SVENNISAIHow Claude runs in your company
Every owner's first question is where the company's data goes. Here are the answers, with Anthropic quoted word for word and what that means for your company.
Book a 30-minute call · with a Claude Certified Architect from our team.
Read on Anthropic's public pages on 13 October 2026.
Whose account is it?
Claude is the AI assistant made by Anthropic, an American company. Below are nine questions, in the order we receive them, each with the Anthropic quotation it rests on.
Yours. Every pilot and every assistant runs on your company's account with Anthropic or on your own cloud account. The access keys are created in your account, and you set the spending limits.
We do not resell Claude, and no Anthropic invoice passes through us. If we stopped tomorrow, nothing would disappear; we write this rule into every offer.
“Your organization's designated Primary Owner manages your Work account and all associated data.”
Who do you sign with?
For a UK company, the contract for Claude Team, Claude Enterprise or the API is with Anthropic Ireland, Limited. You sign it yourself, directly with Anthropic; the seats do not pass through us. Companies use Team or Enterprise; Pro and Max are for individuals, not for client data.
On Claude Team, Claude Enterprise and the Anthropic API, your company is the controller. Anthropic processes the data only on your instructions, as processor. With us, Svennis Cloud Solutions Ltd, you sign a contract for our work and a data processing agreement.
“'Anthropic' means Anthropic Ireland, Limited if Customer resides in the European Economic Area ('EEA'), Switzerland or UK, and Anthropic, PBC if Customer resides anywhere else.”
“Anthropic acts as a 'Processor' of the data on behalf of the customer. Anthropic only processes the data as instructed by the customer in order to provide the Claude service.”
Where does the data go?
On Claude Team, Claude Enterprise and the Anthropic API, the text goes to Anthropic to be processed. Anthropic stores Claude Team and Enterprise data in the US and may process it in the US, Europe, Asia or Australia. On the Anthropic API, stored data sits in the US.
Anthropic's data processing addendum includes the UK Addendum, which covers the transfer out of the UK. UK GDPR also asks you to check that the protection stays materially the same; we draft that assessment for you to adopt, on request.
For regulated data we use your own AWS account, on Amazon Bedrock in London (eu-west-2). On the AWS region table read on 10 October 2026, Claude Opus 5.5 is served in-region in London, so inference runs in the UK.
Claude Sonnet 5.5 and Haiku 5.5 reach London through EU cross-region inference: processed within Europe, not always in the UK. Fable 5.1 is global only. Fable models keep data for 30 days on every platform, so we do not use them for regulated data.
On those routes the processor is AWS, not Anthropic. We write the chosen route into the offer; you name the transfer and the recipients in your privacy notice (UK GDPR Articles 13 and 14).
“This page covers the Claude API (api.anthropic.com), Claude Platform on AWS, and Claude in Microsoft Foundry, where Anthropic is the data processor. On Amazon Bedrock and Google Cloud's Agent Platform, the cloud provider is the data processor; refer to those platforms' data retention and compliance documentation for their equivalent controls.”
“Inference geo: Only 'us' and 'global' are available. [...] Workspace geo: Only 'us' is currently available.”
How long does Anthropic keep the data?
On the Anthropic API, inputs and outputs are deleted within 30 days, with the exceptions Anthropic lists on the page quoted. On Claude Team, conversations stay in the account until someone deletes them; a custom retention period exists only on Enterprise.
Two exceptions we state openly. Content flagged by Anthropic's automated safety systems may be kept for up to two years.
A conversation a colleague sends as feedback (the thumbs up or down button) may be kept for up to five years. At setup we switch the feedback button off in the organisation's settings.
“For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation, except:”
“By default, data is retained indefinitely unless a custom retention period is set.”
Does Anthropic train its models on my data?
On Claude Team, Claude Enterprise and the API, no. In Anthropic's terms, "may not" is a prohibition, not a possibility.
