---
title: "Claude API (Anthropic, PBC)"
url: "https://ailawframework.com/software/anthropic-api"
type: "software_profile"
site: "AI Law Framework"
id: "anthropic-api"
vendor: "Anthropic, PBC"
category: "General-purpose"
segment: "General-purpose assistants"
confidence: "high"
last_reviewed: "2026-09-20"
---

# Claude API (Anthropic, PBC)

> Developer API for Anthropic models. Zero data retention is available on eligible endpoints only. The wrapping application owns retrieval, logging, identity and human gates.

Canonical page: https://ailawframework.com/software/anthropic-api  
Last reviewed: 2026-09-20

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: First-party Claude API and Claude Platform (api.anthropic.com). ZDR and HIPAA-ready are optional and feature-limited. Amazon Bedrock, Google Vertex AI and Microsoft Foundry need separate profiles/contracts.

## Capabilities

- Document summarisation
- Contract drafting
- Agentic workflows
- Knowledge search

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS, Private cloud |
| Hosting regions | United States, Worldwide or dynamically routed |
| Australian region | No |
| Model providers | Anthropic |
| Assurance | SOC 2 Type II, ISO 27001:2022, ISO/IEC 42001:2023, CSA STAR, NIST 800-171 |
| Training on customer content | No |
| Retention | Standard API deletes inputs/outputs within 30 days. ZDR available on request for eligible Messages/Token Counting features and Claude Code; many features excluded. Covered Models require 30-day retention. Activity Feed 6 years. |
| Integrations | Amazon Bedrock (separate contract), Google Vertex AI (separate contract), Microsoft Foundry (separate contract) |
| Legal content coverage | None native. Any legal grounding is supplied by the wrapping application. |
| Pricing | Published token pricing by model. Optional US-only inference multiplier. Batch discount advertised. Console/API credits or invoiced spend depending on account. |
| Australian presence | Yes. API access from Australia is supported. Workspace geo is US-only. Named AU customers may use Platform, Team or Enterprise; not confirmed as API-only. |
| Website | https://platform.claude.com/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan in scope | Public claim only | Direct Claude API (api.anthropic.com) and Claude Platform, including optional Claude Platform on AWS. Bedrock, Vertex and Foundry are separate contracts with the cloud provider as processor. ZDR and HIPAA-ready are optional arrangements with feature eligibility tables. Console playground is outside ZDR. | Confirm we are contracting first-party API versus Bedrock/Vertex/Foundry, and list enabled endpoints, tools, Files API, Batch, Managed Agents and MCP. | [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention); [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) |
| Deployment | Public claim only | API SaaS. Workspace geo is currently US-only and cannot be changed after workspace creation. Inference geo is global (default) or us, on Claude 4.6+ models, at 1.1x price for US-only. Private-cloud style options are Bedrock/Vertex/Foundry under other agreements. | Record workspace geo, default_inference_geo and allowed_inference_geos in the order form. | [Data residency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/data-residency); [Where are your servers located?](https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers) |
| API features | Public claim only | Messages, Token Counting, Files, Batch, Skills, Managed Agents, code execution, web search/fetch, computer use and MCP connectors. Several of these are excluded from ZDR (Console, Managed Agents, Claude for Excel, consumer products, some Covered Models, CORS, third-party integrations). | Which API features will be enabled, and which of them fall outside ZDR or HIPAA-ready? | [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |
| Australia | Public claim only | Australia is supported for API access. There is no Australian workspace geo. Global routing may process inference in selected countries including Australia; storage remains US. | Is US storage plus optional AU inference routing acceptable under our APP 8 and client guidelines? | [Data residency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/data-residency); [Where are your servers located?](https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers) |
| Pricing | Public claim only | Published per-million-token rates by model (for example Opus 5 input USD 5 / output USD 25 per MTok at review date). US-only inference is 1.1x on Claude 4.6+. Batch processing advertised at 50% off. Commercial Terms: Anthropic may update published rates on 30 days' notice. | Lock model prices, the 1.1x residency multiplier and any spend caps in the order form. | [Claude pricing (API models)](https://www.anthropic.com/pricing); [Data residency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/data-residency); [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) |
| Application integration | Not confirmed | The API has no Word add-in of itself; the customer application must implement identity, logging and save-back. Console organisations can use SSO/JIT/SCIM (SCIM on Enterprise/Console parent orgs). | Who owns the wrapping application (internal build, Harvey, Legora, other) and does that wrapper's contract flow down these API terms? | [Set up JIT or SCIM provisioning](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning); [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) |
| Support | Public claim only | Developer platform support; security via Responsible Disclosure / HackerOne. No public API uptime SLA was inspected in this review. DPA audit rights exist. | What is the API availability SLA, status page commitment and security severity response time? | [Anthropic Responsible Disclosure Policy](https://www.anthropic.com/responsible-disclosure-policy); [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum); [Anthropic Trust Center](https://trust.anthropic.com/) |
| Quality | Public claim only | Model documentation forms and training-data summaries are listed on the Trust Center. Commercial Terms still require the customer to evaluate outputs. Legal accuracy depends on the wrapping application. | What groundedness tests will the wrapping application run on Australian authorities? | [Anthropic Trust Center](https://trust.anthropic.com/); [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms); [Using Claude for legal work: privilege, confidentiality and configuration](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration) |
| Task fit | Not confirmed | The API is a model endpoint. Task fit is determined by the customer application (prompts, retrieval, citations, human gates). Using the raw API for advice or court documents without those controls is a firm design choice, not a product guarantee. | Document the wrapping application's retrieval sources, citation checks and refusal behaviour for our tasks. | [Using Claude for legal work: privilege, confidentiality and configuration](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration); [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |
| Client-facing applications | Not confirmed | If the firm exposes Claude via a client portal, unqualified-practice and disclosure rules fall on the firm. Commercial Terms require notifying users that outputs may be false. | Will any end-client application call this API, and what practitioner review is mandatory before the client sees output? | [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms); [Using Claude for legal work: privilege, confidentiality and configuration](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration) |
| Model provider | Public claim only | Anthropic. Covered Models (including named Fable/Mythos versions) require 30-day retention and are not ZDR-eligible unless expressly authorised. Customer can pin models per request. | Which model IDs are approved, and will Covered Models be disabled if we require ZDR? | [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention); [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) |
| Subprocessors | Public claim only | Published list (GCP, AWS, Azure, Cloudflare, and feature services). DPA flow-down and 15-day objection. Web search (Brave, TurboPuffer) applies if that tool is enabled. | Map each enabled API tool to a subprocessor and disable unused tools. | [Anthropic subprocessors](https://trust.anthropic.com/subprocessors); [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum) |
