Is Claude Safe

For most people Claude is safe to use, with two caveats worth knowing. On the security side, Anthropic encrypts data in transit and at rest, limits staff access to conversations, and lists a SOC 2 Type 2 report and an ISO 27001 certificate at its Trust Center (Security), plus ISO/IEC 42001 for AI management since Jan 13, 2025. The caveats: on Free, Pro, Max and Ultra your chats can be used to train future models unless you switch that off, and Claude's agent features (Claude in Chrome, connectors, Cowork, Claude Code) can be tricked by instructions hidden in web pages, emails or files, which Anthropic itself says its defenses do not fully stop. This page covers your data, those risks, and the habits that keep Claude safe to use.

Quick facts

What happens to your chats

0:58 Who can read them. Anthropic says employees cannot see your conversations by default. The exceptions are chats you send as feedback (a thumbs up or down) and chats reviewed by designated Trust and Safety staff to enforce the Usage Policy, under least-privilege access (How does Anthropic protect the personal data of Claude users?).

2:48 Training. Since a consumer terms change on Aug 28, 2025, every Free, Pro and Max user chooses whether chats help train Claude; the pricing page lists training as "Opt-out" on Free, Pro, Max and Ultra (Plans & pricing, as of Nov 6, 2026). With it on, new and resumed chats may be kept de-identified for up to five years; with it off, the standard 30 days apply. Raw content from connectors such as Google Drive is not used unless you paste it into the chat (Is my data used for model training?). Even with training off, conversations flagged for safety may still train Anthropic's internal safety classifiers. Turn it off in Settings > Privacy > "Help improve our AI models".

4:10 Business plans. Team, Enterprise and the API run under commercial terms: Anthropic does not train on inputs or outputs by default (Is my data used for model training? (commercial)). Enterprise adds audit logs, custom retention, customer-managed encryption keys and a HIPAA-ready configuration with a business associate agreement (What is the Enterprise plan?). If you use Claude for work, use the account your employer provides, not a personal one. See Claude Team and Enterprise.

Keeping a chat out of everything. An incognito chat is left out of your history and memory and is never used for training, though Anthropic still keeps it 30 days (Use incognito chats). Details on retention are in Claude Privacy and Data Use and How to Export or Delete Claude Data.

Prompt injection: the real risk with agents

When Claude only chats, the worst it can do is give a wrong answer. When it reads web pages, emails and documents and can also act (click, send, delete, run code), text inside that content can pose as instructions. This is prompt injection, and it is the main security risk of every AI agent, not only Claude's.

Anthropic has published its own numbers. Testing an early Claude in Chrome on 123 adversarial cases in 29 scenarios, it measured a 23.6% attack success rate without mitigations and 11.2% with them, and showed a phishing email that had made Claude delete a user's emails (Aug 25, 2025). Those figures predate today's models. The current Claude in Chrome page says its protections "aren't foolproof" and that Claude may still take actions you did not intend (Claude in Chrome). Anthropic's custom connector guide warns that a malicious MCP server "may include hidden instructions" (Getting started with custom connectors), and its skills guide names prompt injection and data exfiltration as the main risks of untrusted skills (Use skills in Claude).

The built-in guardrails: Claude in Chrome waits for you before purchases, financial actions and anything irreversible, and can ask per site; Cowork asks before deleting files; connector actions such as sending email ask by default; Claude Code asks before running commands outside its rules, and does not auto-approve curl or wget (Security). The code sandbox in the apps runs in an isolated container per user, with a prompt injection classifier that can stop execution (Create and edit files).

Wrong answers

Claude can state false things with confidence, misread a document, or cite a source that does not say what it claims. This is a safety issue too when the subject is health, law, money or code that runs in production. Open the cited links, check numbers against the original, and have a professional review decisions that matter. Web search and Research give sources to check; they do not make answers correct.

What Anthropic discloses about its own models

Anthropic publishes misuse reports and incident reviews. It reported disrupting what it called an AI-orchestrated cyber espionage campaign that used Claude Code (Nov 13, 2025). On Sep 9, 2026 it published an assessment of four incidents in which Claude models, during cyber evaluations misconfigured with live internet access, reached real third-party systems; in one, Claude Mythos 5 published a malicious package to PyPI that was removed within about an hour (An alignment assessment of recent cybersecurity incidents). These happened in testing, not in users' chats, but they show why agent permissions matter. Anthropic's broader approach is on Responsible Scaling Policy and Anthropic Safety Research.

