Using coding agents in line with data protection law: the gap in the subscription

A developer working on company code with a personal Pro or Max subscription falls under Anthropic’s consumer terms, not the commercial ones. There, training use is an account setting, explicitly “including when you use Claude Code from these accounts”, and with the setting enabled the data is held for five years rather than thirty days.

This is not a scandal and not hidden small print. Anthropic documents the differences on a public data usage page, in more detail than most providers. The gap opens inside companies that never settled the difference between a consumer and a business plan. Using coding agents in line with data protection law therefore starts with the account, not with the tool.

How a personal subscription ends up on company code at all

Coding agents enter a company through the developer, not through procurement. Somebody tries Claude Code on their own project in the evening, likes it, types claude in the client repository the next morning, and is still signed in with the personal account. There is no installation dialogue that notices.

The second route is the expense claim. A team without a licence reimburses twenty dollars a month as an expense. The subscription is paid for, but contractually it remains a consumer agreement between Anthropic and a private individual. The employer is not a party to it.

Both routes are technically inconspicuous. /status in Claude Code shows the login method and the organisation, but nobody looks there as long as nothing is broken.

Is company code a data protection matter at all?

Company code becomes a data protection matter as soon as personal data appear in it, and that happens more often than assumed. Test fixtures with real names, a database dump for a migration, a log extract somebody pastes into the prompt: in those moments a coding agent is processing personal data.

On 24 September 2025 the Swiss Federal Data Protection Commissioner recorded in AI and data protection that “the Swiss Data Protection Act (DPA) is directly applicable to AI-supported data processing”. No special AI legislation is needed for obligations to apply. Which provisions engage individually, and who is liable for a breach, is in our article on a revDSG-compliant AI architecture.

Where no personal data are involved, two other bindings remain: the client’s trade secrets, and the confidentiality clause in the framework agreement. Whether a particular clause covers disclosure to an inference provider is a question of the individual case and belongs checked before the first prompt, not after.

What Anthropic commits to per plan

The commitments differ between consumer and business plans in three respects: training, retention and negotiability. All figures come from the data usage page and the pricing page, retrieved 20 August 2026.

Three details that regularly get misreported in procurement conversations:

• Zero data retention is not included in the standard Enterprise plan. Anthropic writes that ZDR is available for qualified accounts and is enabled per organisation by the account team after an eligibility check. If you need ZDR, you negotiate it.
• Transcripts shared through /feedback, /bug and /share are retained for five years, whatever the plan. Session transcripts uploaded voluntarily through the quality survey for up to six months.
• Error reports are active only with Pro and Max login, from version 2.1.198 and only on a direct connection to the Claude API. That too is a consumer property that does not arise on a business plan.

What closing the gap costs

Moving from personal subscriptions to team seats costs a twelve-person team three dollars per head per month. A model calculation from the list prices: twelve annual Pro subscriptions cost 12 × 17 = 204 USD a month, twelve team standard seats 12 × 20 = 240 USD. Delta: 36 USD a month, 432 USD a year.

For heavy users the arithmetic is different and cheaper still. Someone on a Max subscription at 100 USD a month costs the same 100 USD as an annual team premium seat. At that usage profile the move is price-neutral.

The honest caveat: a standard seat is not a substitute for a Max subscription, the usage quotas differ. Anyone currently expensing Max needs a premium seat, not the cheapest one. Even so the order of magnitude holds, and it is why this gap is irritating: it costs almost nothing except the decision.

If you do not know which accounts your team works under today, that is an hour’s work, not a week’s. Thirty minutes with one of our engineers is enough to turn it into an inventory and an order of operations.

Three data flows that remain even on a business plan

A commercial plan governs training, not every data flow. Three of them remain and belong in the record of processing activities, because otherwise they appear in no contract review.

Local transcripts in the clear. Claude Code stores session transcripts under ~/.claude/projects/, by default for 30 days. The documentation is unambiguous: “Transcripts and history are not encrypted at rest. OS file permissions are the only protection.” If a tool reads a .env file, its contents end up in the .jsonl file. Controllable through cleanupPeriodDays, CLAUDE_CODE_SKIP_PROMPT_HISTORY and claude project purge.

