The short answer to does Claude Code retain or train on source code is that it depends on your account tier, your deployment surface, and your contract. Anthropic states it does not train foundation models on commercial and API inputs by default, while consumer plans differ. For enterprises, the real risk is the gap between that policy statement and what code actually leaves each workstation, so approval means verifying retention, residency, and enforcement.

Last updated: August 2026.

Claude Code is a command-line coding assistant that reads files, runs commands, and edits repositories. It operates directly on source, prompts, command output, and repository context, so the data-handling question is not academic. Legal, privacy, AppSec, and security teams need one place that resolves how the tool processes code, how retention and model-improvement settings differ by tier and deployment surface, and which contractual instruments to check before authorizing it across a developer population.

This article walks through each of those decisions, then the interaction-level controls a team should put in place after approval. A policy statement in a vendor document is not the same as an enforced control at the point where code leaves an endpoint. For the same question applied to a different assistant, see does Cursor store, retain, or train on source code.

Does Claude Code Train on Source Code?

Whether Claude Code trains on your source code depends on account tier: Anthropic states commercial and API inputs are not used to train foundation models by default, while consumer-tier terms differ and must be checked. Model training means using your prompts and code to improve Anthropic’s foundation models. That is a different question from retention: training can embed patterns from your code into a shared model, while retention concerns how long a copy of your data persists on Anthropic’s infrastructure. Both matter for approval, and each requires separate verification.

Until you verify the setting, take the safe approval position: do not route proprietary source through a personal or consumer-tier login while the training behavior is unconfirmed.

No-training commitments in commercial and API agreements may carry a trust-and-safety carve-out: content flagged for abuse review can be handled outside the default no-training path. If Anthropic identifies an abuse-review exception, legal teams should get the exact scope: what triggers a review, who can access flagged content, whether reviewed content can be retained longer, and whether it affects the no-training commitment.

Across the market, only 38 percent of organizations report a formal, comprehensive AI policy and 25 percent have none (ISACA, 2026). That gap matters here. Even when an enterprise secures the right contract tier, a missing AI-use policy means the training-and-retention question never reaches the developers who need to act on it.

What Does Claude Code Send to Anthropic Servers?

Claude Code sends the file content, prompt, and repository context needed to answer each request to a model endpoint, along with command output and any file it reads. Ask it to explain a function, refactor a module, or fix a failing test, and that content travels to the model. So secrets in a config file, proprietary algorithms, and customer data in a fixture can all become model input if they sit in the files the agent touches.

This is the core of the egress question. Approval means knowing exactly which data categories travel over the wire, not only what the model does with them once received.

OWASP ranks Sensitive Information Disclosure (LLM02) among the top risks for applications built on large AI models, and that framing applies to any coding assistant that reads repository context: the risk is not only adversarial exfiltration but also data included in a prompt that lands on a server under terms the developer never reviewed (OWASP, 2025). AppSec teams should treat egress as a data-classification exercise before developers route source through the tool.

This is why AppSec teams treat coding assistants as a data-egress question first. The same concern applies to other assistants covered in risks of using Claude Code with company source code.

How Long Does Claude Code Retain Source Code?

Retention windows are plan-specific, and public documentation does not always state an exact figure, so the contract and admin console are the source of truth for each surface. Confirm the storage window for consumer login, Team or Enterprise account, direct API, and any Zero Data Retention (ZDR)-approved API route. Where public docs are silent, verify the window in the executed contract and the account admin console before authorizing a developer population.

Zero Data Retention removes prompt and output storage on eligible API traffic. Before you rely on it, confirm three things: eligibility for your specific plan and endpoint, the scope of what it removes, and its limitations around abuse monitoring and support debugging. ZDR is not automatic and not universal. It can apply to the API route but not to a Team or Enterprise seat that routes differently.

This checklist sequences the retention approval for a legal or AppSec reviewer:

1. Identify the exact account tier each developer group will use: consumer, Team, Enterprise, or direct API.
2. Get the current retention window for that tier from the Anthropic contract or admin console, because public documentation does not always state an exact figure and windows change.
3. Confirm whether that tier is eligible for Zero Data Retention and whether it is on by default or requires an explicit opt-in or request.
4. Read the ZDR scope statement for exceptions such as abuse review, safety flags, or support-triggered logging, and document what those exceptions cover.
5. Map the confirmed retention window to your data-classification policy and any record-retention obligations under GDPR, HIPAA, or sector-specific rules.
6. Define what sensitive content may not reach the endpoint at all, then put interaction-layer controls in place to enforce that boundary before data leaves the workstation.

