Claude Cowork in Your Own Cloud: What Bedrock, Google Cloud and Foundry Change for an RIA

1. The Short Answer: Yes on Bedrock and Google Cloud, With Trade-Offs

Claude Cowork can run through your firm's own Amazon Bedrock or Google Cloud account. Anthropic's Cowork page offers the choice in one line: "Use a Claude account or your own cloud provider: Amazon Bedrock, Google Cloud, or Microsoft Foundry."

On Bedrock and Google Cloud, Anthropic's documentation says the app sends no user data, prompts or completions to Anthropic. For a CCO worried about Anthropic holding client data, that is the strongest answer on offer, with one model caveat in section 3.

You give up the connectors labeled Made by Anthropic, the claude.ai admin console, the Compliance API that archiving tools such as Smarsh plug into, and early access to new features. The audit trail becomes a job for your own IT team.

Microsoft Foundry needs a closer read, because neither of its two hosting options runs inference in your Azure tenant. This guide is operational guidance, and your CCO and counsel own the interpretation.

Moving the model call is the easy part. The real work is rebuilding what Anthropic used to run around it.

2. What Own Cloud Means Here

Anthropic calls it Claude Desktop on third-party platforms, or 3P. Its overview describes a deployment mode that "routes all model inference through a provider you configure," with inference and billing "handled by the provider you choose."

The providers are Google Cloud's Agent Platform, Amazon Bedrock, Microsoft Foundry, a compatible gateway you operate, or the Anthropic API directly. This guide covers the first three.

It is the same app. One binary serves both modes, and Anthropic says the 3P mode "keeps the standard feature set and relocates inference to the provider you configure." A device management (MDM) profile decides which mode each laptop runs, so a firm without MDM has nowhere to start.

The two modes, side by side:

Read down the gold card and mark each line where work moves from Anthropic to your firm. The rest of this guide is about those lines.

3. Where Client Data Goes, Provider by Provider

In the overview's words, "The app sends prompts, responses, files, and tool outputs only to your configured inference endpoint," and conversation history is stored on the user's device. Then it depends on the provider:

• Amazon Bedrock and Google Cloud. Inference runs in your cloud provider account, and for data residency the provider "processes conversation data in the region you select." For these two, the docs say: "Claude Desktop on 3P does not send user data, prompts, or completions to Anthropic."
• Microsoft Foundry, Hosted on Azure. Inference runs "in an Anthropic-operated service on Azure infrastructure," which the docs place "not in your Azure tenant."
• Microsoft Foundry, Hosted on Anthropic. Prompts and completions go to Anthropic's own infrastructure. On either Foundry option, use of Claude is subject to Anthropic's data use terms.
• A gateway you operate. The app talks to your gateway, and the path behind it is yours to document.

Two other paths can reach Anthropic. By default the app sends crash reports and product analytics, with no prompt or response content, until admins switch them off (telemetry and egress docs). The remote Microsoft 365 connector also connects to a service Anthropic hosts, so count it as an Anthropic path if you use it.

The model you pick adds one caveat. Anthropic designates Claude Fable 5 and 5.1 and Claude Mythos 5 and 5.1 as covered models, whose prompts and outputs have been "retained for 30 days to support our safety work, on every platform where these models are offered" since June 9, 2026. On Bedrock, "Retention will need to be enabled to access covered models, and retained data stays in AWS"; on Google Cloud's Agent Platform, "retained data stays in GCP," and Anthropic says the same applies to Cowork on either platform (Privacy Center, Help Center).

So picking Fable means turning on 30-day retention in your cloud account, while other models, such as Opus 5.5 and Sonnet 5.5, are unaffected. Anthropic's pages do not say who reviews retained data on those clouds, so ask in writing before client work runs on a covered model.

Draw this path, telemetry and connectors included, and keep it in your vendor file. Where client data goes should fit on one page.