The WebFetch domain check. Before every fetch, WebFetch sends the requested hostname to api.anthropic.com to check it against a blocklist. Only the hostname, not the full URL. This runs independently of the model provider, so also through Bedrock, and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC does not cover it. It can only be turned off through skipWebFetchPreflight.

Telemetry and error reports. Controllable through DISABLE_TELEMETRY, DISABLE_ERROR_REPORTING, DISABLE_FEEDBACK_COMMAND and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC. On Amazon Bedrock, Google Cloud, Microsoft Foundry and Claude Platform on AWS, metrics, error reports and /feedback are already off by default. Session surveys and the WebFetch check still run there.

Which purchasing route for which kind of code?

The purchasing route follows the contents of the repository, not the size of the company. So the question is not “which plan do we buy” but “what is in this repository and what from it ends up in the prompt”.

Amazon Bedrock encrypts with AES-256 and allows customer-managed keys through AWS KMS; Google Cloud supports CMEK. With Microsoft Foundry and “Hosted on Azure”, prompts and completions stay in Azure, and only usage metadata and content flagged by security systems go to Anthropic. Which regions are concretely available is not stated on the data usage page and has to be checked with the respective cloud provider.

How to enforce compliant use technically

Login to a particular organisation can be enforced, and it is the only point on this whole list that works without discipline. forceLoginOrgUUID and forceLoginMethod belong in managed settings and are rolled out through your device management: on macOS to /Library/Application Support/ClaudeCode/managed-settings.json, on Linux to /etc/claude-code/managed-settings.json.

{
  "forceLoginMethod": "claudeai",
  "forceLoginOrgUUID": "550e8400-e29b-41d4-a716-446655440000",
  "cleanupPeriodDays": 7,
  "env": {
    "DISABLE_TELEMETRY": "1",
    "DISABLE_ERROR_REPORTING": "1",
    "DISABLE_FEEDBACK_COMMAND": "1"
  },
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)"
    ]
  }
}

Four limitations that Anthropic names itself in the authentication documentation and that you have to know before ticking the box: claude setup-token and /install-github-app enforce only forceLoginMethod, so they can create a token in a different organisation. Sessions through cloud providers are not blocked; you restrict those through IAM. ANTHROPIC_API_KEY and apiKeyHelper are blocked at startup, because organisational membership cannot be verified there. And if you additionally distribute server-managed settings, both keys have to appear in both places, because the sources do not merge.

The second half belongs in the repository rather than on the device, so that it is visible in code review. A .claude/settings.json with deny rules applies to everyone who checks the project out:

{
  "permissions": {
    "deny": [
      "Read(./deploy/*.key)",
      "Read(./fixtures/prod-*.sql)"
    ]
  }
}

And a check script that runs as an MDM check or during onboarding:

#!/usr/bin/env bash
# Checks whether the Claude Code policy is in force on this device.
# Exit 1 as soon as a requirement is missing.
set -euo pipefail

case "$(uname -s)" in
  Darwin) managed="/Library/Application Support/ClaudeCode/managed-settings.json" ;;
  *)      managed="/etc/claude-code/managed-settings.json" ;;
esac

fail=0
note() { printf '%-26s %s\n' "$1" "$2"; }

if [ -f "$managed" ]; then
  org=$(jq -r '.forceLoginOrgUUID // empty' "$managed")
  [ -n "$org" ] || { note "forceLoginOrgUUID" "missing"; fail=1; }
  days=$(jq -r '.cleanupPeriodDays // empty' "$managed")
else
  note "managed-settings.json" "not present"
  fail=1
fi

# Cleartext transcripts older than our own retention period
old=$(find "$HOME/.claude/projects" -name '*.jsonl' -mtime +"${days:-30}" 2>/dev/null | wc -l | tr -d ' ')
[ "$old" = "0" ] || { note "old transcripts" "$old files past retention"; fail=1; }

exit "$fail"

OpenAI Codex: same check, different names

At OpenAI the check runs along the same three questions; the labels differ. The business plan costs, according to the Codex pricing page, 20 USD per user per month on an annual plan and carries the commitment “No training on your business data by default”. Enterprise adds controls for retention and data residency, SCIM, external key management, role-based access control, and audit logs through the compliance API.

