Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan and modules in scope
Public claim only
This profile covers Claude Enterprise (self-serve from 20 seats; sales-assisted from 50 seats). The seat fee is USD 20 per user per month billed annually, with all Chat, Cowork and Claude Code usage billed at published API token rates. Claude for Legal (May 2026) is a set of plugins and MCP connectors on this plan, not a separate SKU. HIPAA-ready, CMEK, US-only inference and API Zero Data Retention are optional and do not apply to every surface.
Ask: Confirm the exact seat type (usage-based Enterprise versus any remaining Standard/Premium seats), enabled products (Chat, Cowork, Claude Code, Claude for Legal plugins), and which of ZDR, CMEK, US-only inference and HIPAA-ready will be contracted for our tenancy.
Deployment and hosting
Public claim only
Claude Enterprise is a multi-tenant SaaS product (web, desktop, mobile). The same models are also available via Amazon Bedrock, Google Vertex AI and Microsoft Foundry under those clouds' contracts. Commercial storage is in the United States. Default inference may be routed to selected countries in the US, Europe, Asia and Australia unless US-only inference is enabled. Workspace geography on the first-party API is US-only.
Ask: For our proposed tenancy, state primary storage, inference geo (global versus US-only), backup locations, and whether any work will run on Bedrock, Vertex or Foundry instead of claude.ai.
Legal features and surfaces
Public claim only
Claude for Legal (12 May 2026) adds practice-area plugins (commercial, corporate, employment, privacy, product, regulatory, AI governance, IP, litigation and others) and MCP connectors including iManage, NetDocuments, Docusign, Ironclad, Thomson Reuters CoCounsel, Everlaw, Relativity, Box and Datasite. Claude for Word, Outlook, Excel and PowerPoint is stated to carry context across those apps. Native Claude is not a licensed Australian primary-law database.
Ask: Which plugins, MCP connectors and Microsoft 365 add-ins will be enabled for our tenancy, and which will be switched off by default?
Availability in Australia
Public claim only
Australia is listed among supported countries for commercial API and Claude.ai. A Sydney office opened in April 2026 and Anthropic names Australian enterprise customers (not law firms) on its own site. There is no published Australian storage region for Claude Enterprise.
Ask: Will the agreement record Australia as a supported place of use, and will any Australian government or client residency clauses be met given US storage?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client-facing use and unqualified practice
Not confirmed
Claude Enterprise is sold as a tool for lawyers and in-house teams. The same ecosystem includes public-service connectors (Courtroom5, BoardWise, Free Law Project) and a Legal Clinic plugin aimed at intake. Commercial Terms require the customer to notify users that outputs should not be relied on without independent checking. No Australian-specific unqualified-practice or client-disclosure templates were found.
Ask: Will any client-facing or unsupervised advice path be enabled, and can you disable public-service and clinic plugins so only identified practitioners use Claude on matter data?
Model provider
Public claim only
Anthropic, PBC is the model provider for first-party Claude Enterprise. Models offered include Haiku, Sonnet, Opus, Fable and Mythos classes. Some designated Covered Models require 30-day retention and are excluded from Zero Data Retention unless Anthropic expressly authorises otherwise. Claude is also hosted on AWS, Google Cloud and Microsoft Azure as alternative contracts.
Ask: List the exact model IDs enabled for our tenancy, which of them are Covered Models, and whether any request will leave Anthropic's first-party path for Bedrock, Vertex or Foundry.
Subprocessors
Public claim only
The Trust Center lists hosting (Google Cloud, AWS, Microsoft Azure, worldwide), Cloudflare, Stripe, WorkOS (SSO, United States), Intercom, Nutun (support, South Africa), Boldr (support, Canada), Twilio, Iterable, Sentry, Sift, Arkose Labs, Brave Search, TurboPuffer (web search, added May 2026), ElevenLabs (voice, Claude for Work) and others. DPA section C.3: reasonable notice of new subprocessors; customer may object within 15 days on privacy or security grounds. Anthropic remains liable for subprocessors to the extent it is liable for itself, subject to the agreement's liability cap.
Ask: Provide the current dated list with purpose and location for our product scope, 12-month change history, and written confirmation that our no-training, retention and deletion terms are flowed down. Can we disable web search, voice and support access from named countries?
Training on customer content
Public claim only
Commercial Terms section B: Anthropic may not train models on Customer Content from the Services. The commercial privacy article restates that inputs and outputs from Claude for Work, the API and Claude Gov are not used to train models by default. Feedback is a separate exception (see feedbackUse). Consumer Free/Pro/Max terms are different and must not be used for matter data.
Ask: Confirm in the signed agreement that prompts, uploads, outputs, embeddings, telemetry and support tickets from our Enterprise tenancy are not used to train, fine-tune or evaluate any model, including by subprocessors.
Feedback and ratings
Public claim only
If a user submits thumbs-up/down feedback, Anthropic stores the entire related conversation (not raw connector content unless pasted) for up to five years and may use that feedback to train models. Primary Owners and Owners can disable the Rate chats setting under Organisation settings, Data and Privacy. CMEK organisations have response ratings disabled.
