balances, to the wrong recipient. Anthropic said that no payment data or conversation content was involved, and that the cause was human error at the provider, not a breach of Anthropic's own systems. The incident showed that a supplier's mistake can affect customer data outside Anthropic's direct control. Source: VentureBeat, January 2024.
August 2025: the consent screen for training draws criticism. When Anthropic asked consumer users whether their chats could be used for training, the pop-up came under fire. The Decoder called it a dark pattern: a prominent Accept button, with the choice about training in a small toggle that was easy to miss. Critics argued that consent under the GDPR has to be freely given, informed and unambiguous, and that this design made it too easy to agree without noticing. Source: The Decoder, 29 August 2025.
October 2025: prompt injection exfiltrates data through Code Interpreter. Security researchers disclosed that Claude's Code Interpreter, if given network access, could be manipulated through indirect prompt injection into extracting private conversation content and uploading it to accounts controlled by the attacker. The attack hid malicious instructions in documents or other input Claude was asked to process, making it run code that extracted the chat history. Anthropic initially misclassified the finding, then confirmed it as a valid vulnerability on 30 October 2025. Source: eSecurity Planet / HackerOne responsible disclosure, October 2025.
November 2025: an espionage campaign run through Claude Code. Anthropic reported that a group it assesses with high confidence to be Chinese state-sponsored used Claude Code to try to break into about thirty organisations, including technology companies, financial institutions, chemical manufacturers and government agencies, and succeeded in a small number of cases. The attackers posed as a cybersecurity firm doing defensive testing and broke the attack into small tasks that each looked harmless; Claude then did most of the work itself. Anthropic banned the accounts, notified the organisations affected and worked with the authorities. Source: Anthropic, 13 November 2025.
January 2026: Cowork uploads files to an attacker's account. Days after Cowork launched, PromptArmor showed that a document with hidden instructions could make Cowork upload a file from a connected folder to the attacker's Anthropic account. Cowork's sandbox blocks most internet traffic but allows Anthropic's own API, which the attack used with the attacker's API key. The user did not have to approve anything. The file in the demonstration held financial figures and partial social security numbers. Source: PromptArmor, January 2026.
March 2026: "Claudy Day", an attack chain on claude.ai. Oasis Security demonstrated a complete attack chain against claude.ai that combined invisible prompt injection with data exfiltration to extract the conversation history from a session with default settings. The victim only had to click a search result and press Enter on a harmless-looking prompt. Anthropic fixed the prompt injection; other parts of the chain were still being addressed when the research was published. Source: Oasis Security / TechRadar / Dark Reading, March 2026.
May 2026: "ClaudeBleed" lets other extensions control Claude in Chrome. Researchers at LayerX disclosed that the Claude in Chrome extension accepted instructions from scripts running on the claude.ai origin without checking whether they really came from Anthropic. Another browser extension, even one without special permissions, could use that to send commands to Claude and read data from Gmail, Google Drive and GitHub in the user's browser. Anthropic released a fix in version 1.0.70 on 6 May 2026; the researchers reported that they could bypass that first fix within hours. An AI agent in the browser inherits the risk of every other extension installed alongside it. Source: LayerX via CSO Online and IANS Research, May 2026.
Seven incidents, seven different failures: a supplier's mistake, a consent screen, vulnerabilities in claude.ai, Cowork and the Chrome extension, and attackers using Claude Code itself. In most of them the model did what it was told. What mattered was who got to tell it, and what it could reach.
#The settings in Claude that count
Six settings are worth reviewing before Claude is used widely for work.
1. Audit which plan employees are using Find out which plan each work account is on. If employees are on personal Free, Pro or Max accounts, the organisation has no contractual data protection. Move work to the Team or Enterprise plan before any regulated or confidential data is processed.
2. Turn off model training on consumer accounts For personal accounts still in use, click your name > Settings > Privacy and switch off Help Improve our AI models. Every existing user had to make this choice by 8 October 2025, so check what was actually chosen rather than assuming. Once the setting is off, Anthropic stops using your stored chats and coding sessions in future training runs. Training runs already under way, and models already trained, are not undone. For the equivalent setting in other AI tools, see how to stop AI training on your data.
3. Use Incognito mode for sensitive one-off prompts Incognito is available on every plan. Start a new chat outside a project and click the ghost icon at the top right of the screen. The chat does not appear in history, does not create or use memories and is not used for model training. Anthropic keeps incognito chats for 30 days, and on Team and Enterprise they still appear in the organisation's data export. Inside a project the ghost icon is not available; there you can switch off memory for a single chat before sending the first message. Treat incognito as a lower-risk setting, not as zero retention.
4. Review what Claude remembers Memory is on by default for Free, Pro and Max. Under Settings > Memory you can read, edit and delete what Claude remembers, pause memory or reset it completely. Deleting a chat does not remove the memory entries Claude built from it; those have to be deleted separately. On Team and Enterprise, an owner decides whether memory is available, and each member then switches it on themselves. Our article on how AI memory works explains the details and how to manage memory in each tool.
5. Delete conversations and set retention Delete a single chat from the menu next to it, or select several chats at once in the chat list. Deleted chats disappear from history straight away and are removed from Anthropic's back-end systems within 30 days. On Enterprise, owners can set a custom retention period under Organization settings > Data and Privacy, with a minimum of 30 days. Zero Data Retention is an arrangement for the API, not for the Team or Enterprise chat interface.
6. Check Anthropic's data processing addendum for commercial use Anthropic's Data Processing Addendum (in force since 24 February 2025) includes the EU standard contractual clauses and the UK addendum for international data transfers, and is automatically incorporated into the commercial terms for Team, Enterprise and the API. Personal consumer accounts are not covered. Before any regulated personal data is processed in Claude, check that the addendum meets your organisation's GDPR obligations for working with processors.
Checked on 20 October 2026 against the Anthropic Privacy Center at privacy.claude.com, the Claude Help Center at support.claude.com and Anthropic's Claude Code documentation.
#The gap no setting closes
Settings decide how Anthropic handles conversation data once it arrives. They do not decide whether a prompt should have contained identifiable data in the first place.
Turning off model training does not anonymise a prompt that has already been sent. A short retention period does not tell an employee that a support thread mentions a client's health condition. A Team or Enterprise workspace does not stop an HR manager from pasting a full performance-review file when a single anonymised sentence would have done.
The gap is the moment before the prompt is sent, when the text is still on screen and sensitive values can still be masked with a placeholder or removed. Settings only come into play after that moment. They cannot act during it.
#The moment before Enter
The BeeSensible browser extension checks text fields for personal data while the prompt is still being written. The text goes to BeeSensible's detection service in the EU, where it is analysed in memory and discarded after detection. In Claude, names, phone numbers, IBANs, Dutch citizen service numbers (BSNs), email addresses, payment card details and other configured categories can be highlighted before the employee presses Enter.
The user sees the highlighted value and can mask it with a placeholder or remove it. BeeSensible does not store what is in the prompt. Admins see patterns by data category across applications, without access to individual conversations.
In Claude the organisation can also switch on masking on paste, on attach and on send. With Keep context, the extension puts the real values back into the answer on the employee's screen, while Claude only ever sees the placeholders.
Claude
