CyphrQ
Menu

Anthropic Security: How It Protects Its Models and Customer Data

Anthropic security from its own pages: ASL-3 weight protection, ISO and SOC 2 claims, data retention, zero data retention, and what's unverified.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

9 min read

Anthropic security rests on two sets of published commitments. A Responsible Scaling Policy sets the security standard for protecting its model weights. Commercial data terms say business inputs and outputs are not used for training by default. Most of this is self-reported, and the audit reports are available only on request.

Model weights are the trained numbers that make up a model: whoever copies them can run it outside Anthropic's safeguards. Customer data is the prompts, files and outputs businesses send. This post reads Anthropic's own pages on both, then flags what outsiders can't check. It is part of our AI security coverage, and it is an explainer, not an endorsement.

What is Anthropic's Responsible Scaling Policy, and where does security fit?

The Responsible Scaling Policy (RSP) is Anthropic's rulebook for raising safeguards as models get more capable. The policy page lists version 3.4, effective 8 July 2026, and describes version 3.0 (24 February 2026) as a comprehensive rewrite that added Frontier Safety Roadmaps and Risk Reports.

When a model crosses set capability thresholds, Anthropic commits to upgrade "to the ASL-3 Security Standard or the ASL-3 Deployment Standard". ASL stands for AI Safety Level. Security standards protect the weights. Deployment standards limit misuse by people using the model.

On verification, version 3.2 (29 April 2026) "authorizes the LTBT to request external review of Risk Reports". The LTBT is Anthropic's Long-Term Benefit Trust. The page also commits to work with external red team and penetration testing experts.

One limit: the full v3.4 policy is a PDF that could not be extracted as text, so this post quotes the policy page, not the policy's detailed requirements.

What security controls did Anthropic describe when it switched on ASL-3?

On 22 May 2025, Anthropic announced it had activated ASL-3 protections alongside Claude Opus 4. It said the ASL-3 Security Standard targets sophisticated non-state attackers and involves more than 100 security controls combining prevention and detection. The examples it named:

Control named by Anthropic What it does, in plain terms
Two-party authorization for weight access No single person can reach the weights alone
Stricter change management Changes to sensitive systems get more review
Binary allowlisting on endpoints Only approved software runs on staff machines
Preliminary egress bandwidth controls Outbound data from environments holding weights is limited, so unusual transfers can be blocked

Anthropic presented this as a hedge. It said it had not yet determined whether Opus 4 needed ASL-3 protections and called the deployment "precautionary and provisional".

Who falls outside the scope of Anthropic's ASL-3 security standard?

Insiders. The RSP page records that version 2.2 (14 May 2025) amended "a footnote to exclude both sophisticated insiders and state-compromised insiders from the scope of the ASL-3 Security Standard." Before that, only "highly sophisticated state-compromised insiders" were explicitly excluded.

Put simply, ASL-3 is built to stop a capable criminal group from stealing the weights. It doesn't claim to stop a skilled insider, or one working for a government. The exclusion is written down, and it is the gap to know about.

Which certifications does Anthropic list for its commercial products?

The privacy centre article What certifications has Anthropic obtained?, dated 16 March 2026, lists these for commercial products such as Claude for Work and the Anthropic API:

  • ISO 27001:2022 (information security management)
  • ISO/IEC 42001:2023 (AI management systems)
  • SOC 2 Type I and Type II
  • A HIPAA-ready configuration, with a business associate agreement (BAA) available

It points to the Trust Portal (trust.anthropic.com) for the reports. The portal's content doesn't load without a full browser, so this list comes from the privacy centre article only.

A certificate shows an auditor checked a management system against a standard. It doesn't show what was in scope or what exceptions were found. For what each standard covers, see our explainers on ISO/IEC 27001, SOC 2 versus ISO 27001 and ISO/IEC 42001.

Does Anthropic train its models on business customers' data?

Not by default. Is my data used for training?, dated 18 August 2026, says: "By default, we will not use your inputs or outputs from our commercial products" to train models.

The exceptions: chats a user explicitly submits as feedback or bug reports, and data an organisation chooses to share. Feedback is kept for up to 5 years and de-linked from user and customer IDs before use. Team and Enterprise admins can switch feedback submission off.

Consumer plans follow different rules; our AI at work privacy checklist covers those settings.

How long does Anthropic keep API and Claude for Work data?

From the commercial retention article (1 July 2026) and the API and data retention documentation:

Data Retention stated by Anthropic
API inputs and outputs Deleted on the back end within 30 days
Claude for Work conversations a user deletes Removed from back-end storage within 30 days
Inputs and outputs flagged for Usage Policy violations Up to 2 years
Trust and safety classification scores on flagged content Up to 7 years
Compliance Activity Feed 6 years

The two pages word the default differently. The API documentation says conversation content "is not retained by default", except for models that require 30-day retention. The privacy article describes deletion within 30 days. Ask your account team which applies to your contract.

What does Anthropic's zero data retention cover, and what doesn't it?

Under zero data retention (ZDR), the documentation says Anthropic "does not store customer prompts or responses at rest after the API response is returned." It isn't on by default: you request it from sales, and it is enabled per organisation.

