Is Claude Private? What "TEE-Verified" Actually Means

Is Claude private? For most business use, yes, by contract: Anthropic's commercial terms rule out training on your data and limit how long prompts are kept. What Claude isn't, on its own, is verifiably private. That gap matters more in 2026 than it did a year ago, because the rules have kept moving: consumer plans now ask users to opt in or out of training, and the newest Claude models carry a mandatory retention window that even zero-retention contracts don't remove. SayGm was built so the layer between you and Claude is private by hardware, not just by policy.

This guide covers how Claude data privacy works across each plan, what changed this year, how Claude AI privacy compliance actually holds up in a security review, and what a "TEE-verified" route to Claude does and doesn't protect. If you want the background on attestation first, start with why attestation matters for LLM gateways.

Table of Contents

• Is Claude Private? It Depends on Your Plan
• What Changed for Claude Privacy in 2026?
• How Claude AI Privacy Compliance Works
• Private by Contract vs. Private by Hardware
• What Does "TEE-Verified" Actually Mean?
• Keeping Sensitive Data Away From Claude Entirely
• Common Questions About Claude Privacy
• Final Thoughts

Is Claude Private? It Depends on Your Plan

"Claude" covers several products that run under two different sets of terms, and the privacy answer changes with each one.

Consumer plans (Free, Pro and Max) sit under Anthropic's consumer terms. Since late 2025, users on these plans choose whether their chats can be used to improve future models. Anthropic's consumer terms update explains the trade: allow it, and retention extends to five years for new or resumed chats; decline, and the existing 30-day retention period stays in place. Paying for Pro or Max doesn't move you into the business tier.

Commercial products sit under Anthropic's Commercial Terms. That covers Claude for Work (Team and Enterprise), the Claude API, and Claude accessed through Amazon Bedrock or Google Cloud. None of these are affected by the consumer training change, and Anthropic doesn't train on content submitted through them by default. For API users, Anthropic's commercial retention policy says inputs and outputs are deleted within 30 days, with exceptions for features you choose that store data longer, zero data retention agreements, and content kept to enforce the Usage Policy.

On top of that, qualifying organizations can negotiate zero data retention (ZDR), where prompts and outputs aren't stored after the response returns, subject to a few safety-related exceptions.

What Changed for Claude Privacy in 2026?

The biggest change this year landed on June 9, 2026, and it reaches the organizations that had done the most to minimize retention.

Anthropic now designates its most capable models, starting with the Mythos-class models, as "covered models." Under the covered models retention policy, prompts and outputs sent to these models are kept for 30 days on every platform where they're offered, to support Anthropic's safety work. Anthropic's reasoning is that some misuse, like jailbreak attempts spread across hundreds of variations, only shows up when requests can be analyzed together rather than one at a time.

The policy only changes things for organizations running ZDR, including ZDR setups on Bedrock, Google Cloud and Microsoft Foundry. Some of those organizations are notified that they're eligible to keep ZDR for these models; the rest have to turn retention on for the workspaces where they want to use them. Anthropic also states that no personnel can read retained conversations by default, that human review happens only through a controlled path for flagged content, and that each access is recorded in a tamper-proof log.

For anyone writing a data-handling policy, the practical takeaway is simple: "we have ZDR with Anthropic" is no longer a complete answer. It depends on which model you're calling.

That applies to SayGm routes too. Claude Fable, a Mythos-class model, is available through SayGm, and a Fable request is still retained by Anthropic for 30 days under this policy. The TEE protects the request while it passes through the gateway; it doesn't change what Anthropic keeps once the request arrives.

How Claude AI Privacy Compliance Works

Anthropic publishes a solid set of credentials: SOC 2 Type I and Type II reports, ISO 27001:2022 for information security, ISO/IEC 42001:2023 for AI management systems, and a HIPAA-ready configuration with a Business Associate Agreement (BAA) available for qualifying commercial customers.

Two things are easy to miss in a vendor review. First, a SOC 2 report or an ISO certificate describes how Anthropic runs its own controls. Neither one lets you send protected health information; for HIPAA workloads, you need the BAA and a HIPAA-ready setup, which restricts which API features you can use. Second, every one of these credentials covers Anthropic. None of them covers the rest of the route your prompt takes: your own logging, any proxy or gateway in the middle, or a third-party tool that holds your API key.

That second point is where Claude's privacy policy stops by design. Anthropic can only make promises about Anthropic.

Private by Contract vs. Private by Hardware

Every Claude privacy guarantee above is contractual: you read the terms, trust Anthropic to honor them, and rely on audits to confirm it after the fact. For many teams that's enough, and Anthropic's detailed, specific policies earn a lot of that trust.

The open question in a security review is the layer before Anthropic. Any gateway in the path can see what passes through, and its usual assurance is another privacy policy. A hardware-attested gateway replaces that second promise with something you can check; the gateway guide linked at the top of this post covers how.

