Vendors · Questionnaire · Anthropic
Read Anthropic’s own answers to nine buyer questions
Anthropic API and Claude commercial products. Each answer quotes Anthropic’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not by default
By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.
Is my data used for model training?, kept 24 Oct 2026 · sha256 54617b76403f
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for Anthropic.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Anthropic API: deleted within 30 days, with listed exceptions
For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation
Under “Standard Retention Timeframe”. The sentence continues with exceptions: longer-retention services such as the Files API, a zero data retention or other agreement, Usage Policy enforcement, and law. For other commercial products the page says: “we retain your chats and coding sessions in the product to provide you with a consistent product experience.” How long do you store my organization's data?, kept 24 Oct 2026 · sha256 31c58317fd20
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Zero data retention, by agreement
When you and we have agreed otherwise (e.g. zero data retention agreement)
Under “Standard Retention Timeframe”, one of the listed exceptions to the rule that Anthropic API inputs and outputs are deleted within 30 days. How long do you store my organization's data?, kept 24 Oct 2026 · sha256 31c58317fd20
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
API inference: global by default (any geography) or US-only via inference_geo on Claude 4.6 and later, on the first-party API (except the OpenAI SDK compatibility endpoint) and some partner platforms; workspace data at rest: US only
Data residency controls let you manage where your data is processed and stored.
The page says “Inference may run in any available geography for optimal performance and availability” for the default, “global”. Also: “The inference_geo parameter is supported on Claude 4.6 and later models.” Workspace geo: “Currently, "us" is the only available workspace geo.” Data residency, kept 26 Oct 2026 · sha256 0171e6e8e8a1
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Not published in the pages kept
Searched: Is my data used for model training?; How long do you store my organization's data?; Commercial Terms of Service; Data residency; Rate limits.
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: Is my data used for model training?; How long do you store my organization's data?; Commercial Terms of Service; Data residency; Rate limits.
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
Yes: a status history feed, with 29 incidents kept since 2026-09-01
Status history feed, kept 1 Nov 2026 · sha256 98e45177fc1e. The record.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Yes: Anthropic (“Model deprecations”), with 20 dated retirements kept
Anthropic, “Model deprecations”, kept 26 Oct 2026 · sha256 0bcf96b2eeed. The record.
- Anthropic, Is my data used for model training?, kept 24 Oct 2026.
- Anthropic, How long do you store my organization's data?, kept 24 Oct 2026.
- Anthropic, Data residency, kept 26 Oct 2026.
- Anthropic, Status history feed, kept 1 Nov 2026.
- Anthropic, Model deprecations, kept 26 Oct 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.