FYI, everything we say about Anthropic below comes from Anthropic's own terms, pricing page and help center, which we scanned before writing this.
Every firm we talk to asks this, and the (valid) concern usually starts in finance
Once a firm's people start using AI more frequently, someone (usually whoever handles payroll, payouts or client financials) raises their hand and asks whether the company's information is actually protected.
It's the right question to be asking. The slippery part is that most firms are mixing up two different kinds of accounts without realizing it: a company-wide Team or Enterprise account, or a set of individual AI plans that each person bought for themselves.
From our POV, the line that matters is a personal account vs a company account, not Claude vs ChatGPT
When someone buys their own individual Claude plan (Pro, Max or Ultra), they're a consumer in Anthropic's eyes. The account, its settings and everything in it belong to that person, under Anthropic's consumer terms (the contract Anthropic uses for individuals). Turning off the setting that lets Anthropic train on your chats is a great choice, but it's one person's choice, and the company can't see it, enforce it or point to it in a contract.
When the company buys a Claude Team or Enterprise plan, the company is the customer, under Anthropic's commercial terms (the contract it uses for businesses). Those terms say plainly that "Anthropic may not train models on Customer Content." The company owns the data, and Anthropic's data processing agreement, or DPA (the standard contract that spells out how a vendor handles your data), comes with it automatically.
So, for example, a company-wide enterprise ChatGPT/Claude account sits on the company side of that line, and a team on individual ChatGPT or Claude plans sits on the personal side, no matter how carefully each person set their account up.
What actually changes when the company owns the account
Enterprise adds another layer of security, and another layer of administration
For most of the companies we work with, Team is the right fit. Claude Enterprise adds what a larger or more regulated company may need: the company sets its own retention (with a 30-day minimum), plus audit logs, a compliance API, roles, and automatic setup and removal of users. All of that is more for someone to run, and the pricing works differently too: $20 a seat plus usage at API rates, with a 20-seat minimum.
Recent reporting from the past two months points to personal accounts as where the risk is
- Settings chosen at sign-up can go stale. In October Anthropic added a separate setting for voice data, so a training choice someone made months ago may not cover everything now (BleepingComputer, October 4).
- Reimbursing someone's personal plan doesn't make it the company's. The account still belongs to the employee, and the firm has no way to export from it (aiproductivity.ai, October 31).
- The incidents we're seeing involve personal or unapproved accounts. Panasonic treated an employee's upload to an unapproved AI tool as a breach even though training was off (reported October 23). And WIRED reported that a contractor used a personal Claude account on a Defense Department network for about two months before the employer found out (October 29; the employer disputes it).
- We haven't found any report of Claude's training setting turning itself back on. The complaints about settings resetting in this window were about ChatGPT, and OpenAI hasn't confirmed them.
Our recommendation is to move the most sensitive work onto a company account first
- Start with finance. Payouts, payroll and anything with client financial data should run on a company account and not on anyone's personal plan.
- Decide on the company plan together with whoever manages IT and controls the email domain. Single sign-on on a Claude company plan requires verifying the company's email domain, and only one Claude organization can verify a given domain. If you're one office inside a larger organization, that's a conversation with corporate IT.
- Tighten personal accounts in the meantime. Confirm training and voice settings are off on every account, and avoid using thumbs up or down on client work.
- Ask every connector provider for their data terms, Grounded Intelligence included.
Sources
- Anthropic Consumer Terms
- Anthropic Commercial Terms
- Anthropic Data Processing Addendum
- Claude pricing and plan comparison
- How long Anthropic stores consumer data
- Commercial training and feedback
- What is the Team plan
- Who owns and manages team data
- Moving a personal account into Team or Enterprise
- Enterprise retention controls
- Setting up single sign-on
- Office add-in data storage
- Anthropic certifications