Can I control what my staff put into Claude?

What is enforceable, and what is only a request

Most procurement conversations assume that because Claude has an admin console, an administrator can define what may and may not be typed into it. That is not how the product works. The strong controls govern the perimeter: who holds an account, which models and features that account can reach, which outside systems it can connect to, where the network request comes from, and how long the data lives afterward. The content of an individual prompt is a separate problem, and until you reach Enterprise there is no place in the product where a prompt is examined before Claude sees it.

That distinction maps onto two different incidents. The first is a person using a sanctioned account in an unsanctioned way, pasting a signed client contract into a chat that your organization owns. The second is a person using an unsanctioned account entirely, doing the same thing from a personal login at home. Product controls are far better at the second than the first, which is the opposite of what most buyers assume when they ask this question.

Team and Enterprise are both commercial plans, and both are a real improvement over five people paying for Pro individually. But they are not close to equivalent on governance. Anthropic's roles and permissions article groups single sign-on, audit logs, and data retention controls under a heading it labels Enterprise plan only. If your reason for buying is that you are accountable for a data incident, that heading is the whole decision.

• ·Available on Team and Enterprise: organization instructions, set by Admins and above; enabling or disabling native integrations, custom integrations, capabilities, and public projects, restricted to Owners and Primary Owners; member and role management; organization plugin marketplaces; organization data exports, which Anthropic's export article restricts to the Primary Owner
• ·Enterprise only, per the roles and permissions article: manage single sign-on and auth, request audit logs, manage data retention controls, manage feedback settings
• ·Enterprise only, per their own support articles: inference hooks, Tenant Restrictions, IP allowlisting, domain claiming and migration, the Compliance API, connector domain restriction, group-level plugin access, model access and default model settings, custom roles and groups, customer-managed encryption keys
• ·Not available on any plan as a product setting: a rule that blocks a specific word, client name, or file from being pasted. The closest thing is inference hooks, and that is a server you write and operate yourself

The controls that actually enforce something

Inference hooks is the only Claude feature that inspects content before the model sees it. Anthropic describes it as letting your compliance team inspect and enforce policy on every prompt, tool call response, and uploaded file text before it reaches Claude. Your server answers allow or deny, and Claude only continues once it has that answer. It is available in beta to Enterprise plans, can be turned on by Owners and Primary Owners, and covers Claude, Claude Code, Cowork, and other Claude Enterprise products, including tool calls made through skills, plugins, and connected tools. Because the check happens inside Claude's infrastructure, it does not depend on anything installed on employee laptops.

Read that honestly before you put it in a board memo. It is a beta, and it requires your team to build, host, secure, and keep running an endpoint that sits in the path of every prompt your company sends. That is an engineering project with an availability requirement, not a toggle. It is also the answer to the literal question on this page, so if enforcing content rules is genuinely the requirement, this is the feature to scope and budget rather than hope a checkbox appears.

Tenant Restrictions is the control that stops personal accounts from working on your network. Available to Enterprise plans and Console organizations, it has your network proxy inject an anthropic-allowed-org-ids header listing approved organization UUIDs, and Anthropic blocks access from any organization not on the list, returning a 403 with error code tenant_restriction_violation. It covers web, desktop and app access, API key auth, and OAuth token auth. It requires TLS inspection and a proxy you control, so this is a network team deliverable, not a Claude setting. Anthropic caps the allowlist at 500 organization UUIDs across a maximum of ten header lines.

The rest of the enforceable set is worth configuring on day one rather than after an incident, and several of these are not on by default.

• ·IP allowlisting, Enterprise only: every authenticated request is validated against your configured CIDR ranges and blocked if it does not match. You cannot self-serve this. Anthropic asks you to compile your ranges, including office locations and VPN exit points, and send them to your Anthropic contact or sales team, and warns that omitting a range can lock users out
• ·Custom data retention, Enterprise only, Owner or Primary Owner: minimum period is 30 days, deletion happens at midnight UTC, and deleted data cannot be recovered. The default matters more than the setting. Anthropic states that by default data is retained indefinitely unless a custom period is set. Also note that changing the setting deletes anything outside the new window immediately on save
• ·Rate chats, under Organization settings then Data and Privacy: turns off the thumbs up and thumbs down buttons for your organization. Anthropic's commercial retention article says it keeps data associated with a feedback submission for 5 years, so leaving this on quietly extends retention on any conversation someone rates
• ·Public projects: Owners and Primary Owners can disable them for the organization, which removes one way an internal project becomes shareable outside it
• ·Plugins: for a hard block, set the plugin's organization-wide preference to Not available. Anthropic is explicit that group-level plugin access resolves to the most permissive setting across a member's groups and that groups here are not meant to act as a security boundary
• ·Model access, Enterprise only, managed by Primary Owners, Owners, or a custom role with Identity and Access: each model is enabled or disabled for the whole organization, and disabling one removes it for every member including Owners and Admins. Note the floor Anthropic builds in. Haiku models are always available and cannot be disabled, so you can narrow which models staff use but you cannot leave them with none

