Does Claude Code Send Your Code to Anthropic? Privacy, Training and GDPR

What does Claude Code actually send to Anthropic?

Everything the model needs to answer, which is more than your prompt. Anthropic's data usage page states it plainly: "Claude Code runs locally. To interact with the LLM, Claude Code sends data over the network. This data includes all user prompts and model outputs, encrypted in transit via TLS 1.2+."

The part people miss is what counts as a prompt. The page on how Claude Code works lists what the context window holds: "your conversation history, file contents, command outputs, CLAUDE.md, auto memory, loaded skills, and system instructions." The model only sees what is in that window, so each turn ships the files the agent opened and the output of the commands it ran, along with your words. If the agent runs cat config/production.yml or git log -p, the output goes with the next request.

Three surfaces send more than a local session does:

• Claude Code on the web clones your repository into an Anthropic virtual machine: "Your repository is cloned into the session's isolated VM. Anthropic stores the session transcript so you can return to the session later."
• Remote Control, while connected, stores the session transcript on Anthropic's servers to sync it across devices.
• WebFetch sends the hostname of every URL it fetches to api.anthropic.com for a safety blocklist check, "regardless of which model provider you use", even with non-essential traffic disabled. Only the hostname, not the path or the page. The skipWebFetchPreflight setting turns it off.

What never leaves is what the agent never opens. That is the lever the rest of this guide is about. One caution from Anthropic's security page: the working-directory boundary "is a permission prompt, so a Bash command you approve can still write anywhere your user account can". It is a question, not a wall.

If you run Claude Code through Amazon Bedrock or Google Cloud (Vertex AI, now called Agent Platform), requests go to that cloud under its terms. Microsoft Foundry depends on how the model is hosted: on Azure, prompts and completions stay in Azure, but usage metadata and content flagged by Anthropic's safety systems still go to Anthropic; hosted on Anthropic, requests go to Anthropic's own infrastructure. And on every provider, the WebFetch hostname check still reaches Anthropic, per the same data usage page.

Does Anthropic train on my Claude Code sessions?

It depends on how you signed in. On a consumer account, yes if a setting is on. On a commercial account, no.

For Free, Pro and Max, Anthropic's data usage page says: "We will train new models using data from Free, Pro, and Max accounts when this setting is on (including when you use Claude Code from these accounts)." The setting is the one Anthropic introduced in its consumer terms update of 28 August 2025, with a decision deadline of 8 October 2025 for existing users. In the Privacy settings it is called "Help Improve our AI models", and the Claude Code docs link straight to it at claude.ai/settings/data-privacy-controls.

Turning it off is not retroactive. The same announcement says your data "will still be included in model training that has already started and in models that have already been trained", and that Anthropic will stop using previously stored sessions in future runs.

For Team, Enterprise, the API, Bedrock, Google Cloud and Claude Gov, the docs are categorical: "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms, unless the customer has chosen to provide their data to us for model improvement (for example, the Developer Partner Program)." That program is an admin opt-in, available only on Anthropic's first-party API.

Three paths send your code to Anthropic even when the training setting is off, and they are the ones a team policy should name:

• Feedback. "When you run the /feedback command, a copy of your conversation history including code is sent to Anthropic." Transcripts shared through /feedback, /bug or /share are kept for 5 years. On consumer accounts, a thumbs up or down stores the whole conversation for up to 5 years too.
• The session survey. The rating itself sends nothing more, but answering "Yes" to the follow-up uploads the transcript and the raw session log, with "Source code, file contents, and other conversation content [...] uploaded as-is", kept up to 6 months and never used for training.
• Safety flags. Anthropic's privacy center notes that conversations flagged for safety review may still be used to train the models of its Safeguards team.

How long does Anthropic keep Claude Code data?

Thirty days for most commercial use, 30 days or 5 years on a consumer account, and longer in a few exceptions. The figures below come from the data usage page, the zero data retention page and the privacy center.

Two nuances for commercial plans. On Team and Enterprise, the conversations and coding sessions the product lets you reopen, Claude Code on the web included, are kept in the product for that purpose, and Enterprise's custom retention periods "do not apply to" features built on Claude Code on the web, per the privacy center. And on Bedrock or Google Cloud, retention follows your cloud environment, not Anthropic's table.

