Four ordinary programs. None of them looks like a place where minutes are being kept.
Since 26 August, what your people write to Claude inside those four programs can be pulled as a single transcript by your own organisation. The same goes for Claude Science, Anthropic's desktop app for research work.
That day Anthropic extended the coverage of the Compliance API. It is the interface a Claude Enterprise organisation uses to retrieve sessions for compliance purposes, and the extension needed, in Anthropic's own words, "no new key, scope, setting, or client update is required".
One tick, made earlier, now covers four more programs.
How a conversation ends up in the company archive
The Compliance API is Anthropic's interface for what they call compliance reviewers: eDiscovery exports and DLP. It exists for Claude Enterprise only, it uses the Compliance Access Key and the read:compliance_user_data scope the organisation already has, and an ordinary Admin API key gets a 403 and does not get in. If you're weighing up Claude for business, that boundary is the one to hold on to: this comes with Enterprise and does not exist on Team.
The interface splits sessions by where they run.
Local sessions are the ones running on people's own machines. There are four: Cowork in Claude Desktop, Claude Code in the terminal, in Claude Desktop or in an IDE extension, Claude Science as a desktop app, and Claude for Microsoft 365, meaning the add-ins in Excel, PowerPoint, Word and Outlook.
Remote sessions are the ones running in Anthropic's cloud. There is one: Cowork started on claude.ai in the browser or on mobile.
Two of those five surfaces are new since 26 August, and Anthropic describes their coverage as beta: "The local and remote session endpoints are stable for Cowork and Claude Code sessions; coverage of Claude Science and Claude for Microsoft 365 sessions is in beta." Cowork and Claude Code are out of beta. Word, Excel, PowerPoint, Outlook and Claude Science are not.
Then the mechanism, which is the part most people guess wrong. Nothing is installed on the machine. Anthropic says it themselves:
For local sessions, Anthropic records each conversation server-side as its requests reach the Claude API; nothing is installed on the device, and nothing is collected beyond the requests the client already sends to the Claude API.
The recording happens at Anthropic's end, the moment the request reaches the API. No agent on the computer, no rollout, no new client. Which is also why the extension could happen without anyone having to touch anything.
That boundary runs both ways, and Anthropic is just as clear about it: "Local session transcripts show what Claude was asked to do and what it returned, not what happened on the device." Activity that never reaches the API is not captured. A local file the session never sent appears nowhere.
A few surfaces sit outside this altogether, and that matters just as much. Organisations with HIPAA readiness enabled get no local sessions captured at all. Sessions under zero data retention are excluded. So is Claude Code when it runs on a Console API key or through Amazon Bedrock, Google Cloud or Microsoft Foundry. And Claude Code on the web, which does run in Anthropic's cloud but does not count as a remote session: those endpoints return Cowork only.
Three kinds of material now sit in the same log
A transcript holds what the user wrote, what Claude answered, the tool calls and the text of the tool results. Anthropic describes it as returned the way it was sent, apart from truncation. File contents come along when they have passed through a tool call, and only as text. Project files such as CLAUDE.md appear as "ordinary user-role content", meaning as something the user typed. Skill content cannot be distinguished from ordinary user text.
Put those together and there are three kinds of material in the same log.
What your own people wrote. That is the bulk of it. Prompts and answers, in the language people actually write in when they think they are alone with a tool.
Other people's personal data. It does not arrive because anyone decided to collect it. It arrives because the work was about them. An employee asking Claude for help with a reply to a customer puts the customer's details into the transcript on the way past.
Secrets and source. In a Claude Code session the tool results are file contents and command output. That is where configuration, tokens and keys tend to live.
And then there is the one sentence in Anthropic's documentation that makes the rest serious:
Nothing masks URLs, credentials, or personal data in that content, so treat transcripts as sensitive.
Nothing is masked. Not URLs, not credentials, not personal data. It sits in the transcript the way it was written.