ZDR covers the Messages and Token Counting APIs for eligible features, and Claude Code used with a commercial organisation's API keys. It does not cover:

  • The Claude Console, including the playground
  • Claude Free, Pro and Max plans
  • The Claude Team and Enterprise interfaces (Claude Code on Enterprise has a separate ZDR offering)
  • Stateful features such as the Batch API, the Files API and code execution
  • Claude Fable 5, Fable 5.1, Mythos 5 and Mythos 5.1, which require 30-day retention unless Anthropic expressly authorises otherwise
  • Third-party integrations

Even under ZDR, flagged chats or sessions may be kept for up to 2 years, and data may be kept where the law requires it.

How can researchers report security flaws to Anthropic?

The Responsible Disclosure Policy, last updated 14 February 2025, covers internet-facing systems Anthropic owns or controls, with reports through HackerOne. Anthropic commits to acknowledge reports "within three (3) business days" and says it "will not pursue any legal action" over good-faith research. It doesn't mention rewards.

The model safety bug bounty, announced 8 August 2024, targets universal jailbreaks in high-risk areas including CBRN (chemical, biological, radiological and nuclear) and cybersecurity. It offered bounty rewards of up to $15,000 and began as invite-only on HackerOne.

What does Anthropic publish about attacks and incidents?

Anthropic publishes threat-intelligence reports on misuse of Claude, and in 2026 it disclosed incidents from its own cybersecurity evaluations. We've covered the misuse cases in how attackers misuse AI models and the evaluation incidents in AI agents escaping test environments. Both are company-written and company-scoped.

What can't outsiders verify about Anthropic's security?

  • Whether the ASL-3 controls work as described. There is no public, independent attestation of the controls themselves on the pages reviewed.
  • What the audits found. Without the SOC 2 and ISO reports, you can't see scope, exceptions or audit period.
  • Insider risk. By Anthropic's own scoping, sophisticated insiders sit outside the ASL-3 Security Standard.
  • How often content is flagged. Flagged data can be kept for years, even under ZDR, and the pages give no flagging rates.

Going deeper: for security and IT teams

Processor role depends on the route. The API and data retention page says Anthropic is the data processor for the Claude API (api.anthropic.com), Claude Platform on AWS, Claude in Microsoft Foundry and Claude Models on Google Cloud (Anthropic managed). On Amazon Bedrock and Claude Models on Google Cloud (Google managed), the cloud provider is the processor. Map each application's route first: the same model can sit under two data regimes.

ZDR is a contract state, not a request flag. If you call a feature marked "No" for ZDR, the page says "Nothing blocks the request." Batch jobs, uploaded files and code-execution containers are then stored under each feature's own policy. Enforce it yourself: block those endpoints at your API gateway for ZDR workloads and alert on any calls.

Signals to monitor. For Covered Models, a request from an organisation whose retention setup doesn't meet the 30-day requirement returns 400 invalid_request_error. A spike after a model change means a ZDR workload was pointed at a model that needs retention. ZDR organisations can enable Standard data retention (30 days) per workspace; the Default Workspace always follows the organisation setting. Add workspace retention settings to your access reviews. CORS isn't supported for ZDR organisations, so browser apps need a backend proxy, which also keeps API keys out of browsers.

Retention you still own. The Activity Feed keeps data for 6 years. Remote session transcripts are kept for 6 years unless deleted. Local session transcripts default to 6 years, or the custom period set in claude.ai under Organization settings, Data and privacy. Check these against your records schedule and subject access process.

Threat model for the weights. The ASL-3 announcement names a sophisticated non-state adversary. Its controls are familiar ones: dual control, application allowlisting, change management and egress rate limits as data-loss prevention. The RSP page puts sophisticated and state-compromised insiders outside the ASL-3 security scope. If weight theft by a state actor is material to you, for example because you rely on Anthropic's misuse safeguards staying in Anthropic's hands, ASL-3 does not claim to cover it.

In practice: the edge of the data promise. Two figures from Anthropic's pages set it. Flagged inputs and outputs can be kept for up to 2 years even under ZDR (API documentation). Classification scores on flagged content can be kept for up to 7 years (commercial retention article). For regulated data, assume any single prompt could end up in long-term retention.

In practice: the disclosure window. The Responsible Disclosure Policy promises acknowledgement within three business days but doesn't publish an investigation timeline, and it excludes third-party systems even on Anthropic domains. Build that into your own vulnerability-handling expectations.

What to ask Anthropic, or check in the Trust Portal:

  1. The SOC 2 Type II audit period, system description and any exceptions.
  2. The scope statements on the ISO 27001:2022 and ISO/IEC 42001:2023 certificates.
  3. Written confirmation of your ZDR status, and which workspaces have 30-day retention on.
  4. Whether customers are told when their content is flagged and retained.
  5. Whether any independent party has assessed the ASL-3 security controls.

Learn more

Key takeaways

  • Anthropic protects weights under its Responsible Scaling Policy and customer data under its commercial terms and retention rules.
  • ASL-3 security targets sophisticated non-state attackers; insiders, including state-compromised ones, are out of scope.
  • Anthropic lists ISO 27001:2022, ISO/IEC 42001:2023, SOC 2 Type I and II and a HIPAA-ready configuration. The reports are on request, not public.
  • Business inputs and outputs aren't used for training by default. Submitted feedback is the main exception.
  • Zero data retention needs approval, excludes stateful features and some models, and flagged content can still be kept for up to 2 years.

Sources