Claude
anthropic.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- No formal subprocessor register disclosed
- A no-training commitment was found: confirm its scope in writing
- Retention terms found: confirm them in writing
See Before you sign, with what to ask for ↓
Scanned Nov 1, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The vendor names AI-related providers or partially addresses its supply chain, but the public sources scanned do not include a formal, dated subprocessor register.
What to ask for: Request a dated subprocessor register with change-notification terms for the DPA/order form.
Why it matters: The sources include a no-training statement ("For the now-retired Claude 3.7 Sonnet, Anthropic stated it did not train the model on any user prompt or output data submitted by users or customers. Later model reports no longer make this statement, so it is superseded for current models.") but do not settle the question for every model, plan and data type in scope.
What to ask for: Confirm in writing that the no-training commitment covers every model, plan and data type you will use, including any opt-in sharing or feedback.
“Claude Sonnet 5.5 was trained on a proprietary mix of publicly available information from the internet, public and private datasets, and other sources, such as synthetic data generated by other models. The mix may also include user data from feedback or bug reports, or data that users have explicitly permitted for training.”
“Claude Opus 5.5 was trained on a proprietary mix of publicly available information from online sources, public and private datasets, user data, and synthetic data generated by other models.”
“We did not train this model on any user prompt or output data submitted to us by users or customers.”
“Subject to Customer’s compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs. Anthropic may not train models on Customer Content from Services.”
Why it matters: The sources describe retention ("Within 30 days of termination Anthropic deletes all copies of Customer Data held by it or its Subprocessors, subject to three carve-outs: legal/regulatory retention, dispute resolution, and combating harmful use of the Services. During the term, storage is limited to the term of the Agreement.") but not a complete window for every data type.
What to ask for: Get retention periods in writing for inputs, outputs, logs and backups, including any provider that runs the model.
“delete all copies of Customer Data (including Customer Personal Data) processed by Anthropic or any Subprocessors, except to the extent (i) Applicable Data Protection Laws or other applicable legal or regulatory requirements requires storage of the Customer Data, (ii) retention of the Customer Data by Anthropic is necessary to resolve a dispute between the parties, or (iii) retention of the Customer Data is necessary to combat harmful use of the Services.”
“Like Claude Fable 5, both models require 30-day data retention and aren’t available under zero data retention unless expressly authorized by Anthropic. See Model-specific data retention requirements .”
“We’ve expanded the Access Transparency documentation of cmek_preserve events with a filter example, an example event payload, and two preservation reason codes ( policy_violation_investigation , csae_report ). The documentation now also clarifies that a preservation event is written whether the preservation was initiated by a human reviewer or an automated safety pipeline.”
Australian Government checksdirections checked Nov 1, 2026
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
Not found in the sources this scan collected, which is not evidence the vendor has none. IRAP is an assessment, not a certificate, and there has been no public register since 2020. Ask the vendor for its IRAP assessment report and check its date, classification level and the services in scope.
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
No Australian data residency commitment was found in the sources this scan collected. Ask where inputs, outputs, logs and backups are processed and stored, and whether processing can be kept in Australia.
What your organisation still has to do
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
The Sonnet 5.5 training corpus is a proprietary mix of public internet data, public and private datasets and synthetic data, and may also include user data drawn from feedback or bug reports or data users have explicitly permitted for training. The user-data component is qualified as feedback/bug-report or explicitly permitted data, not general usage.
Requires written confirmation, see Before you sign ↓
“Claude Sonnet 5.5 was trained on a proprietary mix of publicly available information from the internet, public and private datasets, and other sources, such as synthetic data generated by other models. The mix may also include user data from feedback or bug reports, or data that users have explicitly permitted for training.”
“Claude Opus 5.5 was trained on a proprietary mix of publicly available information from online sources, public and private datasets, user data, and synthetic data generated by other models.”
“We did not train this model on any user prompt or output data submitted to us by users or customers.”