Ask: Disable organisation-wide chat ratings for our tenancy in writing, and confirm historical feedback (if any) will not be used for training.
Retention of prompts, chats and logs
Public claim only
Default: chats and projects on Claude Enterprise are retained to provide the product until deleted or a custom retention period is set. Custom retention (Owners only) has a 30-day minimum; default project retention is indefinite and overrides chat retention for chats inside projects. Custom retention does not apply to Claude Design, Claude Tag, Managed Agents or Claude Code on the web. API standard deletion of inputs/outputs is within 30 days unless Files API, ZDR, Covered Models, Usage Policy flags (up to 2 years content / 7 years classifier scores) or law require otherwise. Team/Enterprise product interfaces are not ZDR-eligible except Claude Code through Enterprise with ZDR enabled. Compliance Activity Feed retains data for 6 years. Incognito chats delete within 30 days unless flagged.
Ask: Set and contract our chat and project retention (including that projects will not remain indefinite), list every feature excluded from that setting, and confirm whether Covered Models or Claude Code will force a 30-day store.
Deletion on instruction and on exit
Public claim only
User deletion of a conversation removes it from history immediately and from backend storage within 30 days (subject to Usage Policy and legal exceptions). DPA section H: within 30 days of termination Anthropic will, if requested, return a copy of Customer Data or provide self-service export, and delete copies including subprocessors, except where law, dispute resolution or combating harmful use requires retention. Organisation data export is disabled when CMEK is on. No sample deletion certificate was published.
Ask: Confirm matter-level deletion (not only whole-tenancy), backup purge lag, treatment of embeddings/indexes, a deletion certificate, and that export remains available for 30 days after termination even if CMEK is enabled.
Vendor staff access to content
Public claim only
Legal configuration article: retained data is processed by automated safety systems; only flagged content can be reached by a human reviewer, under contractual confidentiality, need-to-know and two-person approval for regulated categories. Access Transparency logs human reads of covered API/Claude Code content to the Compliance API — it expressly does not cover claude.ai Enterprise seats, Cowork or Claude in Chrome. Support subprocessors handle user support.
Ask: Is Access Transparency available for our claude.ai Enterprise chats (not only the API)? How is support access logged, and can we require customer approval before any human reads matter content?
SSO, MFA, SCIM and admin controls
Public claim only
Enterprise includes SSO, domain capture, role-based access, SCIM, audit logs, Compliance API, network-level access control and IP allowlisting. JIT is available on Team and Enterprise; SCIM directory sync is Enterprise/Console only and runs via WorkOS. Group mappings can drive roles and seat types. MFA is expected via the customer's identity provider when SSO is enforced; this review did not obtain a standalone Anthropic MFA-enforcement screenshot for local passwords.
Ask: Enable SSO-only (disable local passwords), SCIM deprovisioning, IP allowlisting and connector restrictions on our tier at no extra charge, and show that a disabled directory user loses Claude sessions immediately.
Encryption in transit and at rest
Public claim only
DPA Schedule 2: AES-256 at rest and TLS 1.2+ in transit over public networks. CMEK lets eligible organisations use AWS KMS, Google Cloud KMS or Azure Key Vault for specified Enterprise data written after activation (US regions except Claude Platform on AWS). CMEK disables or degrades search, project RAG, some exports, Slack/Code-on-web and ratings. Account profile data stays on Anthropic-managed keys.
Ask: Confirm encryption of chats, attachments, vector indexes, logs and backups; whether CMEK will be enabled for our tenancy; and which features we would lose.
Independent security assurance
Public claim only
Trust Center (reviewed 20 Sep 2026) marks Claude Enterprise in scope for SOC 2 Type II, ISO 27001:2022, ISO/IEC 42001:2023, CSA STAR, HIPAA (with BAA) and NIST 800-171, with a 2025 Type 2 SOC 2/CSA STAR L2 report, 2026 SOC 2 bridge letter, ISO 27001 and 42001 certificates (2025), and 2025 annual penetration-testing reports available on request. Full reports were not inspected in this review. UK Cyber Essentials is listed for Anthropic Ireland.
Ask: Provide under NDA the current SOC 2 Type II report (scope including Claude Enterprise AI features), ISO 27001 and 42001 certificates and statements of applicability, bridge letter, and penetration-test executive summary with critical/high remediation.
Contract, DPA, IP and liability
Public claim only
Commercial Terms (Anthropic, PBC for customers outside EEA/UK/Switzerland) incorporate the DPA, Usage Policy and Service Specific Terms. Customer retains Inputs and owns Outputs; Anthropic assigns any interest in Outputs. Customer Content is Confidential Information. Paid-use IP indemnity for Services and Outputs, with standard exclusions. Liability cap: fees in the previous 12 months; consequential damages excluded; indemnity is carved out of the cap. Governing law and venue for Australian customers: California law; arbitration in San Francisco. Anthropic may update Terms on 30 days' notice (immediately for legal changes).
