Claude Vendor Due Diligence for RIAs: The Anthropic Documents to Request and What Each Proves

1. The Short Answer: What the Vendor File Holds

A vendor file for Anthropic is the folder that shows you checked the company behind Claude before your advisors put client data into it, and that you keep checking.

It holds three kinds of evidence:

• Anthropic's documents. Seven of them, listed in section 3.
• Anthropic's written answers. Replies to the questions those documents leave open.
• Your own evidence. Dated proof of how your firm configured Claude, plus the policy, training and review records around it.

The first two describe Anthropic. Only the third shows what your firm switched on, and nobody at Anthropic can write it for you.

Every connector vendor needs a file too. This guide is operational guidance; your counsel and CCO own the interpretation, and the Cowork security guide covers the wider picture.

2. Why Regulation S-P Makes the File Required

Regulation S-P, as amended in 2024, requires policies and procedures for overseeing service providers that touch customer information. That oversight has to include notice from the provider no later than 72 hours after it becomes aware of a breach affecting customer information, and affected individuals generally have to hear from you within 30 days (adopting release).

Every SEC-registered adviser is past its compliance date: December 3, 2025 for advisers with $1.5 billion or more in assets under management, and June 3, 2026 for the rest (SEC compliance guide).

Client information reaches Anthropic as soon as advisors use Claude on real work. When a skill runs, Claude pulls what it needs from connected systems (README), and what comes back enters the conversation under your firm's retention settings.

So treat Anthropic as a service provider, and every connector vendor as another. Cowork run through your own Bedrock or Google Cloud account sends prompts to that provider instead (see the own-cloud guide).

There is no standalone SEC rule on AI, but the fiscal 2026 exam priorities say staff will assess firms' policies to monitor and supervise their use of AI.

When an examiner asks how you oversee Anthropic, hand over the file. One built before go-live answers the question; one assembled the week of the exam raises the next.

3. The Documents to Request and What Each Proves

Seven documents come from Anthropic, three of them public and the rest through Anthropic's Trust Portal or on written request. The eighth comes from you.

Read the last column as your follow-up list: each gap becomes a written question to Anthropic (section 7) or evidence your firm produces (section 9).

4. Reading Anthropic's SOC 2 Report as an RIA

Anthropic lists "SOC 2 Type I & Type II" on its certifications page. A Type I report describes how controls were designed at one point in time; a Type II adds the auditor's testing of whether they worked across a period. Ask for the Type II.

Four parts carry what an RIA needs, described here in general terms; read your copy of Anthropic's report against them.

1. The period covered. A Type II report tests a stated window. Note the end date, and if many months have passed, ask what covers the gap.
2. The scope. The system description says what the auditor examined: Anthropic's service as Anthropic runs it. Your SSO, connector permissions and advisors' laptops sit outside it. Check that the products your firm uses are in scope, and compare any suppliers the report carves out with the subprocessor list.
3. Exceptions. Where testing finds a control that failed, the auditor records an exception, often with management's response. Weigh each by what it touched; one in staff access to customer data deserves a written question.
4. Controls the customer must run. Most SOC 2 reports list complementary user entity controls, the things the vendor assumes each customer does, such as deciding who has access. Copy the list into the file and name an owner for each item.

A clean report tells you Anthropic's controls held up during the window the auditor tested. Everything on your side of the line is yours to evidence.

5. What the Commercial Terms and DPA Commit Anthropic To

The Commercial Terms cover Team, Enterprise and the API, and the Data Processing Addendum is incorporated into them (Section C). Pro and Max run on consumer terms, so nothing below protects client data in an advisor's personal account (more on Pro).