“Subject to Customer’s compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs. Anthropic may not train models on Customer Content from Services.”
!How long do they keep your data?Ask the vendor
Within 30 days of termination Anthropic deletes all copies of Customer Data held by it or its Subprocessors, subject to three carve-outs: legal/regulatory retention, dispute resolution, and combating harmful use of the Services. During the term, storage is limited to the term of the Agreement.
Requires written confirmation, see Before you sign ↓
“delete all copies of Customer Data (including Customer Personal Data) processed by Anthropic or any Subprocessors, except to the extent (i) Applicable Data Protection Laws or other applicable legal or regulatory requirements requires storage of the Customer Data, (ii) retention of the Customer Data by Anthropic is necessary to resolve a dispute between the parties, or (iii) retention of the Customer Data is necessary to combat harmful use of the Services.”
“Like Claude Fable 5, both models require 30-day data retention and aren’t available under zero data retention unless expressly authorized by Anthropic. See Model-specific data retention requirements .”
“We’ve expanded the Access Transparency documentation of cmek_preserve events with a filter example, an example event payload, and two preservation reason codes ( policy_violation_investigation , csae_report ). The documentation now also clarifies that a preservation event is written whether the preservation was initiated by a human reviewer or an automated safety pipeline.”
!Who else can access your data?Ask the vendor
Anthropic gives reasonable prior notice of new Subprocessors; customers may object on data privacy or security grounds within 15 days, after which consent is deemed given. Subprocessors are bound by contractual terms substantially as protective as the DPA and Anthropic remains liable for them.
Requires written confirmation, see Before you sign ↓
“In the event that Anthropic wishes to appoint an additional Subprocessor: (a) Anthropic will provide Customer reasonable notice of the new Subprocessor prior to giving the Subprocessor access to Customer Personal Data; and (b) Customer may, on the basis of reasonable data privacy or data security concerns, object to Anthropic’s use of such Subprocessor by providing Anthropic with written notice of the objection within fifteen (15) days of the date of such notice, or Customer is deemed to consent to the new Subprocessor.”
!Where is your data processed?Ask the vendor
The Claude API offers an inference_geo parameter to choose where model inference runs; US-only inference is available at a 1.1x price premium for models released after 1 February 2026. Inference is otherwise not pinned to a region by default.
Confirm in writing: Ask the vendor to state this in writing before signing.
“We’ve introduced data residency controls , allowing you to specify where model inference runs with the inference_geo parameter. US-only inference is available at 1.1x pricing for models released after February 1, 2026.”
“Claude in Amazon Bedrock is now open to all Amazon Bedrock customers. Claude Opus 4.7 and Claude Haiku 4.5 are available self-serve from the Bedrock console through the Messages API endpoint at /anthropic/v1/messages , in 27 AWS regions with global and regional endpoints.”
“The parties agree that, to the extent required by Applicable Data Protection Laws, the terms of the SCCs Module Two (controller to processor) and/or Module Three (processor to processor), as completed as described in Schedule 3 of this DPA, are hereby incorporated by reference and will be deemed to have been executed by the parties.”
!What happens in a security incident?Ask the vendor
Anthropic commits to notify customers in writing of a Security Breach without undue delay and in any event within 48 hours of becoming aware, and to cooperate with the customer's investigation.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Anthropic will notify Customer in writing without undue delay, but in any event within 48 hours, after becoming aware of any Security Breach, and will assist Customer in complying with Customer’s obligations under Applicable Data Protection laws by reasonably cooperating with Customer’s investigation of the Security Breach.”
“Anthropic’s incident management procedures are designed to allow Anthropic to investigate, respond to, mitigate, and notify of events related to Anthropic’s technology and information assets that process Customer Data. These incident response procedures are tested annually.”
