Home / Personal data, the mandatory caution

What the organisation account guarantees, and what it does not guarantee

On an organisation account, Anthropic does not train its models on conversations, but the organisation remains solely responsible for the processing of the data it passes through it.

An Anthropic organisation account and an individual Pro or Max account open onto the same Claude interface, but they do not follow the same rules for the conversations that pass through them. Confusing the two amounts to lending an individual account a guarantee that only applies to the organisation account.

What the organisation account guarantees

On an organisation account, Anthropic declares itself a processor within the meaning of the European data protection regulation, with the client organisation remaining the controller; the data processing agreement, standard contractual clauses included, is built into the commercial terms with no separate signature, and the content of conversations is not used to train the models, unless the organisation itself chooses to join Anthropic's development partnership programme. This condition appears in the very sentence you will read at the source: quote the guarantee without it, and the third party who opens the address will see it. Recorded on 2 September 2026, addresses at the end of this lesson. This is a real guarantee, but it answers only one question, that of training. It changes nothing about what the organisation already is: the sole controller of the processing. The record of processing activities, the legal basis invoked, the impact assessment when required, and the data protection officer remain on the organisation's side. No setting in the tool replaces them.

What an individual account does not guarantee

An individual Pro or Max account follows different terms. A setting that allows conversations to improve the models exists there, and it is up to the person signed in to turn it off if they do not want their exchanges to contribute to it. The refusal itself carries an exception written into the privacy policy: a conversation flagged for a safety review, or flagged by a user, can be used for training despite the refusal. The exchanges concerned are then kept for up to two years, and the classification scores for up to seven years. No public text says what triggers this flagging, so it cannot be anticipated. Processing a sensitive document on this type of account, thinking it benefits from the same guarantees as an organisation account, therefore exposes you to a risk the organisation account does not pose in the same way. The length of time conversations are kept also differs from one account to another, and it cannot be summed up here in a single figure: it depends on the terms specific to each account and is checked directly in the open settings, or in writing with Anthropic for an organisation account.

A visual cue is not enough to settle the matter: a layout can change without warning, and getting this wrong costs on a sensitive file. The only test that holds is a written one.

Question à poser à la personne qui administre vos comptes :
« Sur quel contrat mon compte Claude est-il ouvert, un contrat d'organisation
signé par la structure, ou un abonnement personnel ? »
À conserver : la réponse par écrit, avec sa date.

The sorting of sensitive information seen in the previous lesson remains necessary even on an organisation account: the guarantee on model training exempts you from none of the questions covered in that lesson, nor from checking, before opening a sensitive file, which account the session is actually open on.