Claude Cowork makes several copies of work data, and each copy follows a different retention rule. So when teams ask does Claude Cowork retain files, prompts, or work product, the useful answer splits into three: what Anthropic states it holds, what stays on the endpoint, and what your own logs record. Anthropic documents 30-day rules for certain model and API data. Confirm they govern your Cowork tier.

Last updated: September 2026.

What Counts as a File, Prompt, or Work Product in Cowork?

Retention for a desktop coworking agent means how long each class of content survives in three separate places: the machine where the agent reads and writes files, the vendor service that processes prompts and returns outputs, and the customer-controlled logs that record activity. A stated retention window covers the middle one. Buyers read it as covering all three, and that is where an approval goes wrong.

The classes behave differently. A prompt is the instruction plus anything pasted into the session. A file is whatever the agent opens, reads, or writes, including material pulled in through a connector. Work product is what the agent generates: a contract comparison, a financial model, a slide outline, a rewritten policy document. Connector and tool-call activity is a fifth class on its own, because it can move content through a third-party system that neither the vendor’s retention page nor your file audit describes. Each class persists on its own timeline, in its own location, under its own contract term. A review that produces one number has answered roughly one fifth of the question.

The pressure behind the question is measurable. Data leaks are now the top generative AI security concern at 34%, ahead of advancement of adversarial capabilities at 29%, reversing the 2025 ordering (World Economic Forum, 2026). Retention is the first place that concern turns into an approval decision, which is why the answer has to hold up beyond a policy page.

How Long Does Claude Cowork Retain Prompts and Outputs?

Two published Anthropic rules carry a 30-day figure. Your approval turns on the difference between them, and on whether either names Cowork directly. The matrix below records what each source states, whether Cowork applicability is confirmed or unresolved, and the action that closes the gap.

Two questions sit outside that matrix. The pages reviewed here address Team and Enterprise use, and none states a Cowork retention rule for individual consumer accounts, so treat consumer-tier retention as unestablished until Anthropic confirms it in writing. None of the four addresses Cowork-specific certifications, attestations, or audit rights either, which is a limit of this source set rather than a finding about Anthropic’s compliance program. Ask your account team for the certification scope that covers Cowork by name.

Training use follows the same pattern. The sources reviewed here state no Cowork-specific default for model training or improvement at any tier. Get the default in writing per tier, confirm whether the setting is enforced at the workspace level or left to each user, and record which tier each business unit is licensed on rather than assuming your Enterprise terms travel everywhere. Anthropic’s compliance tooling matters here for one practical reason: it moves a copy of session activity into systems you control and retain on your own schedule, instead of leaving the only record inside a vendor window. For the parallel analysis on Anthropic’s developer tooling, see Claude Code compliance and data residency risks.

What Happens to Files After a Cowork Session Ends?

Claude Cowork is presented here as an agent that can work with local files. Verify its exact file, execution, and containment permissions against Cowork-specific documentation before approval. Anthropic’s engineering write-up describes containment architecture for agentic sessions, including sandboxing and permission boundaries, without enumerating Cowork’s file and code permissions line by line (Anthropic Engineering, 2026).

Follow one workflow all the way through. An analyst points the agent at a folder of signed customer agreements and asks for a comparison deck. Even when source content stays local, generated work product raises a separate persistence and access question on the endpoint or in a synced folder. Clause text now sits inside a new file, in a new location, under whatever backup, sharing, and retention rules that folder already carries. A vendor window describes the vendor’s copy of the session. It says nothing about that new file, who can open it, or how long it survives.

Two of the risks in play are already ranked. OWASP places Sensitive Information Disclosure (LLM02) and Excessive Agency (LLM06) among the top risks for large language model (LLM) applications (OWASP, 2025). An agent with file write access and connector reach touches both inside a single session, so file behavior earns its own line in the approval rather than a footnote to the retention answer.

Connectors widen the surface again. The agent can reach external systems through connectors and Model Context Protocol (MCP) servers, and MCP is one common tool-execution pattern, not the whole agent access-control problem, since an agent can act just as easily through a connector, a shell command, or a file write. That permission surface is the subject of our guide to AI coding agent permissions across files, shell, git, and cloud and the broader review of the risks of using Claude Cowork at work.

Eight Checks That Close a Cowork Approval

Run these as tests with pass conditions, not as questions to leave open. Each one has a named owner and a written artifact at the end of it.

1. Retention per data class. Ask for figures in days for prompts, uploaded file content, generated outputs, and connector call records. Pass condition: every figure cites a page that names Cowork.
2. Training default per tier. Pass condition: a written default for your tier, plus proof the opt-out is enforced at workspace level rather than per user.
3. File handling during and after a session. Pass condition: a documented statement of what transits the service and what remains in the session workspace once the session ends.
4. Deletion mechanics. Test a user-initiated conversation delete and an administrator delete for a departed employee. Pass condition: observed behavior plus written propagation timing and legal-hold exceptions.
5. Residency. Pass condition: processing and storage regions named in the agreement, plus a written answer on how connector calls route content into other jurisdictions.
6. Internal access. Pass condition: a named list of roles that can read stored conversations and outputs, and confirmation that their access is itself logged.
7. Audit detail. Pass condition: a sample log entry showing user, timestamp, action, target, and result for one agent action on one local file.
8. Connector and tool approval. Pass condition: a named approver, a current allowlist, and a defined outcome when a user adds a server nobody reviewed.

