Is Claude Code safe for a business? What it can reach and what you control
Last updated: November 12, 2026
TL;DR
Claude Code is safe enough for business use when three things are set on purpose: the plan your developers sign in with, the permission mode their sessions start in, and the limits an administrator locks in managed settings. Left at the defaults, Claude Code can reach whatever the developer's account can, a classifier model approves most actions instead of a person, and the sandbox is off.
- 📄 The plan decides where your code goes. Under Team, Enterprise or the API, Anthropic doesn't train on Claude Code data and keeps it 30 days. On Pro or Max with model improvement turned on, it trains on it and keeps it five years.
- 🤖 The mode decides who approves. Since version 2.1.283, interactive sessions start in auto mode by default, where a separate classifier model reviews actions before they run.
- 📦 The sandbox decides what a command can touch. It's off by default. Without it, a shell command you approve can write anywhere your user account can.
- 🔒 Managed settings decide what a developer can't change. A deny rule set there can't be allowed anywhere else.
What Claude Code can reach on a developer's machine
Claude Code runs as the developer, with the developer's access. Anthropic's security docs describe four kinds of reach, each with a check in front of it.
| What it can reach | The check in front of it | Where the check stops |
|---|---|---|
| Files | In Manual mode, its file tools ask before reading or writing outside the folder where it started | "a Bash command you approve can still write anywhere your user account can" |
| The shell | In Manual mode, commands outside a built-in read-only list need approval or an allow rule | An approved command runs with your account's permissions |
| The network | curl and wget aren't auto-approved by default. Web pages arrive as a separate model's summary for most fetches | An allow rule for Bash(curl *) lets every curl command run |
| MCP servers and connectors | Servers in a project's .mcp.json have their own approval prompt | Anthropic reviews directory connectors against listing criteria but "does not security-audit or manage any MCP server" |
Credentials get better treatment than files: Claude Code stores API keys and tokens in the macOS Keychain where it can, and on Linux in a file only the user can read, per the same docs. A .env file in the repository is just another file unless a deny rule covers it.
The folder boundary is a prompt, not a wall. Anthropic says so directly, and points to the sandbox for a limit the operating system enforces.
Where your code goes
Every prompt, and every file or command output Claude reads into the conversation, goes to the model provider, encrypted in transit with TLS 1.2 or later, per Anthropic's data usage docs. What happens next depends on the terms the developer signed in under.
| Account | Trains on Claude Code data | Anthropic keeps it |
|---|---|---|
| Free, Pro, Max or Ultra, model improvement on | Yes | 5 years |
| Free, Pro, Max or Ultra, model improvement off | No | 30 days |
| Team, Enterprise or API | No, unless the organization opts in | 30 days |
| Enterprise with zero data retention | No | No server-side persistence |
The row that catches businesses is the first one. A developer who runs Claude Code on client code from a personal Pro account is under consumer terms, not yours. Zero data retention isn't part of the standard Enterprise plan: Anthropic's account team turns it on per organization after confirming eligibility.
Three copies sit outside that table. Claude Code keeps session transcripts on the developer's machine in plaintext under ~/.claude/projects/ for 30 days by default. Transcripts sent with /feedback are kept five years. Saying yes to the optional "Can Anthropic look at your session transcript" question uploads source code as-is, kept up to six months. Usage metrics never include code, prompts or file paths, per the same docs.
For what Anthropic keeps from Claude chats rather than Claude Code sessions, see our Claude data privacy guide.
Who approves each action
Since Claude Code 2.1.283, interactive terminal and VS Code sessions start in auto mode by default on every plan and provider, per Anthropic's permission modes docs. In auto mode, a separate classifier model reviews each action and blocks anything that "escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read." Anthropic's own warning on the same page: auto mode "does not guarantee safety."
| Mode | What runs without asking |
|---|---|
Manual (default) | Reads only |
acceptEdits | Reads, file edits and common filesystem commands |
auto | Everything, with a classifier reviewing in the background |
dontAsk | Reads in the working directories and pre-approved tools. Anything else is denied |
bypassPermissions | Everything. Anthropic says it's for isolated containers and VMs only |
Two things hold in every mode, bypassPermissions included: deny rules block, and no mode auto-approves a tool matched by an explicit ask rule. Set those rules where a developer can't remove them, and the mode matters less.
Security fixes from November 2026
Three fixes from early November 2026 set the minimum version worth running: 2.1.321 or later covers all of them. Auto-update keeps a team there.
- Account email in User-Agent headers. Claude sometimes copied a signed-in user's email address into the User-Agent of commands it wrote. The Claude Code team confirmed the cause on November 6, 2026, and version 2.1.317 added a check that asks first. Our write-up has the versions.
- A race in the Edit tool. GHSA-5xjx-9qx6-jcrv, published November 9, 2026, covers a case where code already running inside the macOS sandbox, such as a malicious dependency script, could make the Edit tool overwrite a file outside the workspace. It was fixed in 2.1.251.
- Fixes in 2.1.321. The changelog entry of November 9 stops MCP OAuth requests from sending secrets such as refresh tokens to another host on a redirect, and closes a case where a read-only Bash command ran outside the sandbox without a prompt.
