Client data checklist
for using Claude.

By The Experts AI editorial team · Written with AI assistance · Updated October 21, 2026

Short answer: Run these 15 checks before client data goes into Claude, Claude Code or Cowork: rules and contracts, the right account and settings, the minimum data, human review and cleanup. Print the page or keep it with your firm's written information security plan. It is a working checklist, not legal advice.

Print this checklist Why each check matters →

Before you start

• Your firm's AI policy allows this tool for this kind of client work.
• Your engagement letter or client contract allows outside service providers for the task.
• If you prepare US tax returns, the AI provider is in your written information security plan and is chosen, contracted and reviewed like other service providers (16 CFR 314.4(f)).
• If tax return information is involved, you have asked your adviser whether section 7216 requires the client's written consent.
• If you are an AICPA member, you have checked the confidentiality rule (ET 1.700.001) and the Code's guidance on third-party service providers.

Account and settings

• You sign in with your firm's commercial account (Team, Enterprise or API), not a personal Free, Pro or Max login.
• If your policy requires zero data retention, Anthropic has enabled it for your Claude for Enterprise organization. It does not cover chat or Cowork.
• Claude Code runs in Manual or plan mode, and never in bypassPermissions on a machine with client files.
• Local transcript retention is shortened with cleanupPeriodDays, and with desktopSessionCleanupPeriodDays if you use Claude Desktop or Cowork.

Data

• You tested the workflow on fictional data with known totals first.
• Files hold only what the task needs: no Social Security numbers, full account numbers or other clients' data.
• Each client's files sit in their own folder or project.

Review and cleanup

• A person checks every result against source totals before it reaches a client, a return or the books.
• Nothing is sent, posted, filed or paid without your approval.
• When the work ends, local data is removed with claude purge and the tool's review is recorded in your security plan.

Sources: Anthropic's Claude Code documentation on data usage, zero data retention and permission modes; the FTC Safeguards Rule; IRS Publication 5708 and Alert 2026-19. Checked October 21, 2026. The reasons behind each check are in is it safe to use Claude Code with client financial data?

Frequently asked questions