If your data cannot leave a controlled environment, you have three practical places to run an AI agent: the model vendor's API directly, the same model through your own cloud provider, or no model on the sensitive record at all. The choice mostly decides one thing — who the data processor is — and that answer changes your contracts, your audit evidence, and which agent features you are allowed to use.
The rest of this guide is the detail behind that sentence, checked against Anthropic's published documentation on 21 August 2026. Verify anything here against your own contract before you rely on it; vendor terms change, and yours may differ from the public defaults.
What actually changes when you switch routes
Teams usually frame this as "can the model see our data." That question has a boring answer and hides the one that matters. The useful question is who processes the data on your behalf, because that determines whose retention policy, whose regional controls, and whose audit logs you are relying on when a regulator asks.
Anthropic states the split plainly in its API retention documentation: for the Claude API, Claude Platform on AWS, and Claude in Microsoft Foundry, Anthropic is the data processor. On Amazon Bedrock and Google Cloud's Agent Platform, the cloud provider is the data processor, and you are directed to that platform's own retention and compliance documentation for the equivalent controls.
Route 1: the vendor API, with a contract on top
Calling the API directly is the simplest architecture and the one most teams assume is the riskiest. The published defaults are stricter than the assumption. Anthropic's documentation states that conversation content — your prompts and the model's outputs — is not retained by default, with an exception for models it designates as Covered Models, which require 30-day retention. It also commits that retained data is never used for model training without your express permission.
Two contractual arrangements sit on top of that. A zero data retention (ZDR) arrangement means prompts and responses are not stored at rest once the API response is returned. It is granted per organization through the sales team, and enabling it for one organization does not extend it to others under the same account — a detail worth checking if your group runs separate legal entities.
The exclusions matter more than the headline. ZDR does not cover consumer plans (Free, Pro, Max), the Claude Teams and Claude Enterprise product interfaces, or Claude for Excel. It is also unavailable for Covered Models, which carry a 30-day retention requirement of their own. Stateful features are excluded because they have to store something to work: the Files API, code execution, and programmatic tool calling are all listed as ineligible. If you have ZDR, cross-origin browser calls are unsupported, so browser applications must route through a backend proxy.
The ZDR detail that catches teams out
Here is the part that belongs in your design review rather than your legal review. Under a ZDR arrangement, the API does not block the features that fall outside it. Anthropic's documentation is explicit: using one is a choice to step outside your arrangement for that specific data, and the feature's own retention policy applies instead. HIPAA readiness behaves differently — there, the API rejects an ineligible request with a 400 error.
So a developer can add a file upload to an agent on a Tuesday and silently move a class of data out of the arrangement your compliance team signed, with no error and nothing in the response to indicate it. Your retention posture is a contract, not an enforcement mechanism. Treat it as something to instrument and test, not something to assume.
One more limit applies regardless of arrangement: content flagged by automated trust and safety systems may be retained for up to two years. Separately, the Activity Feed retains data for six years, and local session transcripts on users' own machines are stored for six years by default unless your organization sets a shorter retention period. If the objection you are answering is "nothing may persist anywhere," those are the numbers to bring to the conversation.
Route 2: the same model through your cloud provider
Running Claude through Amazon Bedrock or Google Cloud's Agent Platform moves the processor relationship to a vendor you have already cleared. For a bank or insurer with a signed cloud agreement and an established control framework, that is usually the shortest path through procurement, and it is the honest reason most regulated buyers pick it.
Two tradeoffs come with it, and neither is obvious from the marketing.
First, routing. On Bedrock, recent Claude models default to global endpoints, which route dynamically for availability and are described as suited to applications where data residency is flexible. Regional endpoints are the ones documented as required for data residency and compliance requirements, they cover the US, EU, Japan, and Asia-Pacific, and they carry a stated 10% pricing premium. The default is the cheaper one. If a residency commitment is in your client contracts, the model identifier your engineer typed is a compliance artifact, and someone should be checking it.
Second, capability. The partner-operated route does not carry the full feature set. Anthropic's Bedrock documentation lists server-side tools (code execution, web search, web fetch), the Files API, Agent Skills, the MCP connector, programmatic tool calling, Message Batches, and Managed Agents as unsupported there. If your agent design depends on those, you are choosing between the architecture you wanted and the procurement path you can get approved. Better to find that out in week one than after the build.
A useful counterweight to the fear in this area: Bedrock offers invocation logging so you can log prompts and completions for your own review, and the documentation states that turning it on does not give AWS or Anthropic access to your content. Anthropic recommends logging activity on at least a 30-day rolling basis. Logging is how you get audit evidence; it is not a second leak.
Route 3: keep the model off the regulated record entirely
The route nobody sells you is the one where no inference touches the sensitive field. A large share of the work that people describe as "AI automation" in regulated operations is retrieval, matching, formatting, and chasing — moving a policy record between a carrier portal and a spreadsheet, assembling a bundle, checking a deadline. Those are deterministic problems. They can run inside your boundary with no model involved, and the model can be reserved for the steps that genuinely need judgment, on redacted or synthetic inputs.
