AI vendors and your data

Vendors146Answers427

146 vendors · 427 answers

API and data retention changed Anthropic, Nov 9, 2026

Anthropic · Nov 9, 2026 · 7 added, 5 removed · seen by the weekly check

The pageAll Anthropic terms
  1. Added: This page covers the Claude API ( api.anthropic.com ), Claude Platform on AWS, Claude Models on Google Cloud (Anthropic managed) , and Claude in Microsoft Foundry , where Anthropic is the data processor. On Claude Models on Google Cloud (Google managed) and Amazon Bedrock, the cloud provider is the data processor; refer to those platforms' data retention and compliance documentation for their equivalent controls.
  2. Removed: This page covers the Claude API ( api.anthropic.com ), Claude Platform on AWS, Claude in Microsoft Foundry , and Claude Models on Google Cloud (Anthropic managed) , where Anthropic is the data processor. On Amazon Bedrock and Claude Models on Google Cloud (Google managed), the cloud provider is the data processor; refer to those platforms' data retention and compliance documentation for their equivalent controls.
  3. Added: Several retention models sit outside the ZDR and HIPAA arrangements described on this page. Data accessible through the Compliance API follows its own retention model. The Activity Feed retains data for 6 years. Chat, file, and project content from claude.ai follows your organization's retention policy set in claude.ai > Organization settings > Data and privacy , unless a user deletes it sooner. Local session transcripts come from sessions on users' machines, in apps such as Cowork and Claude Code. These transcripts are stored for 6 years by default, or for your organization's custom conversation retention period when a finite one is set (the same claude.ai setting). Remote session transcripts (Cowork in the cloud and Claude Tag) have no default retention period. See Retention and deletion . The Compliance API does not capture local sessions for which ZDR is in effect. For organizations with HIPAA readiness enabled, it captures Cowork and Claude Code local sessions only and stores their transcripts for 30 days.
  4. Removed: Several retention models sit outside the ZDR and HIPAA arrangements described on this page. Data accessible through the Compliance API follows its own retention model. The Activity Feed retains data for 6 years. Chat, file, and project content from claude.ai follows your organization's retention policy set in claude.ai > Organization settings > Data and privacy , unless a user deletes it sooner. Local session transcripts (from sessions on users' machines, in apps such as Cowork and Claude Code) are stored for 6 years by default, or for your organization's custom conversation retention period when a finite one is set (the same claude.ai setting). Remote session transcripts (Cowork in the cloud) are retained for 6 years, unless a user deletes the session sooner. The Compliance API does not capture local sessions for which ZDR is in effect. For organizations with HIPAA readiness enabled, it captures Cowork and Claude Code local sessions only and stores their transcripts for 30 days.
  5. Added: Organizations with a ZDR arrangement cannot call the Claude API directly from a browser: the API rejects their cross-origin (CORS) requests. To call the API from a web application, send the requests from your own back end. See Browser-based applications .
  6. Removed: Cross-Origin Resource Sharing (CORS): CORS is not supported for organizations with ZDR arrangements. To make API calls from browser-based applications, route requests through a backend proxy server. See the API security guidance for proxy patterns and API-key handling.
  7. Added: A thread's contents (the conversation, system prompt, and tools) are held in memory, encrypted under a server-managed key, never written to durable storage, and deleted no more than 1 hour after the thread's last use. Using this feature does not affect your use of other ZDR eligible features. Learn more about Message threads (ZDR)
  8. Added: Nothing blocks the request. Features marked "No" for ZDR are fundamentally stateful: the Batch API stores your jobs, the Files API stores your files, and code execution runs in persistent containers. Data for these features is retained according to the feature's documented policy. Using them is a choice to step outside your ZDR arrangement for that specific data.
  9. Removed: Nothing blocks the request. Features marked "No" for ZDR are fundamentally stateful: the Batch API stores your jobs, the Files API stores your files, and code execution runs in persistent containers. Data for these features is retained per the feature's documented policy. Using them is a choice to step outside your ZDR arrangement for that specific data.
  10. Added: Claude Models on Google Cloud (Anthropic managed) follows the same data retention policy as the first-party Claude API, and Anthropic is the data processor. ZDR is available there on request. On Claude Models on Google Cloud (Google managed) and Amazon Bedrock, the cloud provider is the data processor; refer to those platforms' data retention and compliance policies for their equivalent controls.
  11. Removed: Claude Models on Google Cloud (Anthropic managed) follows the same data retention policy as the first-party Claude API, and Anthropic is the data processor. ZDR is available there on request. On Amazon Bedrock and Claude Models on Google Cloud (Google managed), the cloud provider is the data processor; refer to those platforms' data retention and compliance policies for their equivalent controls.
  12. Added: Files API reference Preview with links to the API reference available - press Tab until focus enters the card, Escape to return.
About this change
Page
platform.claude.com/docs/en/manage-claude/api-and-data-retention
Kind
Documentation
Text hash
da97cd88789b to 713c35e89091
Dated by
the weekly check that first read the new text