Can you put client information into Claude?
Claude is getting increasingly popular with professionals in highly regulated industries.
There is no question that it's good. It's fantastic, it brings a lot of joy.
But I am still hearing a lot of debate around whether can we share confidential information with it.
So let's understand first why we're asking, and then go into the details.
Why are we asking this?
Because there's responsibility.
The Tax Practitioners Board tells us that entering client information into AI tools can count as divulging that information to a third party, so we must get each client’s permission first.
To inform clients properly, we need to understand the risk and show that we’ve done our due diligence.
The Office of the Australian Information Commissioner also says we’re accountable for how an overseas recipient handles personal information we disclose.
So we have a lot of responsibility here.
Three questions to ask about any AI tool
On top of all the questions we already ask about software vendors about how they handle our data, security, encryption and all of those things, there are three new questions we need to ask about AI specifically:
Will they train on my data?
Where do they store my data?
Who else do they share my data with?
So let's look at Claude.
1. Will they train on my data?
Claude's privacy policy says: "We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings."
But if you dig a bit deeper, there are two separate articles to look at. One is for the consumer products, and the other is for the commercial products.
The consumer one says that if you use the Claude consumer products, that's Claude Free, Pro and Max, you can turn off the model training setting. Pro and Max are paid plans, but they're still considered consumer.
The commercial one says: "By default, we will not use your inputs or outputs from our commercial products to train our models." That's Claude for Work (the Team and Enterprise plans), Claude Government and the API.
The risk with the consumer products, even the paid ones, is that if you give them to your team, someone can forget that toggle or turn it on by mistake, and you are allowing them to train on your data.
So if you're going to use Claude, use the commercial product. Paid is not enough. You want commercial.
And if you're using ChatGPT or Copilot, it's very similar. You need to look at which plan you're on. The business plans don't train on your data by default. The consumer plans, even the paid ones, can train on your data based on a toggle. So have a look there.
2. Where do they store my data?
Anthropic make it very clear. They've got an article, "Where are your servers located?", and it says data is stored in the United States. Easy.
Then they say they may also process data in countries where their affiliates operate. And they talk about routing: by default, they may route traffic to select countries in the US, Europe, Asia and Australia, unless otherwise agreed.
So with Claude, data is stored in the United States and can get processed in a lot of places in the world. And that's the big question: are you comfortable with that?
When we did our session with Matt McMillan from Lander & Rogers in our AI club, we read the details together (recording available for members in the AI Club). His bottom line was that he’d use Claude for other things, not for client data, for this reason.
The other opinion I see a lot out there is: "Well, this is similar to any other cloud software I'm using. They store data in many different places in the world, and I'm comfortable with that. I look at Claude, I see how they encrypt, how they store, how they look after and secure data, and I'm comfortable."
So this is where you have a decision to make.
As a side note, OpenAI do have Australian data residency for eligible Enterprise, Edu and healthcare customers, but not for the majority of us even on a business plan. Microsoft Copilot has an in-country commitment for Australia, but not for New Zealand at the moment. I have anecdotally seen New Zealand business setups showing data stored in Australia, which works for them, but I don't know that there's a commitment for that.
3. Who else do they share my data with?
Anthropic show us a page in their Trust Center listing their sub-processors, and we can see they use Google Cloud Platform worldwide, Amazon Web Services worldwide, and some other services in the United States, South Africa and Canada, for user support and more.
So that's who else can access our data and where it gets routed through and processed.
Microsoft Copilot uses OpenAI and Anthropic as sub-processors and treats them slightly differently. Copilot do promise us in-country data, but then they have caveats on Anthropic as a subprocessor and search with Bing. That’s for another day, today we're focusing on Claude.
So, in summary
Focusing on Claude, and on the business plans (so you want Team, not Pro or Max):
They will not train on our data.
Data is stored in the United States and routed and processed in many countries.
They have sub-processors worldwide.
Are you comfortable with that, the way you are with a lot of other cloud software?
That's your one decision to make.
--
Inbal Rodnay
Guiding Firms in AI Adoption and Automation
Keynote speaker | AI Workshops | Executive briefings | The Tech Savvy Firm
When you are ready, here is how Inbal can help:
AI for Accountants Club
- Meetups: See what other firms are actually doing: real use cases, real results, no polish.
- The Radar: What to act on now, what to watch, and what to safely ignore
- The resource hub: prompt packs, policy templates, and implementation guides
AI Magic: 6 Steps to AI Mastery In Your Firm:
- A step-by-step roadmap that shifts your firm from dabbling to safe, impactful AI Adoption
- A hands-on guide for mastering AI in your firm, solo practice, or team.
- Access to a live AI Resource Hub