The email case carries a design lesson for any agent setup. Version 2.1.234 had already told the model not to send the address to unrelated services, and that instruction didn't hold. The check that held runs outside the model, which is the same reason team rules belong in settings rather than in prose.
The settings a business controls
Managed settings are the layer a developer can't change. Anthropic's permissions docs say that if a tool is denied at any level, no other level can allow it. These are the controls worth setting there first.
| Risk | Control | Setting |
|---|---|---|
| Code going out under consumer terms | Put developers on Team, Enterprise or the API, not personal plans | Your plan, plus SSO |
| Someone running with no checks | Block bypassPermissions | permissions.disableBypassPermissionsMode: "disable" |
| A classifier approving instead of a person | Turn auto mode off, or set the starting mode | permissions.disableAutoMode: "disable", or permissions.defaultMode |
| Secrets read into a session | Deny reads of secret files | Read(./.env), Read(./secrets/**) in permissions.deny |
| Commands reaching past the project | Turn on the sandbox, and stop sessions where it can't run | sandbox.enabled: true, sandbox.failIfUnavailable: true |
| Writes outside the project | Refuse file-tool writes outside the working directories | permissions.blockWritesOutsideWorkingDirectories: true |
| Not knowing what ran | Send usage to your own collector | OpenTelemetry monitoring |
The sandbox needs one more decision on Windows. It runs on macOS, Linux and WSL2, and Anthropic's sandbox docs say native Windows runs commands unsandboxed. Without failIfUnavailable, an unsupported machine falls back to running commands with no sandbox at all.
For the hooks that turn a team rule into a check, see our Claude Code hooks guide. For where each rule belongs, see Claude Code best practices for a team.
Frequently asked questions
Is Claude Code safe to use on company code?
Yes, when developers sign in under Team, Enterprise or the API, where Anthropic doesn't train on Claude Code data and keeps it 30 days. On a personal Pro or Max account with model improvement on, Anthropic trains on it and keeps it five years. Set permission and sandbox limits in managed settings too.
Does Claude Code train on my code?
Not under commercial terms. Anthropic's data usage docs say it doesn't train on code or prompts sent to Claude Code by Team, Enterprise, API or cloud-provider customers unless the organization opts in. On Free, Pro, Max and Ultra, it trains on that data when the model improvement setting is on.
Can Claude Code access files outside my project?
Yes, through commands. In Manual mode its file tools ask before reading or writing outside the folder where it started, but Anthropic's security docs say a Bash command you approve can still write anywhere your user account can. Turn on the sandbox for a limit the operating system enforces.
What is auto mode in Claude Code?
Auto mode is the permission mode where a separate classifier model reviews each action instead of you, blocking anything that goes beyond your request or looks driven by hostile content. Since Claude Code 2.1.283 it's how interactive sessions start. Anthropic says it doesn't guarantee safety.
Is the Claude Code sandbox on by default?
No. Anthropic's sandbox docs say it's off by default, and you turn it on with /sandbox or in settings. It runs on macOS, Linux and WSL2. Native Windows runs commands unsandboxed, and an unsupported machine falls back to no sandbox unless sandbox.failIfUnavailable is set.
Can developers override company Claude Code settings?
Not managed settings. Anthropic's permissions docs say a tool denied at any level can't be allowed at another, so a deny rule in managed settings holds against personal settings and command-line flags. An administrator can also block bypassPermissions and auto mode there.
Which Claude Code version should a team run?
Version 2.1.321 or later. It includes the November 2026 security fixes: the 2.1.317 check on account emails in User-Agent headers, the Edit tool fix from 2.1.251 disclosed as GHSA-5xjx-9qx6-jcrv, and 2.1.321's fix for MCP OAuth secrets sent on redirects. Keep auto-update on.
Does Claude Code store my code locally?
Yes. Claude Code keeps session transcripts in plaintext under ~/.claude/projects/ for 30 days by default so sessions can resume, per Anthropic's data usage docs. The cleanupPeriodDays setting changes the period. Transcripts of sessions last continued in Claude Desktop or Cowork are exempt from that limit by default.
Get Claude Code set up properly for your team
We set up Claude Team for small businesses: the seat plan, the security settings, shared Projects and skills written from your actual processes, and managed Claude Code settings for teams with developers. If you'd rather have it done once and done right, see how our Claude Team setup works or book a 30-minute call.
Stop guessing. Score your first workflow.
Score one workflow in about five minutes. Nine questions, a grade, and the specific gap holding it back - no call required.
Related Posts
Claude Code sandbox: what it stops, what it doesn't, and when to use a container
How to set up the Claude Code sandbox: turn it on with /sandbox, prove it works, allow only the hosts and paths a build needs, block credential reads, close the unsandboxed retry, and know when a container is the better boundary.
Claude Sheets, Whiteboards and Data: the admin defaults to check
Anthropic launched Claude Sheets and Whiteboards in beta on November 10, 2026, and renamed Claude Dashboards to Claude Data. What's already on for Team plans, what Enterprise turns on November 19, why live sharing is the setting to read first, and where to change it.
Claude Code best practices for a team: what to write down and what to enforce
Claude Code best practices for a team: what belongs in CLAUDE.md, which rules to enforce with hooks, deny rules and managed settings, how to scope them, and how to measure a pilot.