Is Claude Safe? Claude Privacy for Accountants

It depends: Claude can suit client work under approved commercial terms, but a personal account with training enabled is unsuitable for client records.

Is Claude Safe for Client Data?

Claude Team, Enterprise and the API can be suitable when your practice approves the agreement and the information staff may disclose. Paying for Claude Pro or Max leaves you under consumer terms.

Anthropic’s commercial terms treat customer content as confidential and prohibit training on it. Those terms also incorporate a data processing agreement. They do not give your practice permission to disclose a client’s information.

The Tax Practitioners Board’s AI guidance requires client permission before disclosure to a third party, unless a legal duty applies. Record the approved use and obtain permission before uploading client file notes.

For a hypothetical client-letter task, approve the commercial workspace first. Give Claude only the facts needed for that letter, with unnecessary identifiers removed. Keep Tax File Numbers (TFNs) out of general chatbot prompts as a practice rule.

Does Claude Train on Your Data?

Claude’s consumer service can use chats for training unless you opt out. Anthropic’s consumer terms make that distinction explicit. A paid personal subscription does not change it.

Use the documented model improvement setting to check the account before anyone starts work:

1. Open the account menu and select Settings.
2. Open Privacy.
3. Turn off “Help Improve our AI models”.
4. Reopen Privacy and confirm the switch remains off.

Switching it off stops future training use of previously stored and new chats. It does not reverse training already started or completed. Treat an unchecked personal account as unapproved for client information.

There are exceptions to the consumer opt-out. Anthropic’s training policy allows safety-flagged conversations to support its safeguards work. Submitting thumbs-up or thumbs-down feedback also sends the related conversation for possible training use.

The commercial training policy says commercial inputs and outputs are excluded from model training by default. Keep staff feedback and voluntary data-sharing permissions within the practice’s approval rules too.

How Long Claude Keeps Chats

Deleting a Claude chat removes it from history immediately, but Anthropic generally takes up to 30 days to delete it from backend storage. Its consumer retention policy separates deletion from training and safety retention.

Consumer chats allowed into training can remain in de-identified training pipelines for up to five years. Feedback data is also retained for five years. Deleting a chat stops its use in future training, but cannot undo training already underway or completed.

If safety systems flag a policy violation, Anthropic can keep inputs and outputs for up to two years. Safety classification scores can remain for seven years. Legal requirements and disputes can also extend retention.

Incognito chats stay out of chat history and model training. They are retained for 30 days by default, or longer under an Enterprise retention setting. Team and Enterprise owners can still receive them in organisational exports.

Commercial chat history remains available until deleted, subject to the organisation’s retention arrangements. Anthropic’s commercial retention policy describes a standard API deletion period of 30 days, with exceptions for stored files, agreed terms and safety or legal needs.

API retention also depends on the model and feature. Anthropic’s API retention documentation describes zero-retention arrangements and covered models that require 30-day retention. A commercial account alone does not establish zero retention.

Delete Chats or Close an Account

Use Anthropic’s chat deletion instructions after saving any work your practice must retain in its approved records:

1. Open a chat, select its title and choose Delete to remove that conversation.
2. For bulk deletion, open Recents through View all in the sidebar.
3. Select the conversations and choose Delete Selected.
4. To clear your history, continue through the remaining conversations and confirm they no longer appear in Recents.

For a personal account, follow the account deletion instructions. Cancel a Pro or Max subscription and wait until its paid period ends. Then open Settings, select Account and choose Delete Account. Deletion permanently removes your access to saved chats.

Deleting Claude content does not delete your practice’s downloaded copies or the original files in a connected service. Remove unwanted copies separately under your retention policy. Safety and legal exceptions still apply to Anthropic’s deletion periods.

Connectors and File Access

Claude connectors let it access the services you authorise, within your existing account permissions. Some also allow changes. Anthropic’s connector instructions describe tool permissions that can allow, require approval for or block particular actions.

Its Google Workspace documentation describes access to email, calendar information and Drive files. Retrieved information is stored with the associated chat. Deleting that chat removes the retrieved copy under the applicable deletion policy.

Raw connector content is excluded from consumer model improvement, but material copied directly into a conversation can be included. A connector therefore needs its own approval, even when the staff member has already disabled training.

Limit the connected account’s source permissions before connecting it. A staff member who can open every client folder can expose a much wider set of files than one letter requires. Start with an approved folder or restricted account.

Keep sending and file-changing actions blocked or subject to approval. Disconnect unused services in Customize, then Connectors. For broader account and retention decisions, use the AI privacy guide.

Claude Security Incidents and Practice Rules

Reported Claude vulnerabilities show why a no-training promise cannot guarantee that client information stays confidential. In its Claudy Day disclosure, Oasis Security demonstrated hidden instructions in prefilled prompts that could extract information from conversation history.

The researchers also described an open redirect that could send someone from an apparently trusted Claude link to the attack. They reported the flaws to Anthropic. Their disclosure says the prompt-injection issue was fixed and other issues were being addressed.

These were researcher demonstrations, not evidence that every Claude account had been accessed. They show how an attacker’s instructions can reach an assistant through content the user opens. Training settings do not prevent that kind of disclosure.

Adopt a written rule that names the approved commercial workspace and permitted information. Require separate approval for connectors, and tell staff to open Claude directly instead of following unsolicited prefilled-chat links.

If client information enters an unapproved chat, stop adding information and notify the person responsible for privacy immediately. Record what was disclosed and assess the incident before relying on deletion as the response.

Use the AI policy template to record that rule. Once permissions are settled, the Claude for accountants guide covers practical tasks within the approved account.