For companies wanting to avoid the data flow to OpenAI entirely: since release 0.148.0 the Codex CLI supports Amazon Bedrock Runtime as a built-in provider, including AWS profile and region. That gives Codex the same route as Claude Code — inference in your own AWS account rather than at the model provider.

The practical consequence is inconvenient: anyone running both tools in-house needs two reviews and two policy lines. A single paragraph saying “AI tools are permitted” does not cover it.

What belongs in the policy on Monday

Six lines are enough, and they take an hour to write. In order, because the order determines the effort:

1. Inventory. Who works with which tool under which account? /status answers that per device in seconds.
2. Expenses rule. Personal AI subscriptions are no longer reimbursed. That line closes the second route in.
3. Enforce login. forceLoginOrgUUID and forceLoginMethod through device management, with the four limitations above in mind.
4. Repository classification. One column in the repository inventory: does it contain personal data, yes or no? The purchasing route from the table follows from that.
5. Document the egress. api.anthropic.com belongs on the allowlist and in the record of processing activities — because of the WebFetch check, even when you run through Bedrock.
6. Settle the feedback path. Either set DISABLE_FEEDBACK_COMMAND, or record in the team that /feedback and /share hand code to a recipient who keeps it for five years.

The guardrails belong in the repository and in device management, not in a wiki, for the same reason we put them there in who writes the architecture: what is not in the tooling stops applying after three weeks.

What we advise against

A ban. Banning coding agents does not stop people using them, it stops people saying so. The result is exactly the case this article describes: personal account, unknown plan, no oversight. A paid team seat is the cheaper control.

Zero data retention as a reflex. ZDR is not included in the standard Enterprise plan, is enabled per organisation, and requires a negotiation with the account team. For repositories with no personal data, thirty days of retention plus a documented processor agreement solves the same problem without a procurement project.

skipWebFetchPreflight as a default. Turning the check off means fetching URLs without comparison against the blocklist, and for an agent pulling web content into its context that is not a good trade. The better route is the allowlist plus an entry in the record.

The trade-off we will name openly: Bedrock and Foundry buy data residency with operational effort. You manage regions, IAM roles and your own keys, you lose billing through a single seat price, and new model versions tend to reach you later. For a repository with health data that is right. For the internal admin tool it is effort without a return.

Frequently asked

May a developer with a personal Claude Pro subscription work on client code?

Contractually possible, operationally hard to defend. Consumer plans are subject to consumer terms, training use hangs off a personal account setting the employer neither sees nor controls, and with the setting enabled retention is five years. Whether data protection or confidentiality obligations are additionally breached in a given case depends on the repository and on the client contract.

Is a team plan enough, or do we need Enterprise?

For the training question, team is enough: under commercial terms Anthropic does not train on code or prompts, and retention is thirty days. You need Enterprise for SSO, role-based permissions, the compliance API, and managed policy settings for organisation-wide configuration. Zero data retention is only available that way, and even there only after an eligibility check.

How do we get zero data retention?

Through the account team, not through a switch in the admin area. Anthropic describes ZDR as available for qualified accounts and enabled per organisation after confirmed eligibility, explicitly not as part of the standard Enterprise plan. Allow for lead time, and settle beforehand which repositories actually need it.

Does Amazon Bedrock solve our data protection questions?

Bedrock solves the residency and key questions, not the processing question. Encryption with AES-256 and customer-managed keys through AWS KMS are documented, and telemetry and error reports are off there by default. What remains are the local cleartext transcripts, the WebFetch domain check against api.anthropic.com, and your own obligations around purpose limitation, information and logging.

---

Take your list of developers and add a column for which account each person is signed in under. If a personal subscription shows up there, you already hold the conclusion of this article.

Thirty minutes with an engineer on plan choice, purchasing route and managed settings, no sales pitch: book a slot. Prefer writing? Through contact. How we build and secure AI systems is under Artificial Intelligence & Machine Learning.

All product and contract details verified against Anthropic’s and OpenAI’s primary sources on 20 August 2026. This article describes product and contract terms and derives technical consequences from them; it is not legal advice.