What the two documents commit Anthropic to:

• Training. "Anthropic may not train models on Customer Content from Services." The exception is feedback: per the Privacy Center, a thumbs up or down stores "the entire related conversation" for up to 5 years, and explicitly reported feedback may be used for training. Owners can switch chat ratings off under Organization settings, Data and Privacy.
• Confidentiality. "Customer Content is Customer's Confidential Information."
• Instructions. Anthropic "will only process Customer Personal Data to provide or maintain the Services, and in compliance with Customer's documented instructions."
• People. Staff who process your personal data owe "an appropriate duty of confidentiality," access is least-privilege and role-based, and "Anthropic logs employee access and actions within Anthropic's systems, inclusive of those storing or maintaining Customer Data."
• Legal process. Anthropic may disclose confidential information when the law or a court order requires it, and will notify you promptly unless expressly prohibited (Commercial Terms, Section E.3).
• Subprocessors. "Reasonable notice" before adding one, and 15 days for you to object in writing.
• Audits. Reports or certificates "(e.g., SOC 2 report)" on written request. You may also audit Anthropic's controls at your own expense, generally no more than once in 12 months unless there has been a breach or a regulator requires it.
• Testing. "Upon request, Anthropic will make available to Customer a summary of its most recent penetration testing report."

If an examiner ever wants more than the reports, read the audit right's regulator carve-out with counsel. A contract records promises; the rest of the file shows you checked them.

6. The 72-Hour Test: Anthropic's 48-Hour Breach Notice

Anthropic's breach notification promise is shorter than the window Regulation S-P asks you to get from service providers. The DPA says: "Anthropic will notify Customer in writing without undue delay, but in any event within 48 hours, after becoming aware of any Security Breach."

The notice then describes the breach, the categories and approximate numbers of people and records affected where reasonably possible, the likely consequences and the measures taken.

Reg S-P requires your service-provider oversight to include notice no later than 72 hours after the provider becomes aware of a breach affecting customer information. Both clocks start at the provider's awareness, so 48 hours fits inside 72 with a day to spare. Three things still sit with your firm:

• The policy. Your policies and procedures have to require the notice from every service provider and route it into your incident response program, which has its own deadline for telling affected individuals, generally 30 days.
• The inbox. Ask Anthropic which contact on your account receives the written notice, and make sure someone reads that address, with a backup.
• The definitions. "Security Breach" is a defined term in the DPA, and the rule has its own trigger. Ask counsel to compare them once and record the answer.

Anthropic's 48 hours covers Anthropic alone; each connector vendor needs its own commitment. The DPA leaves you 24 hours of margin, and your procedure decides whether anyone uses them.

7. Questions to Put to Anthropic in Writing

The documents leave five questions open. Send them as a short security questionnaire, and file the written replies beside the documents.

1. When can Anthropic staff see our data? For consumer plans, the Privacy Center says employees cannot access conversations by default, except through the user's feedback or a Usage Policy review. Anthropic publishes no equivalent sentence for Team or Enterprise, where the protections are contractual. Ask for that answer in writing, including how flagged chats, kept for up to 2 years, are handled (short answer).
2. What stays on advisors' laptops? The Cowork help page says: "For local sessions, Cowork stores conversation history on users' computers. This data is not subject to Anthropic's standard data retention policies, and admins cannot centrally manage or delete it." Ask what is stored, how to protect it, and how to remove it when an advisor leaves.
3. How do we keep the archive complete? On Enterprise, Cowork sessions are captured in the Compliance API, but "The Compliance API returns sessions from the most recent 30 days," and "Deletion endpoints for local sessions aren't available yet." Ask how a failed pull would show up, and confirm your archiving vendor pulls continuously.
4. Where is our data stored? Anthropic stores data for these plans in the United States, with no EU storage option. Get that in writing, along with where subprocessors process it.
5. Which connectors does Anthropic host? Anthropic's documentation says connectors labeled "Made by Anthropic" are hosted on Anthropic infrastructure. Ask which of yours fall in that group, since the answer decides whose file covers that connector's traffic.

An answer you cannot find in writing later is an answer you never got.

8. One File per Connector Vendor

Every connector adds a second company to the chain. When a skill runs, Claude queries that vendor's system, so the vendor handles your client data too and needs its own file.

