Data use, training & retention
How this is scored
What happens to prompts, uploaded files, connected data and outputs: whether any of it trains a model (the vendor's or a model provider's), how long it is kept and where logs live, whether zero-retention is available, and whether a data processing agreement covers it.
0 — No statement on training or retention; the privacy policy is a website policy that does not cover the product.
3 — A general statement that business data is "not used for training", with no word on retention, on the model providers behind the product or on logs.
5 — Business data excluded from training by contract, retention periods stated for chats and files, and a DPA offered to business customers.
8 — No-training commitments stated for the vendor and every model provider it routes to, retention configurable by the admin (including deletion of chat history), zero-data-retention terms with the model providers named, and abuse-monitoring retention described.
10 — Data use fully accounted for: training, retention, logging and abuse monitoring stated per model provider, customer-controlled retention and deletion with an audit trail, outputs and connected data treated as customer data in the DPA, and an independent audit (SOC 2, ISO 27001 or ISO 42001) covering the product.
The Head of IT
The commercial terms state that Anthropic may not train models on Customer Content from the Services, an opt-out is shown on all plans, and accepting the Commercial Terms also accepts the DPA. Enterprise admins can set custom retention for conversations, projects and artifacts from a 30-day minimum, data past the period is permanently deleted, every retention action is tracked in audit logs, abuse-monitoring retention for safety-flagged conversations is described openly, and SOC 2 and ISO 27001 are listed for the Enterprise plan. I hold it just under the top level because retention defaults to indefinite, the controls are Enterprise-only, and they exclude Claude Managed Agents and features running Claude Code in the cloud — exactly what an agent rollout would lean on. 4 7 6 2 3