Deployment Surface Determines Governing Terms

Where you route Claude Code determines which company holds the traffic and under which terms, so a direct Anthropic API call, a Bedrock route, a Vertex AI route, and an Azure AI Foundry route are governed by different contracts. A direct Anthropic API call is governed by Anthropic’s commercial terms. Route Claude through a cloud provider, and you must verify the provider contract that governs prompts, outputs, logs, support access, processing region, and retention. Do not assume the direct Anthropic terms apply to Amazon Bedrock, Google Vertex AI, or Azure AI Foundry-hosted deployments.

Data residency is a separate question from retention. For cross-border deployments, name the processing region, the logging region, the support-access region, the subprocessor region, and the international transfer mechanism that covers the data flow under GDPR or equivalent rules. The EU AI Act adds a further obligation for organizations deploying AI systems that touch personal data in scope: high-risk AI system classification triggers conformity obligations that compound the GDPR analysis (EU AI Act, 2024).

The table below is a capability comparison. Each row states a governance capability, what deployment-surface terms alone provide, and what Aurascape enforces at the interaction layer:

Confirm the cloud-provider data-handling terms for each route before you rely on the table above.

The common failure is approving one surface, then watching developers quietly use a personal login or an unconfigured cloud endpoint. That is a discovery problem a policy document cannot solve. For a broader view of governing multiple assistants at once, see how to secure Claude Code, Cursor, and GitHub Copilot.

Local Cache, Permissions, and Workstation Exposure

Not all exposure travels over the network. Claude Code runs as a local agent with file access and command execution, and it can create local artifacts such as session history, configuration, and command context. Verify where those artifacts live, who can read them, and whether secrets or customer data can enter them. A permissive configuration that lets the agent read the whole repository, run arbitrary commands, or reach outside the project directory widens the surface well beyond the prompt itself.

Security teams should scope the agent’s permissions to the minimum the task requires: which files it may read, which commands it may run, and whether it can call external tools beyond the project boundary.

Source-code context sent as prompt input is different from agent-to-tool execution. When Claude Code invokes an external tool through the Model Context Protocol (MCP), that action is a separate data path, and MCP is one common tool-execution pattern, not the whole agent access-control problem. An agent that reads a repository is one risk. An agent that reads a repository and then calls a tool to push data to an external endpoint is a compounded one. Govern both paths separately.

The NIST Secure Software Development Framework makes clear that provenance and control over the tools that touch source are part of the secure-development obligation, not an optional add-on (NIST, 2024). That shifts the conversation from “can we trust Anthropic’s terms” to “can we show that our development toolchain meets our own secure-development requirements.”

For how workstation-level exposure plays out across two comparable assistants, see Cursor source code exposure.

Compliance Instruments, GDPR, and HIPAA Deployment

Legal teams should collect the contractual instruments that turn a stated commitment into an enforceable obligation, and confirm which ones are available for the exact plan and deployment surface in use. For Claude Code, collect: a SOC 2 Type II report to verify operational controls; an ISO 27001 certificate to verify information-security management; an executed Data Processing Addendum (DPA) that names Anthropic or the cloud provider as a data processor, lists subprocessors, and specifies the international transfer mechanism; and, for workloads that touch protected health information (PHI), a Business Associate Agreement (BAA) where one is available for that surface.

Under GDPR, the DPA must name all subprocessors that may touch the data, including cloud providers and support vendors, and specify a valid transfer mechanism such as Standard Contractual Clauses for data leaving the EU. Routing through a European-region cloud instance does not satisfy GDPR on its own if support personnel in other regions can access flagged content. Verify that point explicitly.

For HIPAA, approval turns on whether PHI is actually in scope and whether a BAA covers the exact service tier and deployment surface in use. Do not assume a BAA is generally available, or that one executed for a different tier or surface extends to Claude Code. A DPA satisfies the contract; it does not enforce what a developer types into a prompt or which files the agent reads. The World Economic Forum reports that organizations assessing AI-tool security before deployment nearly doubled, from 37 percent to 64 percent (World Economic Forum, 2026). An assessment is still not an enforced control, which is the gap between a signed DPA and runtime policy.