Email to send the vendor7 items to confirm in writing
Hello Anthropic team, We are assessing Claude (Anthropic) as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 2. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 3. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 4. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 5. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 6. Please provide the current SOC 2 Type 2 report (or bridge letter) and any ISO/IEC 27001, 27701 or 42001 certificates, stating the in-scope services (Claude API, Claude for Enterprise, Claude Code), the audit period and the issuing auditor. 7. Confirm in writing that 'user data' in the Opus 5.5 and Fable 5.1 model reports excludes all Customer Content submitted under the Commercial Terms (API, Team, Enterprise), and describe which user populations and consent mechanisms it does cover. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Strong contractual baseline for commercial Claude: no training, 48-hour breach notice, defined deletionStrong
For the commercial Services (Claude API, Console, Team and Enterprise under the Commercial Terms and DPA) Anthropic commits in contract not to train on Customer Content, to notify Security Breaches within 48 hours, to delete Customer Data within 30 days of termination (with stated carve-outs), to encrypt data at AES-256/TLS 1.2+, and to annual external audits and penetration tests. Customers own Outputs and retain rights to Inputs.
These are binding, auditable commitments rather than marketing statements, and they are scoped to the commercial product that an enterprise buyer would actually contract for. They answer the training and incident questions directly in the buyer's favour.
“Subject to Customer’s compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs. Anthropic may not train models on Customer Content from Services.”
“Anthropic will notify Customer in writing without undue delay, but in any event within 48 hours, after becoming aware of any Security Breach, and will assist Customer in complying with Customer’s obligations under Applicable Data Protection laws by reasonably cooperating with Customer’s investigation of the Security Breach.”
“delete all copies of Customer Data (including Customer Personal Data) processed by Anthropic or any Subprocessors, except to the extent (i) Applicable Data Protection Laws or other applicable legal or regulatory requirements requires storage of the Customer Data, (ii) retention of the Customer Data by Anthropic is necessary to resolve a dispute between the parties, or (iii) retention of the Customer Data is necessary to combat harmful use of the Services.”
“Anthropic utilizes industry standard encryption methods for protection of Customer Data, including a minimum of AES-256 for data at rest, and TLS1.2+ for data in transit over public networks.”
“Anthropic’s incident management procedures are designed to allow Anthropic to investigate, respond to, mitigate, and notify of events related to Anthropic’s technology and information assets that process Customer Data. These incident response procedures are tested annually.”
“As between the parties and to the extent permitted by applicable law, Anthropic agrees that Customer (a) retains all rights to its Inputs, and (b) owns its Outputs.”
!No named certification with stated scope in the captured evidenceGap
The only certification language captured is the DPA's statement that Anthropic is audited annually by external auditors and will share reports 'e.g., SOC 2 report' on request, pointing to trust.anthropic.com for current certifications. The Transparency Hub capture holds only the Model Report chapter; its System Trust and Reporting chapter, where certifications would normally be listed, was not captured, and the trust centre itself is not in the stash. The RSP's reference to ISO 27001 is a statement of alignment, not certification. independent_assurance is therefore rated partial rather than not_evidenced: external audits and penetration tests are evidenced, but no certification's name, type, scope, period or issuer is.
A buyer cannot rely on an unspecified 'SOC 2 report' to satisfy third-party assurance requirements; the type (1 or 2), period, auditor and whether the API, Claude.ai Enterprise and Claude Code are all in scope must be confirmed from the actual report.
Question for vendor: Please provide the current SOC 2 Type 2 report (or bridge letter) and any ISO/IEC 27001, 27701 or 42001 certificates, stating the in-scope services (Claude API, Claude for Enterprise, Claude Code), the audit period and the issuing auditor.
“Anthropic is audited annually against known, established industry standards performed by external auditors. Upon Customer’s written request, and subject to the confidentiality obligations set forth in the Agreement, Anthropic will provide Customer with such audit reports or certificates applicable to the Services ( e.g. , SOC 2 report), to the extent available, or such other information reasonably necessary to demonstrate compliance with this DPA. Anthropic’s current certifications are available for Customer’s review at trust.anthropic.com .”
