Is Claude Cowork safe
for client data?
Short answer: Anthropic's own safety guide advises against giving Claude Cowork access to local files with sensitive information, such as financial documents. If your firm still allows it, know that Cowork tasks now run on Anthropic's servers and files Claude opens are processed there. Use a commercial plan where policy requires it, one folder of minimal copies, Manual approval and no browsing in client sessions.
"Safe" depends on three things: what Cowork can reach, where the work happens, and what your plan and firm allow. Here is each, based on Anthropic's help articles.
What Claude Cowork can access
| Area | What Anthropic says | What to do |
|---|---|---|
| Where the work runs | Since October 6, 2026, new Pro and Max tasks run in an isolated, temporary environment on Anthropic's servers. Team plans run Cowork in the cloud by default (beta); on Enterprise, owners decide. | Treat every file Claude opens as sent to Anthropic |
| Local files | Claude reaches only folders you connect, through the Claude desktop app and only while it is open; when a task needs a file, Claude fetches a copy of that file | Connect one client folder of copies, never your whole drive |
| Sensitive files | Avoid granting access to local files with sensitive information, like financial documents, credentials or personal records | Remove anything the task does not need; use fictional or redacted data where you can |
| Deleting files | Claude asks for explicit permission before permanently deleting files, in any mode | Still work on copies and keep backups |
| Approval modes | Manual (default) asks before actions; Auto screens actions automatically; Skip checks nothing | Keep Manual for client work |
| Connectors | You choose which connectors to add; on Team and Enterprise, write-capable connector tools need approval per task by default | Prefer read-only connectors |
| Web content | Prompt injection risk is non-zero; web content is a primary route for it | Do not let Cowork browse in sessions with client files |
| Task history | Deleting a task removes it from your history right away and from Anthropic's systems within 30 days; file copies fetched for the task are deleted with it | Delete client tasks when the work is done if your policy requires it |
| Training | Pro and Max follow the "Help improve our AI models" setting; Team and Enterprise data is handled under commercial terms and isn't used for training | Use a commercial plan where policy requires it |
| Admin controls | Team and Enterprise owners can turn Cowork and cloud sessions off; organizations with HIPAA enabled have Cowork off by default | Ask IT what your plan records and allows |
What leaves your computer
Since October 6, 2026, new Cowork tasks on Pro and Max run in an isolated environment on Anthropic's servers. When a task needs a file from a folder you connected, Claude fetches a copy of that file through the desktop app, and the work on it happens in the cloud. Team plans run Cowork in the cloud by default, in beta; Enterprise owners decide whether to turn it on.
So "it runs on my desktop, so the data stays on my desktop" no longer describes Cowork. If you want tasks that run on your own computer, Anthropic points Pro and Max users to Claude Code in the desktop app. It keeps folders and history on your machine, but it still sends what it reads to Anthropic's models; see is Claude Code safe for financial data?
An eight-point checklist before using client data in Cowork
- Your firm's AI policy allows Claude, and your engagement letters do not prohibit it.
- You are on the plan your policy requires (often Team or Enterprise for client work).
- On Pro or Max, you have checked the "Help improve our AI models" setting in Settings > Privacy.
- Cowork sees one client folder containing minimal copies only.
- Account numbers, tax IDs and anything the task does not need are removed.
- Approvals stay on Manual, and connectors are read-only where possible.
- No web browsing in sessions with client files.
- Every output is checked against source totals before anyone relies on it. See how to check AI calculations.
Regulated data
On Enterprise plans that enable HIPAA, Cowork is off by default, and once the HIPAA configuration is applied to Cowork (local mode), Cowork in the cloud isn't available. Check the current articles with your IT or compliance team before using regulated data.
A lower-exposure alternative
If the same report runs every month, build a small tool with Claude Code on fictional data, then run it on real files without the AI reading them. See Cowork vs Claude Code and the Cowork bookkeeping guide.
Sources from Anthropic: Use Claude Cowork safely, Claude Cowork architecture overview, Use Claude Cowork on web, desktop, and mobile, Get started with Claude Cowork, Cowork on Team and Enterprise plans. Checked October 16, 2026; features and plans change, so confirm before you rely on them.
The Experts AI is independent and not affiliated with Anthropic, Intuit or Xero.
Frequently asked questions
Does Claude Cowork send my files to Anthropic?
Yes, the files it reads. Since October 6, 2026, Cowork tasks on Pro and Max run on Anthropic's servers, and files Claude opens through the desktop app are processed there. Folders you don't connect are not read.
Is Claude Cowork data used for training?
On Pro and Max it follows your "Help improve our AI models" setting. Per Anthropic, Team and Enterprise data is handled under commercial terms and isn't used for training.
Can Claude Cowork delete my files?
Only with your explicit permission: Claude asks before permanently deleting files, in any mode. Work on copies anyway.
Should accountants use Cowork with client data?
Anthropic itself advises against giving Cowork sensitive files such as financial documents. If your firm allows it anyway, use one folder of minimized copies, Manual approval, read-only connectors and a human check of every output.
Turn a CSV into a working cash flow dashboard.
A self-paced Claude Code workshop for bookkeepers, accountants and FP&A: six lessons, one project, sample data with expected totals. Taught by CFO Leo Godnik.
See the six lessons — $69 → Or start with the free lesson ↗