Anthropic’s Enterprise Frontier Safeguards lets your Claude logs stay in your cloud
Eight members of the Analysis and Resilience Center for Systemic Risk, a group whose roster includes the CISOs of Goldman Sachs, Morgan Stanley, Citi, Bank of America, and Wells Fargo, spent months working with Anthropic on a question their examiners care about more than benchmark scores. Scott DePasquale, the center’s president and chief executive, said those eight defined “what it would take to run the most capable frontier models inside a systemically important bank: who holds the data, who holds the keys, what automated review can and cannot see, and under what conditions a human is ever permitted to look.”
The answer arrived Tuesday. Anthropic is calling it Enterprise Frontier Safeguards. Activity data used for misuse detection can live in the customer’s Amazon S3, Azure Blob Storage, or Google Cloud Storage account, under the customer’s encryption keys, access policies, and audit logging.
When the automated systems flag something, the signal goes to the customer. Nobody at Anthropic reads it. If you run security for a regulated firm, that means the alert queue is now yours to staff.
Why the logs got kept in the first place
Zero data retention, the arrangement most regulated buyers wanted, means prompts and responses are analyzed and discarded rather than stored. Anthropic dropped it for its most capable tier starting with Fable 5 and moved to a 30-day retention window. The stated reason was detection. The company says the most sophisticated misuse spreads across many tasks, multiple sessions, and multiple accounts, so scanning each interaction on its own and deleting it immediately does not catch the pattern. Anthropic says it has never trained on enterprise data without explicit permission.
Note what the company does not claim. It says correlation requires storing data “for a meaningful period of time” without arguing that 30 days is the specific number the math demands.
That policy is what stalled the buyers. Enterprises in regulated industries understood the security argument and still could not use the models, because adding Anthropic as another trusted data vendor meant notifying their customers, reworking contracts, and satisfying internal rules about storing sensitive material.
What the monitoring is looking for
Under the new setup, automated systems analyze a rolling window of traffic for signals of serious misuse, including attempts to develop offensive cyber or biological capabilities and signs of stolen or leaked credentials. Anthropic does not say how long that window runs, which matters if you are trying to reason about what an attacker could hide by spacing activity out.
Credential theft is the case that makes the design worth understanding. Anthropic has seen misuse involving stolen or misappropriated enterprise credentials, and that category is hard to spot without watching traffic for abnormal behavior over time, because a stolen key produces requests that look ordinary one at a time. The company also points to agents autonomously engaging in destructive behavior, a failure mode distinct from a human abusing the tool.
The objection from customers was never to review itself. It was to the reviewer. Many of these firms operate under rules governing who may see privileged legal material, non-public information, or drug safety reports, and their staff are already cleared and trained for that work. Under Enterprise Frontier Safeguards, human review by Anthropic employees is not part of the loop.
What ships, and when
Anthropic says it worked with more than 100 customers on the design, spanning a quarter of the Fortune 100 and every US global systemically important bank, along with Comcast, KPMG, Mastercard, Salesforce, and Visa. That is design feedback from a self-selected group of large buyers, not a survey of the market.
“Enterprise Frontier Safeguards gives us exactly what we asked for: our logs stay in a Wells-managed environment under Wells-managed keys. We keep custody of our data while Anthropic operates the detection. That split is what lets our teams put frontier models to work safely and meet our obligations to customers, employees, and regulators. We helped shape these safeguards because our industry needs them,” said Munish Kumar Sharma, CISO at Wells Fargo.
Support is planned for Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Claude Platform on AWS, Google’s Agent Platform, and Microsoft Foundry, with equivalent controls whether you buy direct or through a cloud partner. Customer-owned storage, customer-managed encryption keys, and fully automated review are each opt-in, and none of them change model behavior, API pricing, or rate limits. Rollout happens in phases with broad availability targeted for later this fall, and eligible customers get zero data retention on Fable 5 and Fable 5.1 until their turn comes.
Anthropic charges nothing for Enterprise Frontier Safeguards. Customers who keep the data in their cloud account pay their provider for the storage, the reads, the writes, and the egress, the same way that provider bills any other resource.