4. What You Give Up

Here is the other side of the ledger:

• Connectors Made by Anthropic. Connectors with that label "are hosted on Anthropic infrastructure and are available only in standard Claude Desktop," according to the extensions docs.
• The claude.ai admin console. It does not manage these deployments, which run on MDM and files. Map each console setting your CCO relies on (the admin controls guide lists them) to your own configuration, or record that it has none.
• The Compliance API and Smarsh capture. Anthropic's Compliance API page says the API does not cover sessions on Amazon Bedrock or Google Vertex AI, and Smarsh Capture for Claude Enterprise is built on that API. For Foundry sessions, ask Anthropic in writing.
• Feature timing. Standard Claude Desktop "releases new features more quickly than Claude Desktop on 3P."
• Mutual TLS. MCP servers that require mutual TLS client certificates fail to connect.

Most items on that list move a job from Anthropic to someone at your firm. Name that person before anyone signs a cloud order.

5. Connectors and the Advisor Plugin

Every directory connector stays available except those labeled Made by Anthropic. Admins can add remote MCP servers for everyone with the managedMcpServers key, and the extensions docs say "Any MCP server reachable from the user's device over HTTPS works." Sign-in tokens sit on each device, in the operating system's secure storage, which makes laptop offboarding part of the job.

Plugins arrive through a marketplace, which Anthropic recommends hosting as a git repository or a file over HTTPS, through a system-wide directory on each device, or from users themselves. Admins can disable that user layer, and a CCO will usually want it off.

Anthropic's Claude for Financial Advisors plugin holds no client data. Per its README, "when an advisor runs a skill, Claude pulls what it needs from the connected third-party systems." Two checks come before any rollout:

• Support for this mode. Anthropic's advisor page says "The plugin works on paid Claude plans." Ask Anthropic in writing whether that covers a third-party platform deployment.
• Each connector, one by one. Check its directory label, since Made by Anthropic rules it out here, and ask the vendor whether its connector supports this mode. The connectors guide lists the systems the plugin reads.

A plugin with half its connectors missing is a slow way to write a meeting note. List the connectors first and choose the mode second.

6. Your Audit Trail Becomes Your Job

On standard Enterprise, the Compliance API gives your archive a ready-made records path. On your own cloud, you build it.

Anthropic's telemetry docs point you to an OpenTelemetry collector you run, set with the otlpEndpoint key, and call that export "the recommended way to retain an audit trail in environments that disable Anthropic-bound telemetry." Three details matter:

• Content is off by default. The export includes session metadata "but not message content." Prompts and responses need otlpContentCapture, which turns your collector into a system that holds client data.
• Failures are silent. "If the collector refuses requests or cannot be reached, the app keeps working, shows no error," and the affected batches are dropped. Alert when events stop arriving.
• Retention is yours to build. Under Rule 204-2, required records generally stay five years in an easily accessible place, the first two in an appropriate office of the adviser. A collector only receives events; keeping and producing them is the archive's job.

On the standard plans, Anthropic says its OpenTelemetry feed for Cowork "doesn't replace audit logging for compliance purposes" (Help Center). Here it is the audit trail you have, so run it like a records system, with a named owner, alerts for gaps and a retention schedule your CCO signs.

Ask your archiving vendor whether it can take data from your collector. Which prompts and outputs count as required records is a call for your CCO and counsel, and the compliance guide covers the rules.

The SEC's fiscal 2026 exam priorities say staff will assess firms' policies and procedures for monitoring and supervising their use of AI. A collector that quietly stopped in March is hard to explain in October.

7. Who It Suits

This mode fits a firm that already has the pieces. Check four:

• A cloud agreement. Your firm already runs on AWS or Google Cloud under terms your vendor program has reviewed.
• Device management. Laptops are enrolled in MDM, because the MDM profile is how the mode is configured.
• An IT owner. A named person, on staff or at a managed service provider, who owns the profile, MCP servers, marketplace and collector.
• A data policy that calls for it. A written rule that limits which providers may process client data, or in which region.

An RIA or multi-family office with its own IT team and an existing AWS or Google Cloud footprint is the clearest fit. A Microsoft shop should reread section 3 first, because both Foundry options run in a service Anthropic operates.

