Services / Anthropic / Security and deployment
Security and deployment

What happens to your data, and where Claude runs.

Before Claude goes near company data, security, legal and IT need answers: is our data used for training, where is it stored and processed, which certifications apply, who can see what, and can we run it inside the cloud we already trust? This page gathers what Anthropic's own pages say, in one place.

Data and training →Sri Lanka and India

Anthropic is a public benefit corporation. Full compliance documentation is in its Trust Center.

Illustration of a checklist, simplified. Sample data.
In short

Six answers security teams ask for first.

Each is expanded below, with where Anthropic says it.

01Training
By default, Anthropic does not use your prompts, data or results from commercial deployments to train its models.
02Certifications
SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and CSA STAR, with GDPR and CCPA compliance and a HIPAA-ready offering.
03Residency
Choose where data is stored and processed, with regions in Asia-Pacific (including India and Singapore), Europe, Canada and the United States.
04Your cloud
Run Claude through Amazon Bedrock, Google Cloud or Microsoft Foundry, with your cloud's identity, logging, billing and commitments.
05Control
SSO, SCIM, roles, audit logs, retention controls, IP allowlisting and a Compliance API on Claude Enterprise.
06Availability
Sri Lanka and India are both on Anthropic's list of supported countries and regions.
Data and training

What Anthropic does, and does not do, with your data.

From the Enterprise, Claude Platform and model pages.

TopicWhat Anthropic says
TrainingPrompts, data and results are not used to train Anthropic's models by default. For commercial deployments of the Claude Platform, customer data is not used for training by default.
FeedbackFor Enterprise, the exception is feedback you choose to send, such as thumbs-up or thumbs-down ratings.
Safety monitoringLike all Claude services, Enterprise usage is subject to automated safety monitoring to detect misuse.
RetentionCustom data retention controls are available on Claude Enterprise.
The most capable modelsFable and Mythos require 30-day data retention for safety monitoring by default. Enterprises eligible for Enterprise Frontier Safeguards can store Fable data on their own cloud, with any human review done by the customer by default; until that rollout is complete, eligible customers get zero data retention on Fable.
Zero data retentionEnterprise Frontier Safeguards give eligible Claude Platform customers zero data retention, with safeguards for detecting misuse.
Compliance and certifications

The standards Anthropic lists.

From Anthropic's regional compliance and Enterprise pages. Certificates and reports are in its Trust Center.

01Security certifications
SOC 2 Type 2 for security, availability and confidentiality; ISO/IEC 27001 for information security; ISO/IEC 27017 for cloud security; ISO/IEC 27018 for cloud privacy; and CSA STAR.
02Privacy and regulation
GDPR, with regional processing within the EU and EEA, CCPA, and a Data Processing Addendum defining each party's roles.
03Health data
A HIPAA-ready offering for protected health information.
04Data subject rights
Support for data subject rights, retention policies and deletion.
Data residency

Where data is stored, and where it is processed.

Anthropic separates the two. Both are chosen through regional endpoints on your cloud provider.

TermWhat Anthropic says
Data residencyControls where prompts, outputs and conversation history are stored.
Inference residencyControls where Claude processes requests and generates responses.
RegionsEurope, the United States, Canada and Asia-Pacific, including Japan, South Korea, Singapore, India and Australia.
Global or regional endpointsGlobal endpoints route to regions with capacity for maximum uptime, with no price premium. Regional endpoints guarantee that storage and processing stay in the region, and may be priced to reflect regional infrastructure.
By cloudAnthropic's regional table shows Asia-Pacific included on AWS Bedrock and Google Cloud, and not included on Microsoft Foundry, when we read it.

Some advanced features vary by platform; Anthropic advises checking each cloud's feature support before you commit.

Running Claude on your cloud

Three clouds, two models of management.

On each cloud, Anthropic offers Claude either managed by Anthropic (the full Claude Platform, billed by the cloud) or managed by the cloud provider itself.

CloudWhat Anthropic says
Amazon Web ServicesThe Claude Platform on AWS, with AWS authentication, billing and commitment retirement; Claude on Amazon Bedrock, fully managed by AWS, with inputs, outputs and inference inside the AWS security boundary; and Claude Enterprise in AWS Marketplace.
Google CloudClaude managed by Anthropic, with every Claude Platform feature, Google Cloud billing and commitment retirement; or managed by Google Cloud, with Google as data processor, its governance and controls, and integrations such as Model Armor, Agent Engine and BigQuery.
Microsoft FoundryGenerally available, with Azure authentication, billing and governance, usage on your Azure invoice and eligible for your Azure Consumption Commitment. Inference can run in an Azure data zone operated by Anthropic.
Sri Lanka and India

Our two markets, stated plainly.

