Where does your data go?Nowhere without your say-so.

—The answer for leadership

This section is for the person deciding. Everything after it is for your security team — the paper is the version built to forward.

01How much of this applies to you

For most organisations, this is one decision.

Adoption comes down to running Claude on a commercial plan — Team or above. Every protection that matters here comes with that plan by default. Nothing has to be configured, negotiated or deployed to get it.

Individuals exploring before their organisation commits can do so on a personal plan with the training setting turned off — the first module of the training walks through that setting.

02The review in three sentences

The whole review, in three sentences.

03A deliberately narrow scope

One tool, one inspectable loop.

Multiply Academy’s training deploys one AI tool: Anthropic’s Claude Code, used interactively in a terminal on the employee’s own computer. There is no web workspace to govern, no tenant integration, and no background service. The entire data story is a single, inspectable loop — which makes this a materially simpler review than most AI tools your team will have assessed.

If your organisation has already approved Microsoft 365 Copilot — the most common prior AI review — the questions here have the same class of answers (commercial no-training terms, encryption, central governance), applied to a much narrower surface: Copilot’s review concerned tenant-wide access to mail, calendars and SharePoint by design; Claude Code starts with access to nothing beyond the files a user’s task touches, and any reach into other systems exists only if deliberately connected — per user, under that user’s own sign-in, governable centrally (see connecting other systems). The one genuinely different consideration is that processing happens on Anthropic’s infrastructure rather than inside your Microsoft tenant — the retention and control sections below address it directly.

04The data flow, in one paragraph

Nothing moves until a person sends it.

An employee’s files stay on their computer. When they set a task, Claude Code sends the instruction plus the specific files it reads for that task — encrypted — to Anthropic’s servers; the model’s response comes back; the loop repeats. The person working directs what is read and reviews what comes back — and because choosing what the AI reads per task is the core skill the training teaches, that human control point is a practised discipline, not an assumption. Nothing is uploaded in bulk, no index of your data is built, and nothing runs when the terminal is closed. Where an organisation chooses to connect other systems (next section), the same loop extends to them under each user’s existing permissions. On the plans used for organisational work, the server-side copy of each session is deleted within 30 days and is never used to train models — and organisations with stricter requirements can go further: a zero-data-retention arrangement, negotiated directly with Anthropic for qualifying Enterprise accounts, means sessions are not stored at all (detail in the retention section below).

05What leaves the machine

What leaves the machine — and what never does.

And on Anthropic’s side, your data is never: used to train models (contractual on commercial plans), sold, used for advertising, visible to any other customer, or added to any cross-customer index. There is no mechanism by which one customer’s data reaches another.

06Connecting other systems (MCP integrations)

Connections are default-closed, and yours to govern.

Claude Code can optionally connect to other systems — email, cloud drives, calendars, line-of-business tools — through MCP, the open standard for AI-tool connections. Three facts govern the security review:

1. Default-closed. Out of the box there are no connections; each one is deliberately added.
2. Per-user sign-in. A connector authenticates as the individual user (typically OAuth) and can reach only what that user’s account can already reach. The agent inherits existing permissions — it does not create new ones. If a connected tool over-shares, that visibility existed before any AI was attached; the fix belongs in the source system.
3. Centrally governable. Managed settings can allowlist approved connectors or block them outright, so the reachable surface is an organisational decision, not a user one.

Content a connector retrieves enters the session and follows the same transmission and retention rules as everything else on this page. The connected service itself continues to process its own data under its own terms, as it did before.

07Where does it go, and for how long?

Thirty days on commercial plans — or nothing at all.

Processing and storage happen on Anthropic’s infrastructure; data at rest is stored in the US, encrypted with AES-256. Usage-based Enterprise plans can additionally pin all inference to US-based servers.

Server-side retention of Claude Code session data, by plan:

Three honest footnotes that belong in any accurate review:

• —Three exceptions apply on every plan — including under a zero-data-retention arrangement, where nothing else is stored: sessions flagged by automated trust-and-safety systems may be retained up to 2 years; feedback a user actively submits to Anthropic is retained 5 years (the feedback commands can be disabled organisation-wide); and legal holds apply as they would to any processor.
• —Zero Data Retention (ZDR) is not a plan feature. It is a per-organisation arrangement available to qualified Enterprise accounts, enabled by Anthropic’s account team after an eligibility review — raise it with Anthropic (or with us) if your data classification requires it. It is also available for API-based deployments. One caveat: the frontier models Anthropic designates as “Covered Models” under its safety framework require a 30-day retention window and sit outside ZDR; other models are unaffected.
• —The personal-subscription row is why organisations should not roll out on personal accounts. Its protections are settings and policy rather than contract — the consumer terms carry no confidentiality obligations, and policy can change (the training default did, in September 2025). Commercial plans make the same protections contractual. If individuals explore on personal accounts first, the training toggle must be off.

08Who is legally responsible for the data?

You are the controller. Anthropic is your processor.

On Team and Enterprise plans, your organisation is the data controller and Anthropic is your data processor, under a Data Processing Addendum incorporating the EU Standard Contractual Clauses and UK and Swiss addenda. The commercial terms are short and unambiguous on the points that matter:

• —The only exception to that line is the Development Partner Programme, which requires an organisation admin’s explicit opt-in.
• —You own your inputs and outputs. Anthropic assigns its rights in outputs to the customer — an IP assignment, not a licence.
• —Customer content is classified as confidential information with explicit protection obligations.
• —At end of contract, customer data is returned or deleted within 30 days.
• —Anthropic also provides uncapped copyright indemnification on paid commercial plans — a point your legal team will note.

Deeper legal-evaluation material (IP nuances, DPIA inputs, indemnity exclusions) is available on request.

09What can you control centrally?

All of it, and users cannot override any of it.

On the machine itself. Claude Code is read-only by default, asks approval before acting, is scoped to the folder it is started in, and supports OS-level sandboxing — with credential and key files excludable from its reach entirely via the deny rules above. The final control is the person: every action is proposed and approved, and the training builds that supervision into how people work rather than leaving it to policy.

10Deployment options

Two ways to run it — and one keeps everything inside your own cloud.

Standard SaaS (Team or Enterprise) suits most organisations: the controls above, contractual data protection, fastest path to running.

Cloud marketplace deployment suits organisations whose data must stay inside their existing cloud security perimeter. Claude runs on your cloud provider’s managed infrastructure — Anthropic never sees your inputs or outputs, the cloud provider is the data processor, and your existing compliance frameworks, identity management and (optionally) private networking apply. Billing goes through the cloud agreement you already have.

Claude is available across all three major cloud platforms, so this route is open whichever one your organisation already uses.

11Certifications, and who has already done this review

Independently audited, and already through the strictest reviews.

Full reports are available through Anthropic’s Trust Centre.

12The other two tools in the workflow

The other two tools are simpler cases.

The training workflow includes two supporting tools. Both are simpler cases than Claude Code.

13Getting started

The path is short.

Choose Team or Enterprise, forward the paper and the Trust Centre to your security team — the SOC 2 report and DPA answer most questionnaires — and, where you want the hardening baseline, push the managed settings described above. Nothing else on this page is a precondition. The deeper options — cloud-marketplace deployment, ZDR, custom retention — are there when your data classification calls for them, not before.

On policy: little new policy is usually needed. The human-oversight requirement most AI policies already contain is how this methodology works by design — every output is reviewed and approved by the person who directed it.

And where you have a hard constraint, tell us: we would rather scope honestly around it than talk past it.