Your vendor file changes shape. The cloud provider now processes the prompts, so treat it as a service provider under Regulation S-P, whose oversight requirements include notice from the provider no later than 72 hours after it becomes aware of a breach affecting customer information (SEC compliance guide).

Anthropic stays in the file for the app, its telemetry and any connector it hosts. Ask its Trust Portal for the Claude Desktop Security Overview (Third-party platforms), and use the vendor due diligence guide for the rest.

If all four checks pass, the pilot in section 10 is worth running. If one fails, close that gap first or stay on the standard plan.

8. Who Should Stay on Standard Enterprise

Most small RIAs. If your firm has eight people and IT is part of the COO's week, the extra work in this mode lands on someone who already has a full job.

Stay on standard Enterprise if any of these is true:

• You want the Compliance API and an off-the-shelf archive feed such as Smarsh Capture.
• Your advisors need connectors labeled Made by Anthropic.
• Your CCO relies on the console's controls: connector tool permissions, Cowork approval settings, plugin install preferences and Enterprise roles.
• Nobody at your firm manages laptops through MDM.
• You want new features as soon as they ship.

Anthropic points the same way twice. Its third-party docs say "standard Claude Desktop with Cowork on a Team or Enterprise plan is simpler to deploy," and its advisor page recommends Enterprise for RIAs "as it is the only plan that includes audit logs."

Team has neither the audit log export nor the Compliance API, so records there depend on procedure, which is weaker. The small-RIA guide weighs that trade.

For most firms this size, an archive feed that works on day one is worth more than keeping the model call in your own account.

9. The Cost Shape

The bill moves. Inference and billing are handled by the provider you choose, so model use shows up on your cloud provider's invoice.

For comparison, Anthropic's pricing page lists Enterprise at $20 per seat per month billed annually plus all usage at API rates, with a 20-seat minimum. For a firm under 20 people, that is $4,800 a year in seats before any usage. Team costs $20 per standard seat or $100 per premium seat a month, billed annually, with no Compliance API.

Anthropic's docs state no plan requirement or status label for the third-party mode. Before you build a budget, confirm licensing and support terms with Anthropic and your cloud provider, in writing.

The larger cost is people: someone, on staff or at a managed service provider, has to build and maintain the MDM profile, MCP servers, marketplace, collector and archive feed, and retest them when the app updates.

Count the hours before you compare the invoices.

10. A Pilot Plan

Pilot with two or three people and one provider, in this order:

1. Get terms in writing on licensing and support from Anthropic and your cloud provider.
2. Pick one provider, one region and your models. A covered model such as Fable means enabling 30-day retention first.
3. Build the MDM profile for the pilot group: an advisor, an operations lead and, ideally, the CCO.
4. Set telemetry on purpose. Point otlpEndpoint at your collector, decide on otlpContentCapture with your CCO, and switch off operational telemetry if your policy requires it.
5. Connect only what the pilot needs: managed MCP servers over HTTPS, each connector's label checked, each internal system tested for mutual TLS, and plugins from your marketplace with the user layer off.
6. Break the collector on purpose. Stop it for an hour and confirm your monitoring notices, because the app will show no error.
7. Check where traffic goes. Have your network team confirm the app reaches your endpoint and no destination you did not expect.
8. Run a week of real work, then compare the archive against the sessions people actually ran.

The happy path proves little. The pilot proves its worth on the day the collector goes quiet and someone notices.

11. Where to Start

Settle the question on paper before anyone opens a cloud console.

1. Write down the reason. Name the policy, client requirement or risk that makes your own cloud worth the extra work. If nobody can, stay on standard Enterprise.
2. Ask both vendors in writing about licensing, support and, if you want Fable, who reviews covered-model data.
3. List your connectors and check each label and each vendor's support.
4. Design the records path with your CCO: content capture, collector, storage and archive.
5. Then run the pilot, or take the standard route with the settings in the admin controls guide.

Either way, the Cowork security guide and the vendor due diligence guide cover what your CCO will ask next.