Start with the tier, not the model
The first privacy question usually lands about forty minutes into a procurement call, and it is rarely the one on the slide deck. Someone from legal asks whether client notes end up in a training run. The room goes quiet, the account manager says “good question,” and everyone discovers the evaluation was never really about output quality.
That is the moment a Claude Team purchase stops being a $600-a-month software line and becomes a data-processing decision. Team pricing runs $25 per user per month on annual billing or $30 month-to-month, with a five-seat minimum. What those seats buy beyond usage limits is a commercial contract, an admin console and single sign-on instead of consumer terms of service.
What they do not buy is a privacy sign-off. That still has to be earned internally, and it is worth doing properly, because Anthropic’s three tiers are governed by genuinely different terms.
Consumer tier, commercial tier, custom tier
Free and Pro accounts sit under consumer terms, including the data-use settings that individuals control themselves. A $20-a-month Claude Pro security review shows how far that protection stretches, and the honest answer is: to the individual, not to an organisation. Team and Enterprise move you onto commercial terms with a Data Processing Addendum available. Enterprise adds negotiated retention, a BAA for HIPAA workloads and custom data-residency arrangements.
Most privacy reviews fail at this first step. Someone forwards a screenshot of the free-tier privacy settings to the security team, and the team approves a product they will never actually deploy.
The training question, answered once
Anthropic states that it does not train models on customer inputs or outputs from Team and Enterprise accounts by default. For a lot of organisations, that single sentence is the whole approval. It should not be, because the default is not the same as the absence of human review.
Two nuances matter more than the headline.
- Feedback is a separate channel. Thumbs-up and thumbs-down ratings, plus any written feedback a user submits, are handled differently from ordinary conversation data. Train staff to rate outputs without pasting client context into the comment box.
- Abuse review still reads conversations. Flagged content can be reviewed by humans under trust-and-safety processes. Nobody at Anthropic is browsing your marketing copy, but a conversation that trips a classifier may be pulled.
Ask your account team for the current wording in writing, and note the date you received it. Policies get revised, and a screenshot from a blog post is not an audit artefact.
What “deleted” actually means
When a user deletes a conversation, Anthropic’s documentation puts removal from live systems on roughly a 30-day cycle. Backups and safety-related records can persist longer, which is standard across cloud providers and almost never gets explained in the sales deck. If your retention policy promises a client that their data is gone within 48 hours, this product will not meet it without Enterprise-level negotiation.
The practical fix is to stop treating deletion as the control and start treating classification as the control. Decide before rollout which data categories are permitted in a prompt at all. Anything genuinely sensitive should never enter the box, because once it does, your deletion timeline belongs to someone else’s infrastructure.
Teams running their first structured evaluation tend to make the same set of mistakes, and there is a useful walkthrough of the privacy review nobody runs before signing up that covers the basics in under an hour.
The admin controls that do the real work
Claude Team ships a console where an owner manages members, billing and access. Some of those toggles carry more privacy weight than others.
Domain capture and SSO
Single sign-on ties access to your identity provider, so leavers lose Claude access the moment their main account is deprovisioned. Domain capture prevents colleagues from quietly creating personal accounts on your company domain and uploading the same documents there. Turn both on in week one. A mid-sized agency that skips this ends up with 40 personal Pro subscriptions sitting outside any contract, which is the worst of both worlds.
Seat-level visibility
Ask directly what an admin can and cannot see. On Team, administrators generally manage membership and billing rather than reading through individual conversations. That is good for staff trust and bad for incident investigation. Exportable audit logs, retention overrides and SCIM provisioning sit at the Enterprise end of the product, not the five-seat end.
If you are weighing this against Redmond’s equivalent, a 14-month review of a five-seat ChatGPT Team subscription is a useful benchmark for how the two admin experiences differ in daily use.
Where Claude Team gets thin
Compared with Enterprise, the gaps are specific and predictable:
- No BAA on Team. Any PHI in a prompt is out of scope unless you are on a negotiated Enterprise agreement.
- No data-residency choice. You take the regions Anthropic and its sub-processors operate in, which currently include major cloud providers such as AWS and Google Cloud.
- No zero-retention option. The 30-day deletion cycle is the floor, not a configurable ceiling.
- Limited audit tooling. Compliance teams that need SIEM ingestion will not find it here.
Certifications are the reassuring part. Anthropic publishes SOC 2 Type II and ISO 27001 attestations, plus ISO/IEC 42001 for AI management systems, with reports available through its trust portal under NDA. Pull the current versions yourself rather than accepting a PDF attached to a sales email; if you need a sense of what the enterprise tier of a rival actually includes for the money, this breakdown of ChatGPT Enterprise’s custom pricing makes a fair comparison point.
A 90-minute review you can run this week
Block the time, bring one person from legal and one from IT, and work through this in order:
- Confirm the sub-processor list and check it against your own vendor register.
- Request the DPA and read the liability and breach-notification clauses, not just the summary.
- Write down the current retention window and compare it to your data-retention policy.
- Test domain capture in a sandbox before inviting anyone.
- Draft a one-page acceptable-use note listing three things that must never be pasted in.
- Decide who owns offboarding and how it is triggered.
- Log the date and version of every document you relied on.
- Book a 60-day recheck, because terms and defaults do change.
The risk you cannot configure away
Every control above governs the vendor. None of them govern the person at 4:50pm on a Friday pasting a client’s draft contract into a chat window to get a summary before the weekend. That behaviour is where most real incidents originate, and it is a workflow problem dressed as a technology problem.
It also explains why formal governance lags so far behind adoption. Research on AI use among marketing teams keeps finding the same pattern: heavy daily use, thin written policy, no clear owner for the risk.
A workable decision rule is to treat Claude Team as a third party with a specific data tier rather than as a tool with a settings page. Tier one data, meaning anything that would embarrass you in a breach notification, stays out of every prompt regardless of plan. Tier two data, meaning internal drafts and non-client working material, is permitted on Team with SSO and domain capture enforced. Tier three, meaning genuinely public material, is unrestricted.
Write that rule down, get it signed, and the privacy review stops being an annual argument. The contract protects the organisation. The classification rule protects the client whose name you never agreed to put in a prompt.