Short answer
Under Anthropic's commercial terms, which cover Claude business plans and the API, Anthropic does not use customer prompts and outputs to train its models by default. Business plans add admin controls such as single sign-on and user management. Before rollout, read the current commercial terms, data retention settings, privacy documentation and any data processing agreement for your plan.
Key facts
- Claude business plans and the Anthropic API are covered by commercial terms rather than consumer terms.
- By default, Anthropic does not train models on commercial customers' inputs and outputs.
- Consumer Claude accounts have different terms, so staff should not use personal accounts for company data.
- Retention periods, audit features and admin controls vary by plan; confirm them in current documentation.
- Connectors to tools such as Microsoft 365 should be enabled deliberately and reviewed like any other app integration.
Commercial terms vs consumer terms
Anthropic offers Claude under two broad sets of terms. Consumer accounts, used by individuals, have their own privacy settings and terms. Business offerings, such as Claude Team and Enterprise plans and the Anthropic API, fall under Anthropic's commercial terms.
The most important difference for most businesses is model training. Under the commercial terms, Anthropic does not use customer content, meaning prompts and outputs, to train its models by default. That is the basis for using Claude with company data, but it only applies if staff use the business plan, not personal accounts.
What to check in the vendor's terms
Terms and features change, so treat this page as a checklist rather than a substitute for the documents. Have IT, security and counsel review the current versions for your plan.
- Model training: confirm the default and whether any opt-in or feedback feature changes it.
- Data retention: how long conversations and files are kept, and whether admins can set retention.
- Data processing agreement: whether one applies and how it is executed.
- Subprocessors and data location: where data is processed and stored.
- Security documentation: current third-party attestations and reports available under NDA.
- Regulated data: whether a business associate agreement or similar terms are offered for your plan and use case.
- Account ownership: what happens to data when a user leaves or the plan ends.
Admin controls to configure
Business plans give administrators control that personal accounts do not. Depending on plan, this includes single sign-on with an identity provider such as Microsoft Entra ID, user provisioning and removal, domain capture so company email addresses join the organization's workspace, and settings for features and connectors. Enterprise plans typically add more controls, such as audit logging and custom retention options; confirm what your plan includes.
Configure single sign-on first so access follows your Entra ID lifecycle and Conditional Access policies. Then decide which features and connectors to enable, and who can use them.
| Control | Why it matters |
|---|---|
| Single sign-on with Entra ID | Access ends when the account is disabled; Conditional Access applies |
| User provisioning | Licenses and access follow joiners and leavers |
| Domain capture | Keeps company users out of personal accounts |
| Connector settings | Controls which company systems Claude can reach |
| Retention and audit settings | Supports records and investigation needs where available |
Connectors and company systems
Claude can connect to other tools through connectors, including Microsoft 365 services, and through the Model Context Protocol. Connectors that act on behalf of a signed-in user generally work within that user's own permissions, which means oversharing in SharePoint or OneDrive affects what Claude can reach, just as it does for Microsoft 365 Copilot.
Treat each connector like a new app integration: review the permissions it requests in Entra ID, approve it through admin consent rather than letting users consent individually, and limit it to the groups that need it.
Policy and training still matter
Technical controls do not cover everything. Update your AI acceptable use policy to name approved tools and accounts, list data types that must not be entered without approval, and require users to check AI output before using it. Block or discourage personal AI accounts for work, and use Microsoft Purview DLP and endpoint controls where you need enforcement.
How Accred Consulting approaches it
Accred Consulting deploys Claude for business alongside Microsoft 365, and reviews data handling with the client before rollout; the client and its counsel make the final decisions on terms and compliance. Discovery covers use cases, data types, plan options and identity setup, and the proposal sets scope, fixed price and timeline. The US-based specialists assigned to your engagement configure single sign-on with Entra ID, user provisioning, connector approval, acceptable use guidance and DLP controls, then run a pilot. Handover includes documentation and knowledge transfer, with optional support retainers.
Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies
Related questions
Want this scoped for your environment?
Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.
Book a free consultation