There is one exception: feedback sent explicitly, through the thumbs up or down button. That is why we switch it off at setup, in the organisation's settings.
On Claude Free, Pro and Max, training is on until you switch it off in the settings. That is why your clients' data never goes into a Pro or Max account: we work on Team, Enterprise or the API.
“Anthropic may not train models on Customer Content from Services.”
“If you explicitly report feedback or bugs to us (e.g. via our thumbs up/down feedback button), or otherwise choose to allow us to use your data, then we may use your chats and coding sessions to train our models.”
Is there a UK AI Act, and what applies to my company?
There is no UK AI Act. The EU AI Act is EU law, and we do not apply its duties to a UK company working in the UK. If you sell AI systems into the EU, that market needs its own advice.
What applies here is data protection law. For decisions taken solely by automated means with a legal or similarly significant effect, UK GDPR Articles 22A to 22D set the safeguards.
Those safeguards include telling the person, letting them make representations and contest the decision, and a human who can step in. The ICO, the UK data regulator, publishes guidance on AI and data protection.
Our practice: the assistant presents itself as AI, and a person confirms before an action leaves. The AI policy and the risk register are handed over with named owners.
Walkthroughs written from the projects, not recordings; names and figures are illustrative.
What do UK GDPR and the Data Protection Act 2018 ask of me?
Your company remains the controller. On Claude Team, Enterprise and the Anthropic API, the processor is Anthropic, under Anthropic's DPA, which is part of the commercial terms.
The DPA comes with the public list of sub-processors, the firms Anthropic uses to deliver the service. As with any supplier: a lawful basis, a privacy notice, answers to people's rights requests, and the US transfer named in your notice.
Since 19 June 2026, the Data (Use and Access) Act 2025 requires an electronic way for people to complain about how you use their data. You acknowledge each complaint within 30 days.
If the assistant sends marketing messages, or your website chat sets cookies, PECR applies as well. Where we can, we mask personal data before the text reaches the model and before storage, as we did for Salus Controls.
“This Data Processing Addendum ('DPA') is incorporated into and forms part of the Anthropic Commercial Terms of Service [...] and applies to Anthropic's processing of Customer Data (defined below). [...] Anthropic's list of subprocessors is available at https://www.anthropic.com/subprocessors.”
Making Tax Digital: what does Claude do, and what stays with a person?
Claude does not file your VAT return and never holds your HMRC credentials. The return is submitted from your MTD-compatible software by a person in your company or by your accountant.
Your obligations to HMRC stay with your company. The data stays in your software (Xero, QuickBooks, Sage, FreeAgent or Zoho Books) and on your account.
The purchase invoice, compared
Claude puts the supplier's invoice beside the order and the ledger entry, and flags the differences for a person to resolve.
The VAT figures, checked before filing
Claude runs the checks before the VAT return on the data in your software and marks what is missing. Your software prepares the return, and a person submits it.
Companies House, read
Claude reads a customer's or supplier's record at Companies House: status, officers, filing deadlines. It reports what the company filed; it is not a credit rating.
What do you check directly with Anthropic?
We do not assert Anthropic's security certifications (SOC 2, ISO 27001) ourselves. You check them on the Trust Center, the public page where Anthropic publishes its certifications and documents. Anthropic's account team answers questions about your contract with Anthropic.
We answer for what we build: our processing, our data processing agreement with you, where our code runs and our logs. We write them into the offer and sign them.
“Here you can find our compliance artifacts, request documentation, and view high-level details on controls we adhere to.”
What you receive at handover
The same eight things at every delivery, on your account.
- 01The signed specification. What the system does, what it does not do, who confirms.
- 02The test set, with results. The real cases we tested the system on before go-live, with the result of each.
- 03The human approval step. Where the system stops and who confirms.
- 04The AI policy. What staff may put into Claude, and who is responsible.
- 05The risk register. Each risk, its measure and the person responsible.