“Anthropic engages qualified external assessors for the completion of annual penetration testing of systems that process Customer Data to identify vulnerabilities and attack vectors that can be used to exploit those systems, and identified vulnerabilities are addressed as part of Anthropic’s vulnerability management program. Upon request, Anthropic will make available to Customer a summary of its most recent penetration testing report.”
“Executive Risk Council: Establish an Executive Risk Council sponsored by executive leadership to oversee security programs. Follow a risk-based approach aligned with ISO 27001 standard.”
!Retention is model-dependent: mandatory 30-day retention and no zero data retention for Fable-class modelsGap
Release notes state that Claude Fable 5, Fable 5.1 and Mythos 5.1 require 30-day data retention and are not available under zero data retention unless Anthropic expressly authorises it, implying ZDR exists for other models but is withdrawn for the most capable ones. Separately, the DPA's deletion commitment carries carve-outs for legal retention, disputes and 'combating harmful use', and the CMEK documentation shows content can be preserved for policy-violation investigation or CSAE reporting by an automated safety pipeline as well as by human reviewers.
Buyers who assume a uniform retention posture across Claude models, or who require ZDR, may find the model they want to deploy is excluded. The safety-driven preservation paths mean customer content can be retained beyond the normal window without a customer request.
Question for vendor: Which Claude models are currently eligible for zero data retention, what is the default retention window for API inputs/outputs on each, and under what criteria and for how long is content preserved under the policy_violation_investigation and csae_report reason codes?
“Like Claude Fable 5, both models require 30-day data retention and aren’t available under zero data retention unless expressly authorized by Anthropic. See Model-specific data retention requirements .”
“delete all copies of Customer Data (including Customer Personal Data) processed by Anthropic or any Subprocessors, except to the extent (i) Applicable Data Protection Laws or other applicable legal or regulatory requirements requires storage of the Customer Data, (ii) retention of the Customer Data by Anthropic is necessary to resolve a dispute between the parties, or (iii) retention of the Customer Data is necessary to combat harmful use of the Services.”
“We’ve expanded the Access Transparency documentation of cmek_preserve events with a filter example, an example event payload, and two preservation reason codes ( policy_violation_investigation , csae_report ). The documentation now also clarifies that a preservation event is written whether the preservation was initiated by a human reviewer or an automated safety pipeline.”
!Training-data wording differs across model reports and from the Commercial TermsGap
The Commercial Terms state Anthropic may not train on commercial Customer Content. The model reports describe training corpora at model level: Sonnet 5.5 and Haiku 5.5 say user data is included only from feedback/bug reports or where users explicitly permitted training, whereas Opus 5.5 and Fable 5.1 list 'user data' with no qualifier, and the retired Claude 3.7 Sonnet report said no user prompt or output data was used at all. These statements are not contradictory if 'user data' means consumer opt-in and feedback data, but the documents do not say so.
The model-level training disclosures are the ones a reviewer will quote, and the unqualified 'user data' wording could be read as including commercial usage. The commercial no-training clause should be confirmed to govern, and the scope of 'user data' in current model reports stated explicitly.
Question for vendor: Confirm in writing that 'user data' in the Opus 5.5 and Fable 5.1 model reports excludes all Customer Content submitted under the Commercial Terms (API, Team, Enterprise), and describe which user populations and consent mechanisms it does cover.
“Claude Sonnet 5.5 was trained on a proprietary mix of publicly available information from the internet, public and private datasets, and other sources, such as synthetic data generated by other models. The mix may also include user data from feedback or bug reports, or data that users have explicitly permitted for training.”
“Claude Opus 5.5 was trained on a proprietary mix of publicly available information from online sources, public and private datasets, user data, and synthetic data generated by other models.”
“We did not train this model on any user prompt or output data submitted to us by users or customers.”
“Subject to Customer’s compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs. Anthropic may not train models on Customer Content from Services.”
