Claude Cowork Security for Financial Advisors: Client Data, Admin Controls and Audit, Plan by Plan

1. The Short Answer: Safe Enough on the Right Plan and Settings

Claude Cowork is safe enough for an RIA's client data on two conditions: the firm is on Team or Enterprise, and an admin configures it before the first advisor connects a CRM or custodian.

On those plans Anthropic does not train on your data by default, a Data Processing Addendum governs personal data, admins decide what each connector may do, and Enterprise's Compliance API can feed your archive.

Anthropic states the limits itself. Local Cowork history sits on the advisor's computer, some plugin guardrails rely on the model following instructions, and the chances of an attack are still non-zero.

Anthropic's page for financial advisors recommends Enterprise for RIAs "as it is the only plan that includes audit logs." Pro and Max, on consumer terms with no admin console, are the wrong place for client data. This guide is operational guidance; your counsel and CCO own the interpretation.

2. What Happens to Client Data When a Skill Runs

The plugin's README answers a CCO's first question: "It holds no client data: when an advisor runs a skill, Claude pulls what it needs from the connected third-party systems."

The record stays at the source. What a connector query returns enters the conversation and is kept under your firm's Claude retention settings, and that copy is what this guide is about.

Writes wait for a person. The README says "The advisor must explicitly approve any action that writes back to an external system (e.g. CRM updates, client drafts)," and Anthropic's advisor page adds that "Claude doesn't place trades or move money."

Some guardrails are structural: file-parsing subagents are allowlisted to read-only tools, and connector-reading subagents are denied shell, file-write and web tools. The rest, including advisor approval before any write, "are enforced by the model following them, not by the runtime." Admin settings put a hard limit under that soft one.

Custodians add a layer. Financial Planning reported that Schwab masks account numbers, Social Security numbers and clients' dates of birth, lets the firm activate its connector and choose which users get it, and has an agreement with Anthropic that prohibits training models on client data. Ask every connector vendor the same questions.

3. Training: The Plan Decides

Team, Enterprise and the API run on Anthropic's Commercial Terms (effective June 17, 2025), which say: "Anthropic may not train models on Customer Content from Services."

Free, Pro and Max run on consumer terms. Chats can train models unless the user opts out, and with training on, de-identified data can be kept for up to 5 years. Incognito chats never train.

Commercial plans keep one exception, triggered with a click. The Privacy Center says: "When you provide us feedback via our thumbs up / down button, we will store the entire related conversation, including any content, custom styles, conversation preferences, or model settings, in our secured back-end for up to 5 years." Explicitly reported feedback may be used for training.

So one thumbs-up on a client conversation can keep all of it at Anthropic for up to five years. Owners on Team and Enterprise can switch chat ratings off in Organization settings, Data and Privacy. Do it before the pilot.

4. How Long Client Data Is Kept, and Where

Deleted chats leave Anthropic's back end within 30 days on every plan. Enterprise owners can also set an organization-wide retention period, with a minimum of 30 days; Team cannot.

Two exceptions apply. When automated trust and safety systems flag a chat, Anthropic says: "We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years" (Privacy Center). It may also keep chats as required by law.

On covered models (Claude Fable 5 and 5.1, Claude Mythos 5 and 5.1), prompts and outputs are "retained for 30 days to support our safety work, on every platform where these models are offered" (Privacy Center). Other models, such as Opus 5.5, fall outside that rule.

Cowork adds a location. Anthropic's Cowork admin article says: "For local sessions, Cowork stores conversation history on users' computers. This data is not subject to Anthropic's standard data retention policies, and admins cannot centrally manage or delete it." On Enterprise, the Compliance API can retrieve that content, though "Deletion endpoints for local sessions aren't available yet."

Cloud sessions and their files are saved to the member's Claude account instead, and "Run Cowork in the cloud" is on by default for Team and off for Enterprise. What Anthropic stores, it stores in the United States, with no EU option for these plans.

So put every advisor laptop running Cowork on your data map. Your device controls and offboarding steps have to cover the client conversations it holds.

5. Who at Anthropic Can See Client Data

Anthropic's general statement on staff access is written for consumer plans. For Free, Pro and Max, its privacy article says employees cannot access conversations by default unless the user shares them as feedback or "Review is needed to enforce our Usage Policy."