What Does "TEE-Verified" Actually Mean?

A trusted execution environment (TEE) is an isolated region of a processor that keeps code and data encrypted while they're being used, walled off from the host operating system and the hypervisor. "TEE-verified" means the environment can show exactly what it's running: the chip produces a signed measurement of the software inside, and anyone can check that measurement against a known build before trusting it. Our guide to what private inference is goes deeper on how that works.

SayGm runs its gateway inside an Intel TDX trusted execution environment. For a Claude request, that means the gateway operator and the host can't read your prompt while the gateway handles it, and SayGm's routing credentials stay inside the enclave. That's a hardware property you can verify, not a promise to take on faith.

Here's the part that matters for accuracy. Claude is a closed frontier model, so the request still has to leave the enclave and reach Anthropic, which processes it under Anthropic's own terms. SayGm's privacy model is explicit about this: a TEE-verified route doesn't hide a Claude request from Anthropic, and it doesn't change Anthropic's retention or training policy. What it removes is the need to trust the layer in between.

Keeping Sensitive Data Away From Claude Entirely

If the concern is what Anthropic receives rather than what the gateway can see, there are two ways to shrink it.

The first is redaction before the prompt leaves the enclave. SayGm offers optional per-key guardrails that run inside the TEE: PII redaction, secret and credential redaction, custom pattern matching, and blocked-word filters. A name, an account number or an API key can be stripped out before Claude ever sees the request. Pattern-based redaction will miss some values and catch some false positives, so treat it as one layer of a data-loss-prevention program, not the whole program.

The second is not sending the data to a frontier provider at all. SayGm's confidential tier runs open-weight models inside a TEE, marked with a -TEE suffix in the model catalog. On those routes, inference stays inside the confidential environment, so no model provider receives the prompt. For workloads like internal document summaries or code review on proprietary repositories, an open-weight model on the confidential tier can be the more defensible choice, with Claude reserved for tasks that need it.

Common Questions About Claude Privacy

Is Claude AI safe for confidential information?

Claude is safe for confidential information on commercial plans (Team, Enterprise and the API), where Anthropic doesn't train on your data by default and deletes API data within 30 days. Consumer plans (Free, Pro and Max) aren't designed for client files, regulated records or trade secrets. For the most sensitive data, redact it before it reaches Claude or use a confidential TEE model instead.

Does Claude train on your data?

It depends on your plan. On Claude Free, Pro and Max, Claude trains on your chats only if the "Help improve Claude" setting is on, which you can turn off at any time in your privacy settings. On Claude for Work and the Claude API, Anthropic's privacy policy says it doesn't train on your content by default.

How long does Claude keep your data?

Claude keeps consumer chats for 30 days after deletion if you've opted out of training, or up to five years if you've opted in. Claude API data is deleted within 30 days by default, and zero data retention is available to qualifying organizations. Prompts sent to Anthropic's covered models are retained for 30 days even under ZDR, unless your organization has been notified that it's eligible to keep ZDR for them.

Is Claude HIPAA compliant?

Claude can be used in a HIPAA-compliant way through Anthropic's HIPAA-ready API and Enterprise offerings with a signed Business Associate Agreement (BAA). Consumer Claude plans aren't HIPAA compliant, and certifications like SOC 2 or ISO 27001 aren't a substitute for a BAA. If a gateway or other intermediary sits in the route, confirm the full path is covered before sending protected health information.

Can Anthropic see my Claude conversations?

Yes. Anthropic has to process every prompt to generate Claude's response, so a Claude request is never hidden from Anthropic, including one routed through SayGm's TEE. What its policies limit is who at Anthropic can access stored data and how long it's kept. A TEE-verified route adds protection at the gateway layer: the operator and host in between can't read your prompt.

Final Thoughts

So, is Claude private? On commercial plans, Claude's privacy protections are strong and clearly documented, but they're contractual and they only cover Anthropic. The 2026 covered-models change is a reminder that those terms can shift, and that the answer depends on the model as much as the plan. A TEE-verified route adds something a policy can't: hardware attestation that the layer between you and Claude can't read your prompts. Pair it with redaction, or move the most sensitive work to a confidential model, and you have an answer to "where does our data go?" that holds up in a security review.

To try a verifiable route to Claude, follow the SayGm quickstart: swap your base URL and key, keep your existing Anthropic SDK code, and turn on guardrails for the keys that handle sensitive data.

About SayGm

SayGm is a drop-in inference gateway for teams who don't want to just take a company's word that their prompts are private. Every request is routed through a hardware-verified confidential environment - not even SayGm can see what's inside it. That's not a policy, it's provable. Swap in your existing OpenAI, Anthropic, or Gemini code and you're covered in minutes, at transparent, published rates with no hidden markup.

Say gm to AI at saygm.com.

Website | Twitter | Discord | Blog | Medium | Docs | LinkedIn