| Training | Public claim only | Commercial Terms: Anthropic may not train on Customer Content from the Services. Commercial privacy article: API inputs/outputs not used to train by default. Feedback/bug reports remain an exception if submitted. | Confirm no-training in the signed API agreement, including embeddings and evaluation datasets. | [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms); [Is my data used for model training? (commercial products)](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training) |
| Feedback | Public claim only | Console thumbs-up/down and explicit bug reports can retain conversations up to 5 years and allow training. Avoid sending matter content through those channels. | Disable or administratively forbid feedback from production API keys. | [Is my data used for model training? (commercial products)](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training) |
| Retention and ZDR | Public claim only | Standard API: inputs/outputs deleted within 30 days except Files API, agreed otherwise, ZDR, Covered Models, Usage Policy flags or law. ZDR: Anthropic does not store prompts/responses at rest after the response is returned, per organisation, on eligible Messages/Token Counting features and Claude Code with commercial keys; must be enabled by sales. Console, Managed Agents, consumer products, Team/Enterprise UIs, Claude for Excel, and several tools are outside ZDR. Activity Feed retains 6 years. | Enable ZDR in writing for our organisation, list excluded features we will not call, and state Covered Model handling. | [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention); [How long do you store my organisation's data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data) |
| Deletion | Public claim only | DPA 30-day return/delete on termination. ZDR organisations have little stored content to delete except excluded features, flags and legal holds. Files API and Managed Agents persist until deleted by the customer. | How are Files, batches, agent transcripts and abuse-monitoring stores deleted on instruction, with what certificate? | [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum); [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |
| Human access | Public claim only | Access Transparency can log Anthropic personnel views of covered Messages API and Claude Code content to the Compliance API (eligibility required; does not cover claude.ai apps, consumer, Files/Batch/non-ZDR features, or Bedrock/Vertex). Automated safety processing does not emit those events. | Enable Access Transparency for our API organisation and confirm support staff cannot read prompts without a logged reason code. | [Access Transparency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/access-transparency); [Using Claude for legal work: privilege, confidentiality and configuration](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration) |
| API keys and SSO | Public claim only | API keys and Console roles (Admin, Developer, Billing, etc.). SSO/JIT/SCIM available for Console organisations on documented tiers. Key handling is the customer's responsibility. | How are production keys scoped, rotated, stored in our vault, and revoked on leaver? | [Set up JIT or SCIM provisioning](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning); [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |
| Encryption | Public claim only | DPA AES-256 at rest, TLS 1.2+. CMEK available for Claude Platform (per workspace) in US regions; some Console features disable when CMEK is on. ZDR is compatible with CMEK. | Will CMEK be attached to a new US workspace before any prompts are sent? | [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum); [Customer-managed encryption keys (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) |
| Assurance | Public claim only | Trust Center: Claude via Anthropic API in scope for SOC 2 Type II, ISO 27001, ISO 42001, CSA STAR, HIPAA, NIST 800-171. Reports on request. Not inspected here. | Provide current reports scoped to the first-party API, including AI features we will call. | [Anthropic Trust Center](https://trust.anthropic.com/); [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum) |
| Contract | Public claim only | Commercial Terms + DPA. Customer owns Outputs. 12-month fee cap. California / SF arbitration for Australian customers. Rate card may change on 30 days' notice. | Execute DPA, confirm no-training and ZDR on the order form, and negotiate cap/forum if required. | [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms); [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum) |
| Transfers | Public claim only | US workspace storage. Inference global or US. SCCs in DPA. No Australian region. Cloud-provider routes have their own regions. | Document inference_geo for production traffic and complete an APP 8 assessment for US storage. | [Data residency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/data-residency); [Where are your servers located?](https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers); [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum) |
| Incidents | Public claim only | DPA 48-hour Security Breach notice. Status page. Responsible disclosure policy. Evaluation-environment incidents have been published separately by Anthropic. | Confirm 48-hour notice and NDB cooperation for API tenants, plus status-page SLA. | [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum); [Anthropic Responsible Disclosure Policy](https://www.anthropic.com/responsible-disclosure-policy); [Anthropic Trust Center](https://trust.anthropic.com/) |
| Changes | Public claim only | Terms and prices updatable on 30 days' notice. Model deprecation commitments exist. Feature eligibility for ZDR/HIPAA can change. Covered Model list can expand. | What notice before a model snapshot is retired or a tool loses ZDR eligibility? | [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms); [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |
| Exit | Public claim only | DPA 30-day export/delete. API customers can export via their own logs if they captured them. Activity Feed is a vendor-side record with a long retention. | Will we receive deletion of Files, agents, activity feed and abuse stores, with a certificate, within 30 days? | [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum); [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |
| Tools and MCP | Public claim only | API tools (web search, MCP, computer use, code execution) send data to subprocessors or customer-configured MCP servers. They are often outside ZDR. The wrapping app must not enable them by default for privileged matter. | Which tools are allowed on production keys, and are MCP servers only our own allow-listed endpoints? | [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention); [Anthropic subprocessors](https://trust.anthropic.com/subprocessors) |
| Web search tool | Public claim only | Web search is an API tool using Brave Search / TurboPuffer. Not on by default unless the application enables it. Outside some ZDR/HIPAA feature tables. | Keep web_search disabled on production keys unless a named non-confidential task requires it. | [Anthropic subprocessors](https://trust.anthropic.com/subprocessors); [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |
| Tool use and agents | Not confirmed | Managed Agents persist transcripts. Computer use, bash and MCP can act outside the model. Human confirmation is an application design choice. Anthropic can suspend for Usage Policy or attack. | Which tools require an application-level human confirm, and how do we revoke keys and halt agents immediately? | [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention); [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) |
| Oversight | Public claim only | Commercial Terms place evaluation of outputs on the customer. Compliance API Activity Feed (6 years) and Access Transparency support supervision if enabled. The API will not itself refuse to answer a legal question. | How will our wrapping application log prompts/outputs into our matter file and force lawyer review before use? | [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms); [Access Transparency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/access-transparency); [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) |