Zero Data Retention needs a careful reading. For Claude Code it "is available to qualified accounts on Claude for Enterprise", it "is not included in the standard Claude for Enterprise plan and cannot be enabled from your admin settings", and it is set per organization by Anthropic. The privacy center adds the other route: an organization with a zero data retention agreement covers "Claude Code accessed via the API" with its commercial API key. Either way, it does not cover a developer who signs in "with a personal account or with an API key from a different organization", nor data processed by "MCP servers, or other external integrations". And since 9 June 2026, Anthropic's policy on covered models keeps prompts and outputs of its Mythos-class models, Claude Fable 5 and 5.1 included, for 30 days "on every platform where these models are offered". The zero data retention page flags them as models that "require data retention by default".

What does Claude Code keep on my own machine?

More than most people assume, and in plain text. Claude Code "store[s] session transcripts locally in plaintext under ~/.claude/projects/ for 30 days by default", per the data usage page, so that you can resume a session. The cleanupPeriodDays setting changes the period; its minimum is 1, and 0 is rejected.

Two more files deserve a line in your policy. The .claude directory reference describes ~/.claude/history.jsonl as "Every prompt you've typed, with timestamp and project path." And transcripts of sessions started or continued in Claude Desktop or Cowork are kept "at any age" unless you set desktopSessionCleanupPeriodDays (Claude Code 2.1.248 or later).

The consequence is concrete. A secret the agent read during a session sits in a transcript on disk for a month by default, where backup tools, sync clients and anyone with access to the laptop can find it. Shorter retention is cheap; not reading the secret at all is better.

Is Claude Code GDPR compliant?

No tool is GDPR compliant on its own; what can be compliant is your use of it, and Anthropic gives you the documents to build that case. The facts your data protection officer will ask for:

• Who is responsible. For consumer accounts in the EEA, the UK and Switzerland, Anthropic's privacy policy (effective 10 September 2026) names the controller: "Anthropic Ireland, Limited", and gives the contact of its data protection officer. For commercial use, Anthropic acts as your processor under its Data Processing Addendum, effective 24 February 2025, which incorporates the Standard Contractual Clauses (Module Two and Module Three) under Irish law. The DPA is part of the Commercial Terms automatically; on Bedrock or Google Cloud, that platform's terms govern.
• Where data is stored. In the US. Anthropic's own answer on EU servers says traffic may be routed to the US, Europe, Asia and Australia, then: "Note that data is stored in the US." On the Claude API, the data residency settings offer inference in "global" or "us" only, and ""us" is the only available workspace geo."
• How to keep requests in the EU. Through a cloud. The Claude Code docs document an eu inference prefix on Amazon Bedrock (ANTHROPIC_BEDROCK_REGION_PREFIX=eu) and an eu multi-region location on Google Cloud (CLOUD_ML_REGION=eu). Model availability varies by region, so check the model you need before you commit.
• What Anthropic is certified for. Its privacy center lists ISO 27001:2022, ISO/IEC 42001:2023, SOC 2 Type I and Type II, and a HIPAA-ready configuration. Those certify Anthropic's controls, not your use.

European regulators have said what they expect from the deploying side, and it maps onto the switches above. Germany's data protection conference (DSK), in its guidance on AI and data protection of 6 May 2024, prefers applications that do not use inputs for training and suggests configuring employee accounts so that no input trains a model and no history is kept beyond the session. France's CNIL, in its first guidance on deploying generative AI of 18 July 2024, asks deployers to determine how far the provider may reuse the data sent to it, and to adapt the use accordingly. Spain's AEPD published guidance on agentic AI in February 2026 (version 1.2), the only regulator text we found that addresses agents specifically.

In practice, the GDPR question for a team is rarely about the source code. It is about the personal data that sits next to it: customer records in fixtures, a production dump in tmp/, emails in a log file, keys to databases full of people. Those are the files to keep out of the agent's reach, which is the next question.

Can Claude Code read your .env file?

Yes, if it sits in the project and nothing denies it. In January 2026, The Register tested it on Claude Code 2.1.12: with .env listed in a .claudeignore file, "We asked Claude to read the .env file and it did so"; a deny rule in settings.json blocked it. Anthropic's permissions page is now explicit: "If your project has a .claudeignore file, it has no effect, so move its entries into Read deny rules."