From Vendor Policy to Enforced Control

Vendor terms define what happens after data arrives at the endpoint. They do not govern which files a developer feeds the agent, which account they use, or which surface they route through. That gap is where source-code exposure actually happens, and it lives at the interaction layer before the data reaches any vendor. 43 percent of employees admit sharing sensitive workplace information with AI tools without employer knowledge, including internal documents and financial data (National Cybersecurity Alliance, 2025). In a developer context that sharing is often unintentional: a coding agent reads what is in scope, and what is in scope depends on file permissions and session configuration, not on what the developer meant to share.

Aurascape enforces that boundary at the interaction layer. It discovers covered Claude Code sessions, accounts, and agent activity as AI traffic traverses Aurascape, including shadow use on unapproved surfaces, then classifies sensitive content inline before it reaches an unapproved endpoint. Aurascape applies 600+ real-time data classifiers to that inline classification, so secrets, proprietary algorithms, and customer data in fixtures get caught and acted on before they leave the workstation path (Aurascape, 2026).

For the agent side, Aurascape discovers local AI agents and their interactions and adds a Zero-Bypass MCP Gateway that cryptographically signs approved tool calls and blocks unsigned ones, governing the agent-to-tool execution path inline rather than observing it (Aurascape, 2026). Prompt and response inspection handles the intelligence channel, and the Zero-Bypass MCP Gateway handles the tool-execution channel, so the two paths are governed separately.

Context-aware policy actions cover the full range a team needs: allow, coach, warn, block, and redact. Coach a developer when a prompt includes a secret. Redact a fixture with customer data before it reaches any endpoint. Block an unsigned tool call outright. Interaction records document who used AI, which account or tenant, what data was shared, what action was attempted, what policy decision occurred, and what record remains, governed by role-based access control (RBAC) for privacy wherever developer prompts and repository paths are logged. That gives AppSec and legal a per-session evidence trail for governed sessions, held independent of what the vendor logs on its side. For how this applies to the developer-agent comparison, see Claude Code vs. Claude.ai Workspaces vs. Claude Desktop.

Frequently Asked Questions

Does Claude Code train on my source code?

It depends on account tier. Anthropic states commercial and API tiers are not used for training by default; consumer-tier terms differ. Verify the current setting for the exact tier your developers use, and ask specifically about the trust-and-safety carve-out that covers flagged content, because that exception can fall outside the standard no-training commitment.

How long does Claude Code retain my data?

Retention is plan-specific, and public documentation does not always state an exact window, so the contract and admin console are the source of truth. Confirm the storage window for each tier in use. Zero Data Retention can eliminate prompt and output storage on eligible API routes, but verify eligibility for your specific plan and endpoint.

Does the answer change if I use Bedrock or Vertex AI?

Yes. Each cloud provider’s own account terms, residency controls, and logging govern the traffic, not Anthropic’s direct terms. Confirm the governing contract for the surface your developers will actually use before they adopt a different route.

What are the Claude Code compliance documents to collect?

Collect a SOC 2 Type II report, an ISO 27001 certificate, an executed DPA that names all subprocessors and specifies an international transfer mechanism, and a BAA if PHI is in scope and one is available for the surface. Confirm that each instrument covers the specific tier and deployment surface in use, not just the product name.

How do Claude Code permissions affect secrets on my workstation?

Broad Claude Code permissions widen exposure to secrets and customer data. The agent reads files, runs commands, and can create local session and config artifacts, so credentials in environment variables or customer data in test fixtures can enter context. Scope file access, command execution, and external tool calls to the minimum the task requires, and verify where local artifacts live and who can read them.

Does a no-training commitment cover the trust-and-safety exception?

Not automatically. If Anthropic identifies an abuse-review exception, content flagged for that review can be handled outside the default no-training path. Ask what triggers the review, who accesses the flagged content, how long it is retained, and whether it affects the no-training commitment.

What Claude Code audit logs do legal and AppSec teams get?

Vendor logs live with the vendor and vary by tier, so teams that want independent, per-session evidence should enforce at the interaction layer. Aurascape produces interaction records for governed Claude Code sessions and governed tool calls, documenting the account used, what data was shared, what action was attempted, and what policy decision occurred, all governed by RBAC for privacy (Aurascape, 2026).

Aurascape turns Claude Code approval into an enforced control. It discovers covered sessions and shadow accounts, classifies sensitive source before egress, governs approved tool calls, and records governed activity for review under RBAC. The result is a Claude Code deployment where the retention-and-training answer is backed by a control at the moment code would leave a covered route.

See how Aurascape governs Claude Code source code across every deployment surface →