- 06The account and limit configuration. The account, the roles, the keys and the spending limits, as they were set.
- 07The agent's log. What the agent did, when and on which data. The agent is the program that takes a task to the end and asks a person when it is not sure.
- 08The monthly report, with Managed AI Operations. Volumes, errors, the usage cost and the month's changes.
Sources
The pages quoted on 13 October 2026, and our own pages.
- Anthropic Trust Center: Certifications, reports, the DPA, sub-processors, Cowork security.
- Commercial Terms of Service: The contracting entity for the UK, customer content, training.
- Data Processing Addendum: Anthropic's DPA, the transfer clauses, the sub-processors.
- How long do you store my organization's data?: Deletion within 30 days on the API, flagged content, feedback.
- Is my data used for model training? (commercial products): The feedback exception and the Rate chats setting.
- Data retention practices for Covered Models: Fable models: 30-day retention on every platform.
- Privacy Policy (consumer accounts): Training switched on by default on Free, Pro and Max.
- AWS, model support by Region: Which Claude models Amazon Bedrock serves in London (eu-west-2).
- Data Protection Act 2018, s.164A: The complaints duty added by the Data (Use and Access) Act 2025.
- AI law for UK businesses: What applies in the UK, and where the EU rules start if you sell into Europe.
- Our services: The offers, with scope, price and timetable written before you sign.
This page is information, not legal advice. Decisions on the lawful basis, the impact assessment, the data transfer and suppliers belong to your company, as controller, together with its lawyer.
Frequently asked questions
Can I use Claude for client data?
Yes, on Claude Team, Claude Enterprise or the API, under Anthropic's commercial terms. For health data or other special category data, an impact assessment comes first, and the route runs through your own AWS account. We decide it together with your data protection lead, and never in a Pro or Max account.
Does the data stay in the UK?
On the Anthropic API, no: processing is in the US or global, and stored data sits in the US. For regulated data we run on Amazon Bedrock in London, where Claude Opus 5.5 is served in-region. The full answer is under "Where does the data go?" above.
I hold health data or other special category data. What changes?
A data protection impact assessment (DPIA) comes before anything else. We deliver its technical part: the description of the processing, the data flow, the measures. The legal assessment and the decision stay with your company, as controller.
Who sees the conversations?
The administrator your company names manages the account and its data, including downloads of conversation data. Downloading colleagues' conversations is monitoring: tell them first, in the AI policy, and follow the ICO's guidance on monitoring workers. At Anthropic, nobody reads conversations by default; flagged content may be reviewed by a small group of approved people.
Who are you, and what do I sign with you?
Svennis Cloud Solutions Ltd, registered in England and Wales, company number 13852193, registered office in Manchester. You sign a services contract and a data processing agreement with us, with the list of our sub-processors. The agreement says how quickly we notify you of a security incident, so you can meet the 72 hours to the ICO. Our services and prices
Do you need access to my systems?
Only as much as the work needs: named accounts for our team, on your systems, with minimum rights, after our data processing agreement is signed. You can revoke them at any time, and at handover we tell you exactly what access remains.
What happens if I stop?
The account, the keys and everything we handed over stay with you and carry on without us. Managed AI Operations stops from the following month; there is no minimum term. What you sent to Anthropic follows its deletion rules above, and you revoke our accounts on your systems.
Which Claude plan do I need, and what does it cost?
For companies, Claude Team or Enterprise, bought directly from Anthropic; we do not resell the seats. Anthropic's published UK prices, with the date we read them, are on our Claude pricing page. Claude pricing in the UK
Last reviewed 18 October 2026
Bring your lawyer's questions
Bring the question your lawyer or your data protection lead wants to ask. You talk for 30 minutes with a Claude Certified Architect from our team, without a demonstration.
Prefer to call? +44 7588 772736 · Not ready to talk? See it on your business first.
- 1Time
- 2Details
- 3Booked