The account you do not own is the whole problem

The realistic version of the incident you are worried about does not happen in your organization. It happens in a personal Pro account, on a personal laptop, on home wifi, at nine at night, because the work was due. No setting inside your admin console reaches that account, because that account is not yours. Every honest answer to this question has to start there, and this is where the Team and Enterprise gap gets expensive.

Enterprise can claim the domain. Anthropic's domain claiming article lets Enterprise admins discover, claim, and migrate existing personal Free, Pro, and Max accounts on a verified company domain into the Enterprise workspace. The prerequisites are real: restrict organization creation on the verified domain, complete DNS domain verification, actively enforce single sign-on rather than merely configure it, and enable JIT or SCIM provisioning. Enabling domain capture is described as a one-way door that cannot be reversed. Affected users get 30 days, on a single organization-wide deadline, to merge and join or join fresh, after which remaining personal accounts are deactivated. Anyone not in your identity provider gets locked out, so the IdP work has to finish first.

Team cannot do that. Anthropic states directly that Team plans can verify a domain and block new personal accounts from being created, but admins cannot claim or migrate existing accounts. People on Team can migrate their own personal account voluntarily. If your staff have been using Claude on personal logins for a year, which in a 200-person firm they almost certainly have, Team gets you a clean future and leaves the existing accounts exactly where they are.

Enterprise has one more narrowing control worth knowing, and Anthropic's own limits on it are the most useful part. The connector domain restriction setting, available to Owners, Primary Owners, and custom roles with Identity and Access set to Manage, stops Claude accounts outside your Enterprise from connecting services like Gmail, Slack, Google Drive, Microsoft 365, Notion, HubSpot, and Atlassian using an email address on your verified domains. Anthropic then tells you plainly what it does not do, and those four sentences belong in your risk register.

• ·It does not restrict the other direction. People in your Enterprise can still connect personal accounts to their work Claude account
• ·It does not replace data loss prevention. Anthropic calls it a safeguard against accidentally connecting a work account to the wrong Claude account, not a control against deliberate data movement
• ·It does not disconnect existing connections. Anything connected before you turned it on stays connected
• ·It does not notify admins. Only the person whose connection failed sees the message
• ·It fails open. Where the restriction cannot be evaluated because the service does not share account identity, Anthropic allows the connection rather than blocking it

What an administrator can see, and who holds that key

Visibility and control are different questions, and the answers land in different places. Audit logs are Enterprise only. Owners and Primary Owners export them from Organization settings then Data and Privacy using the Export logs button, which aggregates the past 180 days and emails a link that stays live for 24 hours. The important limit is stated in the article: title and content of chats and projects are not available in audit logs, only their unique identifiers. Audit logs tell you that a file was uploaded, a conversation was created, or a document was added to a project knowledge base. They do not tell you what was in it. Also note that if your Enterprise organization uses customer-managed encryption keys, the Export logs button does not work and audit events come through the Compliance API instead.

Content lives in two other places. Organization data exports include conversation data, and Anthropic's export article says they are available only to Team and Enterprise Primary Owners, with no self-serve export for individual members. The Compliance API, generally available to Claude Enterprise plans excluding Public Sector organizations, pulls activity feed events, chat data, and file content across your Claude deployments so you can run it through your own tooling. Coverage for Cowork and for Claude Code via CLI and Claude Desktop is in beta, and Anthropic excludes Claude Code on web, Claude Code accessed through the Claude Platform, and sessions run on Amazon Bedrock or Google Vertex AI.

Incognito chats are not a hiding place on a commercial plan, and staff assume otherwise. Anthropic states that on Team and Enterprise, incognito chats are included in organizational data exports, are included in the Compliance API on Enterprise, and are retained for 30 days by default or longer in line with your organization's retention setting. Tell people this before rollout rather than after. Anthropic even publishes an article aimed at the employee, titled Who owns and manages the data of my team, which says the Primary Owner manages the account and all associated data and can request access to user data through data exports that may contain conversations, uploaded files, and usage patterns. Send that link to staff. It is a better disclosure than anything you will write, and it is Anthropic saying it rather than you.