What Published Retention Terms Cannot Show About Your Environment

Published retention terms do not provide environment-specific evidence about active users, account type, or local file actions. That gap shows up first in inventory: security teams have to identify active Cowork use before they can apply the approved tier, account, and data policies. A retention setting configured correctly in one workspace does nothing for a second workspace nobody registered.

The common failure is not a misconfigured setting. It is an employee signing into a personal account on a managed laptop and running the same agent against the same files. A session under a personal account can fall outside the organization’s negotiated workspace terms, even on a managed device, so account type belongs in the control set rather than only in the policy document. Employee behavior supports the concern: 43% admit sharing sensitive workplace information with AI tools without employer knowledge (National Cybersecurity Alliance, 2025).

A compliance reviewer asks a narrower question than any policy page answers: on this date, which user ran which session, under which account, against which content, and what left the device. Runtime produces that answer, while the session is happening.

How Aurascape Adds Runtime Evidence for Cowork Use

Discovery comes first, because usage predates review. Aurascape continuously discovers AI applications, agents, MCP servers, and MCP tools across the enterprise, including tools security has not approved, and detects AI agents running locally on endpoint devices, reading an agent launch and its configuration before the agent takes its first action (Aurascape, 2026). That produces the inventory a retention page cannot: which teams run Cowork, on which devices, under which account.

Inline control comes next, at the moment content moves. Aurascape decodes the exchange itself, including prompts, files, code, account type, and intent, and carries context across the full conversation rather than a single prompt. More than 600 real-time data classifiers run on that decoded stream, and customers can add their own regex patterns or fingerprinted data under Bring Your Own Key (BYOK) for content only they can name (Aurascape, 2026). Policy actions include allow, coach, notify, redact, redirect, block, capture, and require tenant, so a team can steer a user to the sanctioned account or strip a customer identifier from a prompt without switching the tool off.

Tool execution and evidence close the loop. Aurascape discovers and secures local AI agents and their interactions, and adds a Zero-Bypass MCP Gateway that marks every tool call it approves and blocks unmarked calls, governing the agent-to-tool execution path inline rather than observing it (Aurascape, 2026). Tool definitions are pinned at sanction, tool descriptions are inspected for hidden instructions, and results are inspected before the agent acts on them. Aurascape creates interaction records for audit and effectiveness, governed by role-based access control (RBAC) for privacy, showing the user, application, tool, parameters, detected data categories, and the policy decision for a given action.

The table below sets the documented Cowork controls beside what a runtime control layer contributes. Column two reports what Cowork’s own documentation establishes, not the full capability of Anthropic’s service.

For teams mapping these controls to sector obligations, see our overview of AI compliance frameworks for banks and investment firms.

Frequently Asked Questions

Does Claude Cowork retain prompts and outputs by default?

Anthropic’s covered-model policy sets a 30-day window for prompts and outputs, and its API policy sets 30-day backend deletion, so the open item is which of the two governs your Cowork tier. Get that mapping in writing before you treat 30 days as your approval baseline.

Does Anthropic train models on Cowork content?

The sources reviewed here publish no Cowork-specific training default at any tier. Confirm the default per tier, and confirm whether the opt-out is enforced at the workspace level rather than left to each user to set.

What happens to local files Cowork opens or creates?

Generated work product can persist on the endpoint after a session, independent of anything the vendor retains. Confirm which content transits the service, what remains in the session workspace once the session ends, and which folders the agent may write into.

Can administrators delete Cowork conversations and files?

Deletion controls and timing were not itemized on a Cowork-specific page in the sources reviewed here. Run the deletion test in the checklist above, and get the propagation timeline and legal-hold exceptions in writing before approval.

Does retention differ between consumer, Team, and Enterprise accounts?

Treat this as tier-specific, per the tier note above: the Cowork documentation reviewed here addresses Team and Enterprise use and states no consumer-tier terms. Request both sets in writing, and record which tier each business unit is licensed on.

Where is Cowork data stored, and can we control residency?

Residency was not resolved by the sources reviewed for this article. Ask for processing and storage regions, whether a regional commitment is contractual rather than operational, and how connector calls route content into other jurisdictions.

Who inside our organization can view stored Cowork content?

The Cowork materials reviewed here do not name the internal roles that can read stored content, so confirm it in your admin console and enterprise agreement. Aurascape applies role-based access control to the interaction records it creates in your environment.

Are there audit logs of what the agent did to local files?

Anthropic describes Cowork session capture through its Compliance API with an owner-managed export path, and the exact event fields remain under verification. Aurascape’s interaction record separately covers the user, application, tool, parameters, detected data categories, and policy decision for an action.

Aurascape adds runtime evidence to a Cowork retention review. It discovers documented deployment paths, evaluates interaction context, enforces data and account policy inline, and creates role-controlled interaction records for audit and effectiveness. Vendor terms describe service-side handling. The runtime layer describes what happened in your environment. A short demo walks through discovery of local Cowork use, real-time data classification on a live session, and the audit trail behind a single tool call.

See how Aurascape governs Claude Cowork and other desktop AI agents →