The documented fix is a deny rule. This is adapted from Anthropic's own example on the settings page:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)"
    ]
  }
}

Three details decide whether it holds. Read(./.env) only matches the directory Claude Code started in, while a bare Read(.env) follows gitignore rules and matches at any depth, so a monorepo needs the bare form. A deny rule covers Claude's file tools, "file commands Claude Code recognizes in Bash, such as cat, head, tail, sed, and tee", and redirections; it does not cover "a Python or Node script that opens files itself". And grep -r sits in a grey zone: the permissions page says the rule does not apply to it, the 2.1.259 changelog says it "now asks", and an open issue (#91690) reports that the fix does not reproduce on Windows with the VS Code extension. For a block that every process respects, the docs point to the sandbox, where sandbox.filesystem.denyRead holds "inside a wider allow". The sandbox also documents a trap: sandboxed commands inherit Claude Code's environment variables, "including any secrets in its environment", unless you set CLAUDE_CODE_SUBPROCESS_ENV_SCRUB.

This is also where a guard belongs. VibeDefend, the layer CybeDefend installs in Claude Code, Cursor and Codex, ships its guards with rules for exactly these reads, on by default. Its rule for .env blocks the Read, Glob and Grep tools on **/.env and **/.env.* (templates such as .env.example excepted). A second rule blocks secrets files by name (secrets.*, credentials.json). A third blocks the shell route, cat, grep, jq, cp and the like, and runtimes such as node -e or python -c pointed at a secret file. Echoing a variable named like a secret is blocked too, and dumping the whole environment draws a warning. The decision is taken on your laptop, before the tool runs, so a blocked read sends nothing to the model.

A guard that matches command text is a seatbelt, not a wall. The Cloud Security Alliance's GuardFall note of July 2026 bypassed the command guards of 10 of 11 open-source agents with shell injection (Claude Code was not in its test set), and its conclusion applies to every tool of this kind, ours included: such guards "cannot be trusted as a primary control". The primary control is a secret that is not in the tree.

How do I keep secrets and regulated code out of Claude Code's reach?

Decide the account first, then shrink what the agent can open, then shrink what stays behind. In order of impact:

1. Pick the identity by the data. Company code goes through a Team or Enterprise seat, an organization API key, or Bedrock or Google Cloud, never a personal login. Requests that must stay in the EU go through Bedrock's eu prefix or Google Cloud's eu location.
2. On a personal plan, check the switch. "Help Improve our AI models", under Privacy. Then tell the team that /feedback and the survey's "Yes" still send the transcript.
3. Keep live secrets out of the tree. A secrets manager injected at runtime beats any rule. What is not on disk cannot be read.
4. Deny the reads, centrally. Read(.env), Read(.env.*) and your own secret paths in managed settings, so the rule applies to every developer. Delete .claudeignore; it does nothing.
5. Turn on the sandbox for the paths that matter. sandbox.filesystem.denyRead blocks every process, scripts included, and CLAUDE_CODE_SUBPROCESS_ENV_SCRUB strips credentials from the environment the agent's commands inherit.
6. Shorten what stays on disk. Lower cleanupPeriodDays, set desktopSessionCleanupPeriodDays, and include ~/.claude/history.jsonl in your laptop policy.
7. Cut the optional traffic. CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 turns off auto-updates, telemetry, error reporting and /feedback. It does not stop the WebFetch hostname check; skipWebFetchPreflight does. Metrics, for what it is worth, "never include your code, prompts, or file paths".
8. Watch your own observability. OpenTelemetry is off by default and redacts prompts. Turning on OTEL_LOG_USER_PROMPTS or OTEL_LOG_RAW_API_BODIES copies code and conversations into your collector, which then needs the same protection as the code.
9. Scan for secrets before they are read and before they are committed. A key that a scanner flags today is a key the next session will not load into context.

Commercial accountSecrets out of the treeRead deny rulesSandbox denyReadShort local transcripts

What no privacy setting covers

Every control above governs what Claude Code reads and sends. None of them governs what it writes, and the code it writes is a privacy surface of its own. An agent that hard-codes a token it saw in a fixture, logs a full request body with a customer's email in it, or returns records a caller was never authorized to see has created a data protection problem that no retention period will fix, because the leak now lives in your repository and your production logs.