This is the same layering argument ATI makes for AI automation in financial services: existing systems do not need replacing, they need a layer on top of them, including the many cases where no API exists at all. The insurance broker workflows that generate the most manual hours — portal-driven quotes, renewals, claims documentation — are largely of this shape, and so is much of the document and deadline work on the law firm side.
The ceiling is real. Rules-based automation cannot summarize a claim narrative or read an unstructured clause. But starting here often lets a first workflow go live while the model-hosting question is still moving through legal, and it makes that later conversation concrete rather than hypothetical.
The part that leaks is not the model host
This is the opinion, and it is the one I would argue for in a review. Teams spend weeks on the hosting decision and almost no time on the layer they actually built, which is where regulated data accumulates: the job queue holding a full record for retry, the error log that captured a payload verbatim, the cache, the CSV someone exported to debug a mismatch, the transcript on a laptop. No model-vendor retention arrangement covers any of it. Your ZDR agreement is silent about your own Postgres instance.
There is a related failure mode worth naming, because we hit it in our own automation. An internal ATI pipeline had a cleanup step that ran on a schedule. Its pre-flight check passed every time, and its execute call was refused by a permission layer that returned quietly. The job logged success on six consecutive runs while deleting nothing. Nobody noticed, because every signal we were watching said the step had worked.
The lesson transfers directly to data handling. Verify the resulting state, not the call. If your design says a record is redacted before it leaves the boundary, deleted after processing, or never written to the retry queue, then something should periodically check the store and fail loudly when the claim is false. A control you have never seen fail is a control you have not tested. That principle is also why the NAIC's model bulletin cited on our insurance page insists that automation touching underwriting, quotes, or renewals be explainable and monitored — monitored being the word that costs money and gets dropped first.
Running the decision without stalling the project
Answer four questions, in this order, before anyone opens an SDK.
Which specific field is the problem? Not "our client data" — the actual attribute that triggers the obligation. Teams routinely discover that one field is the constraint and the other forty are not, which turns an architecture debate into a redaction task.
Who needs to be the processor? If procurement has already cleared a cloud provider, route 2 is usually faster to approve even though it costs you features. If you need the full agent toolset, route 1 with the right arrangement is the path, and you should start the sales conversation early because enablement is reviewed per organization.
Which arrangement fits? If you handle protected health information, Anthropic's guidance is that HIPAA readiness is the arrangement to use and you do not also need ZDR — it applies broader safeguards through encryption, access controls, and audit logging rather than immediate deletion. Note that a BAA is documented as not applying to web search functionality. For non-PHI confidentiality, ZDR is the narrower, deletion-shaped answer.
What does the first workflow actually require? If the honest answer is retrieval and formatting, run route 3 now and keep the hosting decision open.
This sequencing is the same one behind our Claude for business adoption approach and the Claude enterprise rollout guide: define access boundaries and controls on one pilot workflow before scaling, so governance is settled on something small and real.
If you want the routes mapped against your own constraints, our AI consulting team does this as a scoping exercise, or you can book a call and bring the workflow.
Frequently asked questions
Does Anthropic train on data sent through the API?
Anthropic's API retention documentation states that retained data is never used for model training without your express permission, and that conversation content is not retained by default outside the models it designates as Covered Models, which require 30-day retention. Confirm the position that applies to your organization against your own commercial terms.
Is running Claude through Amazon Bedrock more private than the Claude API?
It is different rather than strictly more private. On Bedrock the cloud provider is the data processor instead of Anthropic, so you inherit that platform's retention and compliance controls and rely on an agreement you likely already have. You give up feature coverage in exchange, and you must select a regional endpoint for data residency, which carries a stated 10% premium over the global default.
What does a zero data retention agreement not cover?
Per Anthropic's documentation: consumer plans, the Claude Teams and Claude Enterprise product interfaces, Claude for Excel, and Covered Models. Stateful API features — the Files API, code execution, and programmatic tool calling — are ineligible. The API does not block those features under ZDR; using one steps outside the arrangement for that data. Content flagged by trust and safety systems may still be retained for up to two years.
We handle patient data. Which arrangement applies?
Anthropic documents HIPAA readiness as the arrangement for organizations processing protected health information, available with a signed business associate agreement and a HIPAA-enabled organization, and states that you do not also need ZDR if you have it. Unlike ZDR, ineligible requests are rejected with a 400 error rather than silently permitted. The BAA is documented as not applying to web search functionality.
Can we automate a regulated workflow without sending anything to a model?
Often, yes, for the retrieval and coordination parts. Portal data entry, quote comparison, document assembly, and deadline chasing are deterministic and can run inside your boundary. Judgment-heavy steps — reading an unstructured clause, summarizing a claim narrative — are where a model earns its place, and those can frequently run on redacted inputs.
How long does the compliance review usually take?
We have no representative sample to quote, so we will not invent a number. What shortens it in practice is bringing legal a specific field, a named processor, and a written arrangement rather than a general question about AI, and running a first workflow that does not depend on the answer.
Sources: Anthropic API and data retention documentation, Claude on Amazon Bedrock documentation, and the Anthropic Privacy Center article on zero data retention scope, all verified 21 August 2026. Vendor terms change; check the current documentation and your own contract before relying on any detail here. This article was researched and drafted with AI assistance and edited by ATI before publication.