!Subprocessor list and processing locations not confirmable from the captured documents; no Australian residency or IRAP statement foundGap
The DPA references a subprocessor list by URL (anthropic.com/subprocessors) but the list itself was not captured, so the named recipients of Customer Personal Data are unknown from this evidence. Processing location is disclosed only as an option: an inference_geo control with US-only inference at a 1.1x premium, and 27 AWS regions with global and regional endpoints on Bedrock; inference is not region-pinned by default and the DPA relies on SCCs for international transfer. No statement of Australian data residency, IRAP assessment or Hosting Certification Framework status appears anywhere in the stash. subprocessors_and_supply_chain is rated partial rather than not_evidenced because the notice/objection mechanism, flow-down terms and the list location are disclosed; the gap is the list content.
Australian government and regulated buyers need the actual subprocessor register and a residency commitment to complete transfer impact and sovereignty assessments; a US-only option does not satisfy an in-country requirement.
Question for vendor: Provide the current subprocessor list with processing countries, state which inference geos are available (including whether an Australian or APAC region exists), and confirm whether any IRAP assessment or Hosting Certification Framework status applies to Claude services.
“In the event that Anthropic wishes to appoint an additional Subprocessor: (a) Anthropic will provide Customer reasonable notice of the new Subprocessor prior to giving the Subprocessor access to Customer Personal Data; and (b) Customer may, on the basis of reasonable data privacy or data security concerns, object to Anthropic’s use of such Subprocessor by providing Anthropic with written notice of the objection within fifteen (15) days of the date of such notice, or Customer is deemed to consent to the new Subprocessor.”
“Anthropic’s list of subprocessors is available at https://www.anthropic.com/subprocessors .”
“We’ve introduced data residency controls , allowing you to specify where model inference runs with the inference_geo parameter. US-only inference is available at 1.1x pricing for models released after February 1, 2026.”
“Claude in Amazon Bedrock is now open to all Amazon Bedrock customers. Claude Opus 4.7 and Claude Haiku 4.5 are available self-serve from the Bedrock console through the Messages API endpoint at /anthropic/v1/messages , in 27 AWS regions with global and regional endpoints.”
“The parties agree that, to the extent required by Applicable Data Protection Laws, the terms of the SCCs Module Two (controller to processor) and/or Module Three (processor to processor), as completed as described in Schedule 3 of this DPA, are hereby incorporated by reference and will be deemed to have been executed by the parties.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the scoreorganisation-level evidence60
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Version 3.2 of our RSP authorizes the LTBT to request external review of Risk Reports, gives the LTBT the power to approve our selection of external reviewers, and formalizes a requirement that we provide the LTBT with regular briefings.”
“We shared our August 2026 Risk Report . Our Risk Reports aim to provide a direct, candid, and informative description of how we see the risks of our systems and our state of preparedness for them (particularly the catastrophic risks addressed in our Responsible Scaling Policy).”
“As part of this, we reviewed how well we adhered to the framework and identified a small number of instances where we fell short of meeting the full letter of its requirements.”
“Executive Risk Council: Establish an Executive Risk Council sponsored by executive leadership to oversee security programs. Follow a risk-based approach aligned with ISO 27001 standard.”
“Users in Australia can find instructions to report non-compliance with the DIS Standard and information about the role and functions of the eSafety Commissioner here: Report a Concern: Australian DIS Standard compliance .”
Governance & accountability: vendor-evidenced, not yet independently corroborated.
AI system15% of the score60
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Claude Opus 5.5 can understand both text (including voice dictation) and image inputs, engaging in conversation, analysis, coding, and creative tasks. Claude can output text, including text-based artifacts, and diagrams.”
“Claude Opus 5 can be accessed through: Claude.ai Claude Code The Anthropic API Amazon Bedrock Google Vertex AI Microsoft Azure AI Foundry”
“Fable 5 is what lets us release those capabilities safely for general use: it pairs Mythos 5 with a number of novel safeguards that guard against harmful misuse in these areas. These safeguards are classifiers — automated screening systems that check requests for specific types of content.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“Based on our assessments, we deployed Claude Opus 5.5 with ASL-3 protections, treating it as having CB-1 capabilities. Autonomy threat model 1 is applicable to Claude Opus 5.5.”
