Anthropic scraps its Claude data-retention mandate after enterprise pushback

On September 1, 2026, Anthropic announced Enterprise Frontier Safeguards (EFS). It replaces the mandatory 30-day activity-log retention policy Anthropic had required since June on Claude Fable 5 and Mythos 5-class models for cybersecurity and misuse defense. EFS keeps the misuse-detection goal and moves the data into the customer's own cloud account, under the customer's own encryption keys, off Anthropic's servers.

Per Anthropic, the system has three parts: automated monitoring that sends misuse signals directly to a customer's security team, storage of the activity data inside the customer's cloud account, and a fully automated review step in which no Anthropic staff view the logs. Anthropic says it won't charge for EFS; customers still pay their cloud provider for storage and data transfer. The controls apply across Claude Code, Claude Enterprise and the Claude Platform, and reach customers who access Claude through Amazon Bedrock, Google's Agent Platform or Microsoft Foundry. Rollout is phased, starting later this fall.

Built with the banks it upset

Anthropic says EFS was developed with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail and the public sector. They include the Analysis and Resilience Center for Systemic Risk (ARC), whose members include the chief information security officers of Goldman Sachs, Morgan Stanley, Citi, Bank of America and Wells Fargo. Wells Fargo CISO Munish Kumar Sharma is quoted in Anthropic's announcement: EFS "gives us exactly what we asked for: our logs stay in a Wells-managed environment under Wells-managed keys."

PYMNTS reports this as a reversal under pressure: the June retention rule drove the pushback that produced EFS. Kate Jensen, Anthropic's head of Americas, told PYMNTS the company spent "hundreds of hours" working with customers on the alternative.

A vendor's safety rationale (retaining logs to catch misuse) collided with customers' compliance requirements (data sovereignty, key control), and a public walk-back resolved it. If your security team objected to the June policy, check EFS eligibility for your plan and cloud provider, and budget for the storage costs that now land on your side.