For Team and Enterprise, the protections are mostly contractual, in the Data Processing Addendum (effective February 24, 2025), part of the Commercial Terms:

• Purpose. "Anthropic will only process Customer Personal Data to provide or maintain the Services, and in compliance with Customer's documented instructions."
• Logging. "Anthropic logs employee access and actions within Anthropic's systems, inclusive of those storing or maintaining Customer Data."

Anthropic's page on covered-model retention adds: "By default, no Anthropic personnel can read your retained conversations." Human review runs only through a controlled access path, for example when automated systems flag content, and only by "a small set of approved reviewers."

Legal process is the other route: under Section E.3 of the Commercial Terms, Anthropic may disclose confidential information when required by law or court order, and will notify you promptly unless expressly prohibited.

The widest access may sit inside your firm: the Primary Owner can export the organization's data, which may contain conversations and uploaded files. Choose that person carefully, and ask Anthropic in writing how staff access works on commercial plans.

6. The Controls Your Admin Has

The admin controls guide covers each setting. The short version, for Team and Enterprise owners:

• Connectors. An Owner enables each one, and "Enabling a connector makes it available to your team, but it doesn't automatically grant anyone access" (Help Center). Each person authenticates individually.
• Tool permissions. Per connector, read-only and write/delete tools can be set to Always allow, Needs approval or Blocked for the whole organization, and users can't override the setting.
• Cowork and approvals. Cowork is on by default. So is Allow "Automatically approve" mode, while Allow "Always allow" for connector tools starts off.
• Plugins. Owners set each plugin to Installed by default, Available to install, Required or Not available, and can turn off "User-created skills".
• Enterprise only. SCIM, custom roles, audit logs, the Compliance API, custom retention, IP allowlisting and per-user spend limits. Team gets SSO, domain verification, connector controls and OpenTelemetry for Cowork.

One Enterprise trap: when Anthropic enabled connector permissions, every existing custom role was seeded with the All connectors grant at Always allow (Help Center), and grants add up across roles. Check the older roles.

Keep Anthropic's own caveat in view: "Restricting actions in Claude never grants more access than the source system permits." A loose permission in your CRM stays loose until you fix it there.

7. Audit, Logging and Supervision Today

Three features sound like records. Only one is built to feed an archive.

• Audit logs (Enterprise). Exported from Organization settings, Data and Privacy, 180 days at a time: sign-ins, projects, files, chat creation and deletion. The help page is explicit: "Title and content of chats and projects are not available to be exported in audit logs."
• The Compliance API (Enterprise). It pulls activity events, chat data and file content, and "Cowork sessions via Claude, Claude Desktop, and Claude Mobile are captured in the Compliance API." Only the Primary Owner can switch it on (Help Center).
• OpenTelemetry for Cowork (Team and Enterprise). It streams Cowork events such as tool calls, file access and approval decisions to your SIEM, with prompts and responses off by default. Anthropic's page says: "It doesn't replace audit logging for compliance purposes."

Design around one number. For Cowork, "The Compliance API returns sessions from the most recent 30 days," so the archive must pull continuously, and a feed that fails unnoticed for longer cannot recover the oldest sessions it missed.

Smarsh Capture for Claude Enterprise, launched May 21, 2026, ingests conversations, prompts, files and activity logs through the API. Ask your archiving vendor whether it does the same.

Rule 204-2 generally requires five years of records in an easily accessible place, the first two in an appropriate office of the adviser, and the fiscal 2026 exam priorities say staff will assess policies to monitor and supervise AI use. Which outputs count as records is for your CCO and counsel.

On Team, with neither feature, records depend on people filing outputs by procedure, which is weaker. Supervision runs on the same feeds plus a written review procedure, and the audit log FAQ has the short answer.

8. Plan by Plan: What Each Plan Gives an RIA

The plugin "works on paid Claude plans," so any column can run it. Here is what each plan adds.

Prices, from Anthropic's pricing page: Team is $25 a seat monthly or $20 billed annually (premium seats $125 or $100) for 2 to 150 members. Enterprise is $20 per seat per month billed annually plus all usage at API rates, with a 20-seat minimum, so an eight-person firm pays for 20 seats.