“We worked with several external testers to get additional evidence about the difficulty of breaking our cyber classifiers. As we have done previously, these testers were pointed towards a set of example tasks that we want to ensure are blocked. They mostly tested a version of Claude Opus 4.8 with safeguards very similar to those on Claude Fable 5.”
“On a benchmark created by the AI security company Gray Swan, the UK AI Security Institute, and the US Center for AI Standards and Innovation (now called the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI)), the chance that an attacker succeeded within 15 attempts fell from 83.2% for Claude Haiku 4.5 to 7.1% for Haiku 5.5.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“We announced the deprecation of the Claude Sonnet 4.5 model ( claude-sonnet-4-5-20250929 ), with retirement on the Claude API scheduled for November 30, 2026. We recommend migrating to Claude Sonnet 5.5 . Read more in Model deprecations .”
“We’ve released API version 2026-10-21 . Migrating to API version 2026-10-21 shows how to upgrade. We’ve released new versions of the client SDKs and the ant CLI that send API version 2026-10-21 by default: Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0, and ant CLI 2.0.0.”
“Anthropic may update these Terms at any time, to be effective 30 days after the updates are posted by Anthropic or Customer otherwise receives Notice, except that updates made in response to changes to law or regulation take effect immediately upon posting or Notice. Changes will not apply retroactively.”
AI system description: vendor-evidenced, not yet independently corroborated.
Testing & evaluation: vendor-evidenced, not yet independently corroborated.
Change management: vendor-evidenced, not yet independently corroborated.
Model10% of the score60
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“Cloud computing resources from Amazon Web Services, Google Cloud Platform and Microsoft Azure, supported by development frameworks including PyTorch, JAX, and Triton.”
“Claude Sonnet 5.5 was trained on a proprietary mix of publicly available information from the internet, public and private datasets, and other sources, such as synthetic data generated by other models. The mix may also include user data from feedback or bug reports, or data that users have explicitly permitted for training.”
“Claude Opus 5.5 was trained on a proprietary mix of publicly available information from online sources, public and private datasets, user data, and synthetic data generated by other models.”
“We did not train this model on any user prompt or output data submitted to us by users or customers.”
Model provider transparency: vendor-evidenced, not yet independently corroborated.
Customer data15% of the score60
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Subject to Customer’s compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs. Anthropic may not train models on Customer Content from Services.”
“delete all copies of Customer Data (including Customer Personal Data) processed by Anthropic or any Subprocessors, except to the extent (i) Applicable Data Protection Laws or other applicable legal or regulatory requirements requires storage of the Customer Data, (ii) retention of the Customer Data by Anthropic is necessary to resolve a dispute between the parties, or (iii) retention of the Customer Data is necessary to combat harmful use of the Services.”
“Like Claude Fable 5, both models require 30-day data retention and aren’t available under zero data retention unless expressly authorized by Anthropic. See Model-specific data retention requirements .”
“We’ve introduced data residency controls , allowing you to specify where model inference runs with the inference_geo parameter. US-only inference is available at 1.1x pricing for models released after February 1, 2026.”
“Anthropic utilizes industry standard encryption methods for protection of Customer Data, including a minimum of AES-256 for data at rest, and TLS1.2+ for data in transit over public networks.”
“We’ve expanded the Access Transparency documentation of cmek_preserve events with a filter example, an example event payload, and two preservation reason codes ( policy_violation_investigation , csae_report ). The documentation now also clarifies that a preservation event is written whether the preservation was initiated by a human reviewer or an automated safety pipeline.”
“Claude in Amazon Bedrock is now open to all Amazon Bedrock customers. Claude Opus 4.7 and Claude Haiku 4.5 are available self-serve from the Bedrock console through the Messages API endpoint at /anthropic/v1/messages , in 27 AWS regions with global and regional endpoints.”