Two places where Anthropic's own documentation disagrees with itself, both of which matter here because they concern who can read your employees' conversations. Verify against your own organization settings rather than trusting either page, including this one.

• ·Who can export conversation content: the roles and permissions table lists Request data exports under Primary Owner only, and the Export your organization's data article says exports are only available to Primary Owners. The incognito chats article says incognito chats are included in organizational data exports available to account Owners. Owners and Primary Owners are different roles in this product, and the difference decides who holds the key to staff chat content
• ·Who can change feedback settings: the roles and permissions table lists Manage feedback settings under a heading marked Security and Data Controls, Enterprise plan only. The dedicated article is titled Manage user feedback settings on Team and Enterprise plans and says a Primary Owner or Owner of a Team or Enterprise plan can manage it. If you are on Team and want the 5-year feedback retention turned off, go look for the toggle rather than concluding from one page that you do not have it
• ·A related gap rather than a contradiction: the Enterprise retention article states the default is indefinite, while the commercial privacy article on how long organization data is stored never states a default period for saved Claude for Work conversations. On Team, where there is no retention control at all, you cannot determine your own retention period from the documentation. Ask for it in writing before you sign, and ask again at renewal

Write these down before anyone gets a seat

Because most of what you can enforce is perimeter and most of what governs content is policy, the policy is doing the heavy lifting whether you like that or not. It only works if people have read it, which means it has to be short, specific to your business, and written in your vocabulary rather than in generic privacy language. A five-page document nobody opened is worse than a one-page document everybody did, because it creates a paper record of a control that is not operating.

Start by knowing what Anthropic already requires, because it is not your policy and it does not mention your clients. The Usage Policy applies to anyone who can submit inputs to Anthropic's products or services, including through resellers or passthrough access. Anthropic states that its Safeguards Team implements detection and monitoring to enforce it, and that it may throttle, suspend, or terminate access for violations. That is a floor on conduct, not a control on confidentiality.

One part of that policy catches mid-market service businesses off guard. Anthropic's High-Risk Use Case Requirements name legal, healthcare, insurance, finance, employment and housing, academic testing and admissions, and media or professional journalistic content published for external consumption. For those uses, Anthropic requires that a qualified professional in the field review the content or decision before it is finalized or distributed, and that you disclose to individuals or consumers that you are using AI to help produce advice, decisions, or recommendations, at a minimum at the start of each session. If you run a clinic, an insurance agency, a law firm, an accounting practice, or a staffing company, you are inside that list. Read it and decide who signs off before the first seat is provisioned.

Organization instructions are worth setting and worth not overselling. Admins and above on Team and Enterprise can set instructions Claude follows in every conversation, up to 3,000 characters, taking up to an hour to propagate, and taking precedence over an individual's own instructions. Anthropic's own caveat is the honest part: instruction prioritization relies on prompt-level instructions, and in rare edge cases involving directly contradictory instructions, behavior may vary. Notice too that Anthropic's own example data-handling instruction asks Claude to keep customer names and account numbers out of responses and generated artifacts. That shapes what Claude writes. It does nothing to stop a person from typing an account number in.

• ·Which plan and which organization every single person uses, and a flat statement that company work does not go into a personal account. Name the consequence, and name who checks
• ·A category list of what may never be pasted, written in your words. Chart notes. Signed contracts. Payroll and benefits files. Bank and routing details. Anything under an NDA that names the counterparty. Generic references to sensitive data will not survive a busy Tuesday
• ·The redaction rule, who performs it, and a standing instruction to escalate rather than scrub when a workflow only becomes useful with real client data in it. That escalation is the signal that you need a different surface, not a better scrubber
• ·Which connectors and integrations are approved, and an explicit acknowledgment that enabling one sends data to a third party under that party's terms rather than yours
• ·Who can read staff conversations, under what circumstances, and who authorizes it. Put the Primary Owner in by name and title, and say what happens when that person leaves
• ·Your retention period and what it means for your discovery and records obligations, or a plain note that you are on Team and do not have one
• ·Where the high-risk review and disclosure requirements apply to your actual services, who performs the review, and what the client-facing disclosure says
• ·A review date. Every control described on this page is documented on a page Anthropic has revised recently, and several are labeled beta today

What people ask next

• What should our AI policy actually say?
• How much does Claude cost for a team?
• We already have Microsoft Copilot. Why would we add Claude?
• How do I roll out Claude to my whole team?

Worked examples