Ask: Will you execute the DPA as published, accept a confidentiality overlay covering prompts and outputs, an Australian law/forum option, a higher liability cap for confidentiality, privacy or security breach, and a restriction on unilateral term changes during our term?
Cross-border transfers and APP 8
Public claim only
Storage is in the United States. Default inference may run in selected countries in the US, Europe, Asia and Australia; US-only inference is an Enterprise option on usage-based billing. DPA incorporates EU SCCs Module Two/Three and the UK Addendum. Privacy policy notes an OAIC complaint right for people in Australia but is not an APP-mapped schedule. Support and safety review may occur in countries where Anthropic or affiliates operate. No IRAP assessment was published.
Ask: Document every country for storage, inference, backups, support and safety review on our configuration; confirm SCC/UK addendum execution; and state how you will assist an APP 8 assessment given US storage.
Breach notification and incident history
Public claim only
DPA section G: Anthropic will notify the customer in writing without undue delay and in any event within 48 hours after becoming aware of a Security Breach, and will reasonably cooperate with the customer's investigation. Incident-response procedures are described as tested annually. Trust Center lists CVE-2026-22561 (DLL search-order hijacking in the Claude for Windows installer). Anthropic has also published research posts about evaluation-environment incidents. A public status page exists at status.claude.com. No complete historical incident register for Claude Enterprise was inspected.
Ask: Confirm the 48-hour clock starts on awareness, that notice content will support an Australian NDB assessment, that we may notify regulators and clients, and provide a two-year incident summary including subprocessor events.
Unilateral changes, model updates and funding
Public claim only
Commercial Terms: Anthropic may update the Terms and published rates on 30 days' notice. Subprocessor additions: reasonable notice and 15-day objection window. Anthropic publishes model deprecation and preservation commitments. Series G (12 Feb 2026) raised USD 30 billion at a USD 380 billion post-money valuation; later 2026 press discussed still-higher proposed valuations. Claude for Legal launched 12 May 2026. Feature behaviour can change when models are swapped.
Ask: What notice will we receive before a default model or legal-plugin behaviour change, and do we have a right to freeze a model version or terminate if a material feature is withdrawn or price rises above an agreed cap?
Exit, export and escrow
Public claim only
DPA H: 30-day window after termination to request return or use self-service export, then deletion including subprocessors with stated exceptions. Compliance API can export activity. CMEK disables organisation data exports and audit-log exports in the product UI. No source-code or model escrow was found. Commercial Terms: either party may terminate for convenience (Anthropic on 30 days' notice).
Ask: Provide the export specification (chats, projects, files, skills, audit logs) in open formats, a 30-day post-termination window even with CMEK, certified deletion, and any escrow or wind-down assistance.
Connectors and MCP integrations
Public claim only
Enterprise includes connectors to Google Drive, Gmail, Calendar, GitHub, Microsoft 365 and Slack, plus legal MCP connectors (iManage, NetDocuments, Docusign, Ironclad, CoCounsel, Everlaw, Relativity and others). Admins can control remote and local connectors. Third-party integrations are outside ZDR. Ironclad and Box pages state results are scoped to the user's existing permissions; that is a vendor claim until tested on our DMS.
Ask: List every connector that will be on for our tenancy, the data each sends, whether it inherits DMS or PMS permissions in real time, and confirm unused connectors stay off.
Web search
Public claim only
Web search is a product feature on Team and Enterprise. Subprocessors Brave Search and TurboPuffer (added 6 May 2026) provide web search for all products except Claude for Government. Open-web answers are not licensed Australian primary law. Admin controls for connectors exist; this review did not find a contractual default that web search is off.
Ask: Disable web search (and Brave/TurboPuffer) for our tenancy unless a named task requires it, and confirm queries never include uploaded matter documents.
Agentic actions and kill switch
Not confirmed
Cowork, Claude Code, Chrome, Office agents and MCP connectors can take multi-step actions (edit files, search repositories, orchestrate workflows). Enterprise admins can control connectors, set organisation and user spend limits, and deploy the desktop app centrally. Commercial Terms allow Anthropic to suspend for risk, attack or Usage Policy breach. This review did not find a documented customer kill-switch that immediately halts in-flight agent actions and purges caches across every surface.
Ask: Which actions require an explicit human confirm before send, share, delete or an external call? How do we immediately suspend the tenancy, revoke tokens and stop Cowork/Code agents, and what is the time to effect?
Human oversight of outputs
Public claim only
Commercial Terms D.3: it is the customer's responsibility to evaluate whether Outputs are appropriate, including where human review is appropriate, and to notify users that factual assertions should not be independently relied upon. The legal configuration article recommends keeping a lawyer directing the work. The product does not force a review gate before export or send. Compliance API and audit logs (Enterprise) can record activity for supervision if configured.
Ask: What product controls force or record lawyer review before an output leaves the system, and can audit logs be exported to our SIEM with per-user and per-project detail for at least 12 months?
