Anthropic promises zero data retention for enterprises, but privacy shifts more responsibility to customers

Anthropic is introducing Enterprise Frontier Safeguards (EFS), an enterprise system designed to combine zero data retention (ZDR) with misuse detection. For organisations handling confidential data, that is an important change, but it is not as simple as saying that Anthropic stores nothing.

Customer-controlled infrastructure

Anthropic says EFS will store the data needed for safeguards in cloud infrastructure controlled by the customer rather than Anthropic. Automated monitoring can still identify suspicious patterns, but signals requiring attention are intended to go directly to the customer for review.

That changes the responsibility model. The AI provider reduces retention on its side, while some monitoring and response duties move to the organisation using the model.

ZDR is not automatic for every customer

The Register notes that enterprise customers do not automatically receive a zero-data-retention agreement. They must apply and meet Anthropic's requirements. For ordinary commercial API customers, a 30-day retention period for inputs and outputs remains the default unless different terms are in place.

Anthropic says EFS will roll out in phases starting later this fall. Until it is ready, eligible customers will receive ZDR for Fable 5 and Fable 5.1.

Why Anthropic is changing the model

Anthropic says its previous safety approach sometimes required temporary retention of prompts and outputs so that misuse signals could be correlated across time and accounts. For some large and regulated organisations, that retention made advanced models difficult to adopt.

EFS is an attempt to preserve both privacy and misuse safeguards. Anthropic says the system will be offered by invitation across products including Claude Code, Claude Enterprise, Claude Platform and selected cloud integrations.

What businesses should check

The practical lesson is not to treat the phrase ?zero data retention? as a complete privacy answer. A company should verify whether ZDR is actually active for its specific account and product, where logs are stored, who receives security alerts and who is responsible for responding to detected misuse.

For small and mid-sized businesses, the rule is straightforward: before sending confidential data to an AI model, check the real retention policy attached to the exact service and contract, not just the provider's headline privacy claim.

Sources

Anthropic: Developing Enterprise Frontier Safeguards with our customers The Register: Anthropic promises zero data retention ? but customers must check it worked Anthropic: Claude Fable 5.1 and Mythos 5.1