There is one more thing to know about the export itself. Tool inputs and each text part of a tool result are truncated to 10,000 bytes by default. The full content requires whoever is retrieving it to set tool_use_input_max_bytes and tool_result_max_bytes to -1, which gives about 1 MiB per string. So the default export is not the complete export, and the difference is decided by the person pressing the button.
The delete button only works in one place
Ask people which is more private: Claude on their own laptop, or Claude in Anthropic's cloud. Most point at the laptop.
It's the other way round.
A local session has no deletion path. Anthropic writes that local sessions have no deleted_at field, and that the session stays listed until retention removes it. The interface is read-only: sessions cannot be deleted through the Compliance API. Anthropic illustrates this with Microsoft 365, where deleting a conversation in the add-in "happens only on the client, so it is not reflected in the API". What the other local clients offer the user is not stated anywhere.
A remote session does have a deletion path. Once a user deletes it, those endpoints no longer return it, and the transcript is not recoverable through the Compliance API.
Cowork is both. Opened in Claude Desktop it is a local session. Started on claude.ai it is a remote one. Same product, same person, same afternoon, and whether they can take their own work back out of the record comes down to which window it ran in.
There is one more detail pointing the same way. user.id is always set and survives account deletion, while email_address becomes null once the account is gone or the person is no longer a member of an organisation the key can read. The name falls away. The identifier tying six years of transcripts to that person does not.
I wrote in August about Claude memory and the default that depends on your plan, where the point was that deleting a chat does not remove the memory. This looks similar and is a different matter. There, the product held on to something about the user, for the user. Here it is a third party, the employer, holding the copy, and the employee's deletion was never the deletion that settled anything. The consequence is not a personalisation feature either, but a record others can read for six years.
An empty transcript proves nothing
An export is a reconstruction, and it has gaps the export does not point out.
When the client compacts its conversation history mid-session, the transcript inserts a synthetic_marker at that point and continues with the new content. If the organisation has a finite retention period, the rewritten history is withheld, a second marker notes it, and only the latest user turn and what follows are shown. A client_aborted means the client closed the connection or cancelled before the response completed, so that turn's response was never captured, and whatever had already streamed to the person at the screen is not included. Images and PDFs are not absent but marked: they come back as a text block reading [image content not shown], with truncated set to true. And the 10,000-byte default truncation means the completeness of an export is a choice the retriever has made, deliberately or not.
Then there is OpenTelemetry, the other way into the same material, which Anthropic documents in the same table. It is available for Cowork and Claude Code, it pushes data out to your own collector, and it captures what the Compliance API does not. Host and device metadata, meaning terminal type and workspace paths, reads No for local sessions, No for remote sessions and Yes for OpenTelemetry. Claude Code can also capture tool results and file contents that way, with an optional, size-capped setting.
And then the part a compliance lead needs to take home. not_captured means there is no content for that turn. Anthropic writes that it "does not prove that no record was stored: content that Anthropic's data-handling policies withhold from the Compliance API is reported with the same reason". A single 404 covers four situations the response does not distinguish between: the session is in an organisation the key cannot read, it does not exist, zero data retention is in effect for it, or every call in it has aged past retention. An empty response is therefore not documentation that nothing exists. It cannot be used to answer a subject access request as though it were.
What has to be in place before you say yes
Two things, and both have a deadline.
The first is the retention period. Captured local content is stored for six years from capture by default. If the organisation has set a finite conversation retention period in claude.ai under organisation settings, that applies instead, "whether it is shorter or longer than the default", and where more than one is configured, the shortest applies. Six years is a default, not a ceiling.
Retention is counted per captured request, not per session. Each call carries its own six-year term from the day it was captured, so a conversation only leaves the record six years after its last message.
And the change works in one direction only. Anthropic writes that the endpoints stop returning activity older than the organisation's current period as soon as the setting changes, while each captured message is stored for the period in force when it was captured, "so lengthening the period later does not restore content that has already expired". Shortening takes effect immediately. Lengthening does not reach backwards. Which makes it a decision to be taken before the sessions, not after the audit.
The second is telling your people. There is a notice requirement in Danish employment law, and how long it runs depends on which collective agreement coverage you have. Datatilsynet's guidance on data protection in employment relationships is where that question belongs, and I am not putting a number on it here.