Customer data treatment: vendor-evidenced, not yet independently corroborated.
AI supply chain10% of the score40
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“In the event that Anthropic wishes to appoint an additional Subprocessor: (a) Anthropic will provide Customer reasonable notice of the new Subprocessor prior to giving the Subprocessor access to Customer Personal Data; and (b) Customer may, on the basis of reasonable data privacy or data security concerns, object to Anthropic’s use of such Subprocessor by providing Anthropic with written notice of the objection within fifteen (15) days of the date of such notice, or Customer is deemed to consent to the new Subprocessor.”
“Anthropic’s list of subprocessors is available at https://www.anthropic.com/subprocessors .”
“Cloud computing resources from Amazon Web Services, Google Cloud Platform and Microsoft Azure, supported by development frameworks including PyTorch, JAX, and Triton.”
Security foundation15% of the scoreorganisation-level evidence65
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Anthropic will notify Customer in writing without undue delay, but in any event within 48 hours, after becoming aware of any Security Breach, and will assist Customer in complying with Customer’s obligations under Applicable Data Protection laws by reasonably cooperating with Customer’s investigation of the Security Breach.”
“Contact: https://hackerone.com/4f1f16ba-10d3-4d09-9ecc-c721aad90f24/embedded_submissions/new Expires: 2026-12-31T23:59:00.000Z Preferred-Languages: en Canonical: https://anthropic.com/.well-known/security.txt Policy: https://www.anthropic.com/responsible-disclosure-policy”
“Anthropic’s incident management procedures are designed to allow Anthropic to investigate, respond to, mitigate, and notify of events related to Anthropic’s technology and information assets that process Customer Data. These incident response procedures are tested annually.”
Vulnerability & incident handling: vendor-evidenced, not yet independently corroborated.
Independent assurance evidence10% of the scoreorganisation-level evidence35
Graded from organisation-level evidence, it does not automatically establish assurance for this product.
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Anthropic is audited annually against known, established industry standards performed by external auditors. Upon Customer’s written request, and subject to the confidentiality obligations set forth in the Agreement, Anthropic will provide Customer with such audit reports or certificates applicable to the Services ( e.g. , SOC 2 report), to the extent available, or such other information reasonably necessary to demonstrate compliance with this DPA. Anthropic’s current certifications are available for Customer’s review at trust.anthropic.com .”
“Anthropic engages qualified external assessors for the completion of annual penetration testing of systems that process Customer Data to identify vulnerabilities and attack vectors that can be used to exploit those systems, and identified vulnerabilities are addressed as part of Anthropic’s vulnerability management program. Upon request, Anthropic will make available to Customer a summary of its most recent penetration testing report.”
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“The parties agree that, to the extent required by Applicable Data Protection Laws, the terms of the SCCs Module Two (controller to processor) and/or Module Three (processor to processor), as completed as described in Schedule 3 of this DPA, are hereby incorporated by reference and will be deemed to have been executed by the parties.”
“Anthropic may update these Terms at any time, to be effective 30 days after the updates are posted by Anthropic or Customer otherwise receives Notice, except that updates made in response to changes to law or regulation take effect immediately upon posting or Notice. Changes will not apply retroactively.”
“As between the parties and to the extent permitted by applicable law, Anthropic agrees that Customer (a) retains all rights to its Inputs, and (b) owns its Outputs.”
“Services under these Terms are not for consumer use. Our consumer offerings (e.g., Claude.ai) are governed by our Consumer Terms of Service instead.”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 56 → up to 76 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 2, registry checks and verification ladders, click to view
Named only as an example ('e.g., SOC 2 report') of audit reports available on written request under the DPA; report type, period, auditor and in-scope services are not stated in the captured documents. Current certifications are said to be listed at trust.anthropic.com, which was not captured.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
Sources 12, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.