## Notes

ZDR is not default and excludes several features. Bedrock/Vertex/Foundry not assessed here. Full SOC 2 reports not inspected. No Australian storage region.

## Sources

- [Anthropic Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) (checked 2026-09-20)
- [Access Transparency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/access-transparency) (checked 2026-09-20)
- [Claude pricing (API models)](https://www.anthropic.com/pricing) (checked 2026-09-20)
- [Where are your servers located?](https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers) (checked 2026-09-20)
- [Set up JIT or SCIM provisioning](https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning) (checked 2026-09-20)
- [Anthropic Responsible Disclosure Policy](https://www.anthropic.com/responsible-disclosure-policy) (checked 2026-09-20)
- [Using Claude for legal work: privilege, confidentiality and configuration](https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration) (checked 2026-09-20)
- [Anthropic Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum) (checked 2026-09-20)
- [API and data retention (ZDR and HIPAA readiness)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) (checked 2026-09-20)
- [Data residency — Claude Platform Docs](https://platform.claude.com/docs/en/manage-claude/data-residency) (checked 2026-09-20)
- [How long do you store my organisation's data?](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data) (checked 2026-09-20)
- [Is my data used for model training? (commercial products)](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training) (checked 2026-09-20)
- [Anthropic Trust Center](https://trust.anthropic.com/) (checked 2026-09-20)
- [Anthropic subprocessors](https://trust.anthropic.com/subprocessors) (checked 2026-09-20)
- [Customer-managed encryption keys (CMEK)](https://platform.claude.com/docs/en/manage-claude/cmek) (checked 2026-09-20)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.