What Anthropic's own pages say about the two countries we work in, as we read them in November 2026.

QuestionWhat Anthropic says
Is Claude available?Yes. Both Sri Lanka and India are on Anthropic's Supported Regions Policy, which covers Claude's apps (including Claude Code and Cowork), the API and developer platform, and Claude models through cloud platforms and authorised resellers.
Who counts as supportedThe policy also turns on where an organisation is incorporated or headquartered and who owns or controls it, not only where users are. A subsidiary of a group based outside the supported list should check before it signs.
Can data stay in India?India is among the Asia-Pacific regions Anthropic names for regional data residency, through regional endpoints on your cloud provider.
Sri Lanka residencyAnthropic's pages do not name a Sri Lankan region. Sri Lankan organisations would choose a nearby Asia-Pacific region, such as India or Singapore, and should confirm that against their own regulatory obligations.

The version of the Supported Regions Policy we read takes effect on 12 November 2026. Check the current list before you commit.

Who needs this page

The people who sign off a Claude deployment.

Each has a different first question.

RoleWhat they do
CISOs and security teamsTraining defaults, certifications, audit logs, SIEM integration, IP allowlisting.
Data protection officersResidency, retention, the Data Processing Addendum and data subject rights.
Cloud and platform teamsWhich cloud, which endpoints, and how Claude fits existing IAM and VPCs.
ProcurementDirect from Anthropic, through a cloud marketplace, or against an existing cloud commitment.
LegalSupported regions, ownership rules and Anthropic's commercial terms.

© 2026 Mawkish Technologies. This guide, its diagrams and illustrations are protected by copyright. You’re welcome to learn from it and to quote it with credit and a link. Reproducing it, by hand or through AI, and publishing it as your own is not allowed. Read our copyright notice

Questions

Straight answers.

Does Anthropic train on our data?

Anthropic says that by default it does not use prompts, data or results from commercial deployments to train its models. For Enterprise, feedback you choose to send is the exception.

Which certifications does Anthropic hold?

Its regional compliance page lists SOC 2 Type 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and CSA STAR, with GDPR, HIPAA and a Data Processing Addendum. The Enterprise page adds CCPA.

Can our data stay in India?

Anthropic names India among the Asia-Pacific regions where regional data residency is available, through regional endpoints on cloud providers.

Is Claude available in Sri Lanka?

Yes. Sri Lanka is on Anthropic's Supported Regions Policy. Anthropic does not name a Sri Lankan data region, so a nearby Asia-Pacific region would be used.

Can Claude run inside our existing cloud?

Yes, on Amazon Web Services, Google Cloud or Microsoft Foundry, either managed by Anthropic and billed by the cloud, or managed by the cloud provider.

Why could you not read the Trust Center?

Anthropic's Trust Center loads in a way our research tools could not read. Everything on this page comes from Anthropic's other official pages; the Trust Center holds the certificates and reports themselves.

Checked against Anthropic's own pages in November 2026.

Across Claude

Go to another Claude page.

Claude Enterprise, the Claude Platform, Claude and Claude Code each have their own page. Visit them in any order. Choose one to go there.

You are currently viewing Security and deployment, a supporting page

Also on Claude

How it all fits together

Talk to us

Talk it through with us.

Tell us what you want Claude to do for your organisation, and we will help you work out where to start, safely.

  • Your goals, data and the systems involved
  • Claude Enterprise, the Platform, or both
  • A sensible first step

Anthropic, Claude, Claude Code and the other product names on these pages are trademarks of Anthropic, PBC. No Anthropic logo or artwork is used, and nothing here implies Anthropic's sponsorship or endorsement. Other names are the property of their owners. Screens shown are our own illustrations with sample data, not Anthropic screenshots. Product descriptions follow Anthropic's own published material and may change; check claude.com and anthropic.com for current details.

Our Gorwyn Baseline is the name we give to how we handle Claude security and deployment: one accountable partner, from the first meeting to long after go-live.

© 2026 Mawkish Technologies. This guide, its diagrams and illustrations are protected by copyright. You’re welcome to learn from it and to quote it with credit and a link. Reproducing it, by hand or through AI, and publishing it as your own is not allowed. Read our copyright notice