Anthropic's documentation contains none of that. There is nothing about notifying users, nothing about consent, nothing about transparency towards the people whose conversations are being recorded. The documentation describes an interface, and that is all it sets out to do. The duty sits with you.
Somebody else decides what gets recorded
I do not read this as a warning about surveillance.
The reach of what you record is set out in a table you do not write. Anthropic maintains the list of products and surfaces in their documentation, and underneath it they say: "Products are added to this table as coverage expands."
That is an entirely ordinary and reasonable way to run a product. It is also a description of the scope of your own control measure being fixed somewhere other than at your end, and changing when they change it.
The proof is the four Microsoft programs. Nobody in your organisation asked for Outlook to be included. It appeared on the list on 26 August because Anthropic put it there, and because that decision required nothing of the customer. That those same surfaces are still marked beta is the other half of the proof: the list is still moving.
The consequence is practical rather than principled. What you told your people when you switched it on described the list as it stood then. The list has grown since. The message has not kept up, unless somebody at your end has been watching a documentation page belonging to a supplier in California.
The order matters
Four steps, and the first three can only be done while they still sit ahead of the fourth.
- Write down which programs your people actually open Claude in.
- Choose the retention period. Each captured request carries its own six-year term from the day it is captured, so a conversation only disappears six years after its last message.
- Tell your people.
- Say yes.
The first three are a week's work. The fourth takes a second, and afterwards the first three are no longer available in the same way: a retention period lengthened later does not bring back what has already expired, and a message given afterwards is not notice.
Most of the companies I talk to cannot answer the first step. Not because they're careless, but because Claude came into use one place at a time and nobody made the list. That is exactly the piece of work Internal Claude starts with: how the team actually uses Claude for business, before anything gets adjusted. It is the least glamorous half of GDPR compliant AI consulting and the half that decides the rest.
2032
A transcript captured this morning can still be read in 2032.
The person reading it has probably not been hired yet. The employee who wrote it may not be there either, but user.id is still set, and it still ties the text to them.
Six years is not a long time in a retention policy. It is a long time in a working life.
FAQ
Frequently asked questions
Start by knowing what gets recorded and for how long. On Claude Enterprise, captured session content is stored for six years from capture by default, and you can set a shorter retention period yourself. Map the surfaces, choose the period, and tell your people before you switch anything on.
If you are on Claude Enterprise and the organisation has enabled the Compliance API, they can retrieve transcripts of sessions from Cowork, Claude Code, Claude Science and the Claude add-ins in Word, Excel, PowerPoint and Outlook. Whether they may is a question of Danish employment law and of what you were given notice about.
There is a notice requirement in Danish employment law, and its length depends on collective agreement coverage. Datatilsynet's guidance on data protection in employment relationships is where to look it up. Anthropic's documentation mentions no duty to notify, and that is the point: it sits with you, not with the supplier.
Claude Enterprise, a Compliance Access Key and the read:compliance_user_data scope. Nothing is installed on the machines, and an ordinary Admin API key gets a 403.
Six years from capture by default for local sessions, and six years for remote sessions unless a user deletes them sooner. If the organisation has set a finite conversation retention period, that applies instead, and where several are configured the shortest applies. Retention is counted per captured request, so a conversation leaves six years after its last message.
It depends on where the session ran. Local sessions have no deletion path through the Compliance API, and the session stays listed until retention removes it. A remote session, meaning Cowork started on claude.ai, is no longer returned by those endpoints once the user has deleted it.
File contents and command output come along as text in the tool results, and Anthropic writes that nothing masks URLs, credentials or personal data. So yes, if it has been through a Claude Code session.
Yes. Storage is not the problem in itself. What has to be in place is a lawful basis, a retention period you chose rather than inherited, and notice to your people before the recording is switched on.
Sources
- Claude Platform release notes, 26 August 2026
- Retrieve session transcripts, Anthropic's Compliance API documentation
Every quotation was read directly off Anthropic's own pages on 4 September 2026.