Pro and Max fail the first row. Team clears the terms but leaves records to procedure, and Enterprise alone has a feed built for archiving; the small-RIA guide works through that trade. Choose the plan for the records you must produce, then price it.

9. The Risks That Sit With Your Firm

The contract covers Anthropic's side. The rest sits with you, as Anthropic's Cowork safety page says: "You remain responsible for all actions taken by Claude performed on your behalf."

• Prompt injection. An attack needs two things at once: "Claude can read information outside your trusted boundary, and can perform actions that could compromise the user." An outside email supplies the first and a write-capable connector the second, so Needs approval puts a person in between and Blocked removes it.
• Local files. "Avoid granting access to local files with sensitive information, like financial documents." For an RIA that means most client files, so give Claude a dedicated working folder holding only the copies a task needs. On a managed computer, "connecting local folders makes them reachable from a session in the cloud."
• Browsers and computer use. On the built-in browser and Claude in Chrome: "we strongly advise against using either to manage or take actions involving sensitive information." The built-in browser is on by default (on Enterprise since September 10, 2026), and computer use skips the permission checks that gate other Cowork tools.
• Approvals. Anthropic says to switch to Manually approve when "The task touches sensitive files, accounts, or sites," and not to schedule tasks that access sensitive files, send messages for you or are hard to undo.
• Personal accounts. An advisor on a personal Pro plan puts client data under consumer terms, outside your console and archive. Enterprise owners can stop services on the firm's verified domains from connecting to Claude accounts outside the organization. The Pro FAQ and your shadow AI checks cover the rest.

Firms that want prompts kept away from Anthropic can run Claude Desktop on third-party platforms, which on Bedrock and Google Cloud "does not send user data, prompts, or completions to Anthropic," at the cost of the Compliance API. Covered models still carry their 30-day retention there, and Anthropic says that data "stays in AWS" or "stays in GCP." The own-cloud guide weighs the trade.

10. The Paperwork: Anthropic in Your Vendor File

Regulation S-P, as amended in 2024, requires oversight of service providers, including notice from a provider within 72 hours of learning of a breach affecting customer information. Compliance dates were December 3, 2025 at $1.5 billion or more in AUM and June 3, 2026 for other SEC-registered advisers (SEC compliance guide). Anthropic belongs in that program, and the Data Processing Addendum holds most of its side:

• Breach notice. Anthropic will notify you "in any event within 48 hours, after becoming aware of any Security Breach," which fits inside Reg S-P's 72. Your policy still has to require it.
• Subprocessors. Reasonable notice before a new one, 15 days to object in writing, and a public list.
• Reports. On written request, audit reports such as the SOC 2 report, a penetration test summary, and a right to audit, generally no more than once in 12 months.
• Certifications. SOC 2 Type I and Type II, ISO 27001:2022 and ISO/IEC 42001:2023 (list), with copies and a Claude Cowork Desktop Security Architecture Overview through the Trust Portal.

Each connector vendor needs its own file, with Schwab's terms as the bar. Add your own evidence too: screenshots of connector permissions, Cowork settings, retention and the Compliance API. The vendor due diligence guide covers each document. Anthropic's papers show its side of the file; your screenshots show yours.

11. Where to Start

Work in this order. Each step is easier before advisors connect their accounts than after.

1. Choose the plan in writing: Enterprise for audit logs and the Compliance API, or Team with a written records procedure. Keep client data off Pro and Max.
2. Pick the Primary Owner deliberately. That person alone can switch on the Compliance API.
3. Turn off chat ratings in Organization settings, Data and Privacy.
4. Narrow every connector before anyone authenticates: least access, read-only where offered, write and delete tools at Needs approval or Blocked.
5. Settle Cowork: who gets it, "Automatically approve", the browsers, and cloud or local sessions.
6. Connect the archive and confirm a test Cowork session lands in it.
7. Plan for laptops: a dedicated working folder, and an offboarding step for local Cowork history and each vendor's own app or token settings. That step comes from practice; Anthropic's pages do not say what happens to a removed member's connectors or local history.
8. Open vendor files for Anthropic and each connector, and update your AI use policy.
9. Pilot for a week with two or three advisors, then recheck the archive, the approvals and the settings.

The compliance guide adds the CCO's go-live checklist.