That is the layer VibeDefend adds while the agent writes. It serves your business and security rules at the line being edited, stops the dangerous action before it runs, and scans the diff for SAST, IaC and secrets findings before the commit. Since this article is about where code goes, here is where ours goes: the guards decide on your laptop. To serve the rules that fit the line being written, VibeDefend sends a short excerpt of that code to the CybeDefend backend, in the EU or US region you pick at install; the scan before the commit sends the changed files; and your code is never used to train a model. The security page says what is kept and where.

Rules served at the line also do something a file cannot. In CybeDefend's controlled study, one agent working thirty tickets broke 2.28 rules per ticket with no tool, 2.27 with a hand-kept rules file in the repository, and 0.28 with VibeDefend. Our article on whether Claude Code follows CLAUDE.md explains why the file changes so little.

For the rest of the picture, read the guide to Claude Code security risks and the one on --dangerously-skip-permissions. If your team uses Codex as well, the same question for OpenAI has its own answers. And if you are rolling out Claude Code on code that cannot leave the building, talk to us.

Frequently asked questions

Does Claude Code send my code to Anthropic?

Yes. Each request carries your prompt and everything in the agent's context window, including the contents of files it read and the output of commands it ran, encrypted in transit. A file the agent never opens is never sent. On Bedrock or Google Cloud, requests go to that cloud instead, though the WebFetch hostname check still reaches Anthropic.

Does Claude Code train on my code?

On a Free, Pro or Max account, Anthropic trains on your Claude Code sessions only if the "Help Improve our AI models" setting is on. On Team, Enterprise, the API, Bedrock or Google Cloud, Anthropic does not train on them; the one exception is an organization that opts in to the Development Partner Program, which exists only on Anthropic's own API.

How do I stop Claude Code from training on my code?

On a personal plan, turn off "Help Improve our AI models" in the Privacy settings of claude.ai. It applies to future sessions; runs already started keep the data. Or use a Team or Enterprise seat, an organization API key, Bedrock or Google Cloud, where training is off by default. Avoid /feedback and the survey's "Yes" on sensitive code: both send the transcript.

How long does Anthropic keep Claude Code data?

On a consumer account, 30 days with the training setting off and up to 5 years with it on. On Team, Enterprise and the API, 30 days standard. Flagged sessions keep inputs and outputs up to 2 years, and /feedback transcripts are kept 5 years. Zero Data Retention exists for qualified Claude for Enterprise organizations and for API organizations with a zero data retention agreement, granted by Anthropic.

Is Claude Code GDPR compliant?

Claude Code can be used in a GDPR-compliant way, but that is your organization's case to make. Anthropic offers a Data Processing Addendum with Standard Contractual Clauses under Irish law for commercial use, and Anthropic Ireland is the controller for consumer accounts in Europe. Data is stored in the US; EU routing goes through Bedrock or Google Cloud.

Is Claude Code SOC 2 compliant?

Anthropic lists SOC 2 Type I and Type II, ISO 27001:2022 and ISO/IEC 42001:2023 among its certifications, plus a HIPAA-ready configuration for Claude for Enterprise. These cover Anthropic's own controls. Your SOC 2 auditor will still ask how your team configures Claude Code: which accounts, which deny rules, which retention.

Can Claude Code read my .env file?

Yes, unless you deny it. Add Read(.env) and Read(.env.*) to the deny list in settings.json; a .claudeignore file has no effect. A deny rule covers Claude's file tools and recognized shell commands such as cat, not scripts that open the file themselves, so turn on the sandbox for an OS-level block and keep live secrets out of the project.

Does Claude Code store my code locally?

Yes. Session transcripts, including what the agent read, are stored in plain text under ~/.claude/projects/ for 30 days by default, adjustable with cleanupPeriodDays (minimum 1). Every prompt you type goes into ~/.claude/history.jsonl, and Claude Desktop and Cowork transcripts are kept at any age unless you set desktopSessionCleanupPeriodDays.

Can I use Claude Code with EU data residency?

Not on Anthropic's API today: inference runs in a global or US geography and storage is in the US. To keep requests in Europe, run Claude Code through Amazon Bedrock with the eu inference prefix or through Google Cloud with the eu multi-region location, under that cloud's terms, and check that your model is available there.

Is Claude Code safe to use at work?

It can be, with the right setup: a commercial account rather than a personal login, secrets kept out of the project and denied by rule, the sandbox on for sensitive paths, short local retention, and no /feedback on client code. What remains is the code the agent writes, which needs its own checks before it reaches a commit.