Schwab shows what good answers look like. Financial Planning reported that Schwab masks account numbers, Social Security numbers and clients' dates of birth, lets the firm activate its connector firm-wide and choose which users connect, and has an agreement with Anthropic prohibiting training models on client data.

Ask every other vendor the same things (the connectors guide shows what each one brings):

• What can the connector read and write, and is there a read-only option?
• Which sensitive fields do you mask before data reaches Claude?
• Can we switch it on for the firm and choose which users connect?
• Do your terms, or your agreement with Anthropic, prohibit training models on our client data?
• Who notifies us of a breach within 72 hours, and how?
• How do we revoke a user's access in your own app or token settings?

Your controls in Claude sit on top: owners can set each connector's read-only and write/delete tools to Always allow, Needs approval or Blocked. As Anthropic's help center puts it, "Restricting actions in Claude never grants more access than the source system permits," so a loose permission at the vendor stays loose.

Already keep a file on your custodian or CRM vendor? Add a Claude connector section to it. The count is simple: Anthropic, plus one file per connected system.

9. Your Own Evidence

Only your firm can produce this part. Start with dated screenshots of the settings that decide what Claude can reach:

• Connector permissions. Each connector's Tool permissions under Customize, Connectors. On Enterprise, add each role's Connectors tab: every existing custom role was seeded with the All connectors grant at Always allow when Anthropic enabled connector permissions (Help Center).
• Cowork settings. Organization settings, Cowork: who has Cowork, and under Permissions, Allow "Automatically approve" mode (on by default) and Allow "Always allow" for connector tools (off by default). Add the Run Cowork in the cloud setting, on by default for Team and off for Enterprise.
• Retention and ratings. Your retention period (Enterprise allows a custom one, minimum 30 days) and the chat ratings switch under Organization settings, Data and Privacy.
• Records. On Enterprise, the Compliance API switched on by the Primary Owner, and proof that a test Cowork session reached your archive. Team has neither audit log exports nor the Compliance API, so file the written procedure for capturing records by hand and note that it is weaker. Anthropic says OpenTelemetry for Cowork, on both plans, "doesn't replace audit logging for compliance purposes."

Then add the paper around the settings: the AI use policy addendum naming Claude, the approved connectors and who approves writes; training records; and a signed, dated annual review of the file.

Anthropic can send you seven documents. The eighth, proof of what your firm switched on, exists only if someone at your firm captures it.

10. Keeping the File Current

A vendor file describes Anthropic on the day you built it. Four things should reopen it:

• The annual refresh. Request the newest SOC 2 report and certificates each year, read the new period and exceptions, and check the Commercial Terms and DPA for new effective dates.
• Subprocessor notices. You have 15 days to object in writing, so name the person who reads each notice inside that window.
• Product changes. Defaults move. On Enterprise, the built-in browser has been on by default since September 10, 2026 unless an owner turned it off. A change like the September 16, 2026 merge of Cowork and chat should send you back to the settings in the admin controls guide.
• Your records. On Enterprise, export the audit log more often than every 180 days, since each export covers only the past 180 days, and check that the archive still pulls inside the Compliance API's 30-day window.

A file last opened at go-live describes a version of Claude your advisors no longer use.

11. Where to Start

Work in this order:

1. Confirm in writing that client work runs on Team or Enterprise.
2. Save the Commercial Terms, the DPA and today's subprocessor list.
3. Request the SOC 2 Type II report, ISO certificates, penetration test summary and Cowork architecture overview.
4. Read the SOC 2 for period, scope, exceptions and customer controls.
5. Send Anthropic the five questions in section 7.
6. Open a file for each connector vendor before its connector goes live.
7. Capture your configuration evidence and add the 48-hour notice to your incident response procedure.
8. Calendar the annual refresh and name who reads subprocessor notices.

The compliance guide covers the rest of the CCO's go-live list.