Safe habits

1. Do not paste passwords, full card or account numbers, ID numbers or other people's private data.
2. Decide on "Help improve our AI models" in Settings > Privacy, and use incognito for one-off sensitive questions.
3. Use your employer's Team or Enterprise account for work data.
4. Turn on two-step protection for the Google or email account you sign in with.
5. Give agents the least access that works: only the folders, sites and connectors a task needs.
6. Keep approvals on for sending, buying, deleting and posting; be sparing with "Allow always".
7. Install skills, plugins, extensions and MCP servers only from sources you trust, after reading what they do.
8. Watch an agent on unfamiliar sites, and stop it if it does something you did not ask.
9. Verify facts, figures and citations before acting on them.
10. Check status.claude.com for outages rather than retrying sensitive actions blindly (Claude Status and Outages).

Frequently asked questions

Is Claude safe to use? For ordinary chat, yes, with care about what you share; Anthropic encrypts data, limits staff access and lets consumers opt out of training. The larger risks come with Claude's agent features, which can be misled by prompt injection.

Does Claude train on my conversations? Only if you allow it on Free, Pro, Max and Ultra, under Settings > Privacy > "Help improve our AI models"; Team, Enterprise and API data is not used for training by default (Is my data used for model training?).

Can Anthropic employees read my Claude chats? Not by default. Anthropic says only chats you send as feedback, or chats reviewed by Trust and Safety staff for Usage Policy enforcement, are seen by people.

Is Claude safer than ChatGPT? No independent measurement settles that. Both offer training opt-outs, encryption and business plans without training by default, so the safer choice depends on settings and habits more than on the brand.

Is Claude in Chrome safe? It is useful but riskier than chat, because web pages can hide instructions; Anthropic says its protections "aren't foolproof" and makes Claude wait for you before purchases and irreversible actions (Claude in Chrome).

Does Anthropic sell my data? No. Anthropic says it does not sell Claude users' data to third parties (Updates to Consumer Terms and Privacy Policy).

Is Claude HIPAA compliant? Claude Enterprise and the Claude Platform offer a HIPAA-ready configuration with a business associate agreement; the consumer plans do not.

Sources

• How data retention works when using Claude, Claude, Sep 14, 2026 (video)
• What does AI actually know about you?, Claude, Aug 13, 2026 (video)
• Security, Anthropic, read Nov 6, 2026
• Anthropic achieves ISO 42001 certification for responsible AI, Anthropic, Jan 13, 2025
• How does Anthropic protect the personal data of Claude users?, Anthropic Privacy Center, read Nov 6, 2026
• Claude for government, Anthropic, read Nov 6, 2026
• Updates to Consumer Terms and Privacy Policy, Anthropic, Aug 28, 2025
• Is my data used for model training?, Anthropic Privacy Center, read Nov 6, 2026
• Is my data used for model training? (commercial), Anthropic Privacy Center, read Nov 6, 2026
• How do I change my model improvement privacy settings?, Anthropic Privacy Center, read Nov 6, 2026
• How long do you store my data?, Anthropic Privacy Center, read Nov 6, 2026
• What is the Enterprise plan?, Claude Help Center, read Nov 6, 2026
• Use incognito chats, Claude Help Center, read Nov 6, 2026
• Minimum age requirement access restriction, Claude Help Center, read Nov 6, 2026
• Claude for Chrome, Anthropic, Aug 25, 2025
• Claude in Chrome, Anthropic, read Nov 6, 2026
• Getting started with custom connectors using remote MCP, Claude Help Center, read Nov 6, 2026
• Use skills in Claude, Claude Help Center, read Nov 6, 2026
• Create and edit files, Claude Help Center, read Nov 6, 2026
• Disrupting an AI-orchestrated cyber espionage campaign, Anthropic, Nov 13, 2025
• An alignment assessment of recent cybersecurity incidents, Anthropic, Sep 9, 2026
• Claude Status, Anthropic, read Nov 6, 2026