Is Claude Cowork Safe for Company Files?

Claude Cowork is safe for company files when it runs inside a Team or Enterprise workspace with the controls Anthropic provides actually switched on: it can only read the folders and connectors you give it, cloud sessions run in a temporary sandbox that is destroyed at the end, connector credentials never enter that sandbox, and on commercial plans your data is not used for training and is deleted from backend storage within 30 days of deletion. It is not safe by default on a personal account, with every connector enabled and Auto approvals on. The risk is not the product; it is the configuration and the connectors you let it reach.

This post answers the safety question plainly, from Anthropic's documentation as of October 2026: what Cowork can reach, what it sends where, how long Anthropic keeps it, which admin controls exist and what to set before staff use it. The step-by-step setup is in Claude Cowork setup and security checklist; this post does not repeat it.

What can Claude Cowork reach?

Three things, each under your control. First, connected folders: on the desktop app, Claude reads and writes local files only inside folders a user connects, per Anthropic's Cowork getting-started article. Second, connectors: Google Drive, Gmail, GitHub, Slack, Microsoft 365 and custom MCP servers, which on Team and Enterprise only owners can enable. Third, the web, where the admin's network policy allows it. It cannot reach a folder nobody connected, a system nobody connected, or (in cloud sessions) private, internal or cloud-metadata addresses, which Anthropic's architecture overview says are blocked at a mandatory proxy.

The nuance is that a connector is as broad as its scopes. The Microsoft 365 connector, for example, searches SharePoint tenant-wide and cannot be restricted to one site, with read-only delegated permissions by default and write tools that an Entra admin and an org owner must both enable. A user who can see too much in SharePoint will see too much through Claude. That is a permissions problem that existed before Cowork, and Claude Microsoft 365 connectors lists the scopes to review.

Where are company files processed?

In the cloud, by default. Each Cowork session gets its own temporary sandbox on Anthropic's servers, created at the start and destroyed at the end, with no shared state across sessions or organizations and infrastructure Anthropic describes as separate from its corporate, research and model-training environments. When a cloud session needs a file on the employee's computer, it goes through the Claude Desktop app over an Anthropic-brokered connection, limited to connected folders, with each local tool call checked against the member's permissions. Local sessions, where code ran in a VM on the device, remain only for Pro and Max tasks started before October 6, 2026.

So the honest answer to the question people are really asking (does our data leave the building?) is yes: the content Cowork works on is processed on Anthropic's infrastructure, like any cloud AI product. What you are deciding is whether the terms, the controls and the logs are acceptable for the data in question, not whether the processing stays local.

What does Cowork send where?

How long does Anthropic keep it?

On Team and Enterprise, Cowork conversation data falls under the same commercial commitments as the rest of the workspace: Anthropic's training policy article says commercial inputs and outputs are not used for training by default, and its retention article says deleted chats leave backend storage within 30 days, with exceptions: content flagged for safety review may be kept up to two years, and conversations a user rates with thumbs up or down are kept de-linked for up to five years unless an owner turns off Rate chats in Data and Privacy settings. Enterprise adds custom data retention controls; Team does not list them. Deleted Cowork tasks are removed from history immediately and from backend storage within 30 days.

Personal Pro and Max accounts follow the consumer policy, under which chats and coding sessions can be used for training and kept in de-identified form for up to five years if the user has allowed model improvement. That is the single biggest reason company files should never be processed through an employee's personal Claude account, whatever the plan.

Two regulated-data notes. Anthropic's BAA does not cover Cowork in the cloud; it covers Cowork in the desktop app only after the Primary Owner applies the HIPAA configuration on an Enterprise plan, which then turns cloud features off. And connectors, MCP servers, Claude in Chrome and Skills fall outside the BAA because data sent to third parties is outside it. Our AI tools and HIPAA post covers which products sign a BAA.

What about prompt injection?

This is the real security risk in any agent that reads content it did not write. A document, a web page or a connector result can contain instructions, and Cowork may follow them unless an approval step catches it. Anthropic's custom connector article warns that malicious servers may contain prompt injections, that server developers can change tool behavior after you connect, and that during Research Claude can invoke connector tools without further approval. The Claude Code security page adds that Anthropic reviews directory connectors against listing criteria but does not security-audit or manage any MCP server.

The defenses are the ones you would expect, and they work: Manual approvals for anything that writes or sends, read-only connectors where the product offers them, no Always allow on tools that can act, custom connectors reviewed before an owner adds them (how to review a Claude MCP connector), and a network policy that does not let the sandbox talk to arbitrary hosts. None of them proves injection is impossible; they limit what a successful injection can do.

Which admin controls exist?

• Organization toggle for Cowork, with cloud sessions switchable separately from local desktop Cowork.
• Network-access policy for cloud sessions, defaulting to none on Enterprise.
• Approval policy: admins can turn off persistent Always allow and remove the Auto option, so every permission-gated call needs a fresh human decision.
• Device requirements: trusted-device enrollment and a recent sign-in can be required for all cloud sessions.
• Connector governance: only owners enable connectors; owners can disable specific interactive tool calls, web search and Claude in Chrome.
• Device policy keys for the desktop app that disable local MCP servers and desktop extensions, pushed by MDM.
• Evidence: Cowork activity is captured in the Compliance API, an Enterprise feature, and Anthropic's architecture overview says Team and Enterprise admins can use OpenTelemetry (its Enterprise solutions page lists OpenTelemetry monitoring as Enterprise only, so confirm on your plan). Your EDR cannot see inside cloud sessions or the local VM, so this is the evidence you will have.

What should a company set before staff use Cowork?

1. A Team or Enterprise workspace with SSO, and a written rule that company files never go through personal accounts.
2. Cloud network policy decided per the data: none for a pilot on sensitive files, a short allowlist otherwise.
3. Auto approvals and Always allow off for the pilot; Manual mode as the standard.
4. Connectors enabled one at a time by an owner, read-only where possible, custom connectors reviewed.
5. A folder convention: one connected folder per task, never a root directory.
6. Rate chats disabled if five-year feedback retention is unacceptable; custom retention set on Enterprise.
7. A named person who reads the Compliance API or OpenTelemetry output monthly.

How NetSys reviews a Claude Cowork deployment

Our AI security assessment reviews a Claude deployment within an agreed scope: the identities and plan in use, which folders and connectors Cowork can reach, what each connector's scopes allow, what the approval and network settings permit, what the data terms are for the product and account you actually hold, and what the logs will show after the fact. The deliverable is a prioritized findings record with evidence, owners and the limits of each conclusion; remediation and rollout are scoped separately, and the Claude consulting service carries them out. NetSys engineers set the access and data-handling rules on a Claude deployment for a lean team before any source was connected, which is the order this post recommends.

Request a Claude deployment security review and tell us which files and connectors are in scope.

Frequently asked questions

Is Claude Cowork safe to use with confidential documents?

On a Team or Enterprise workspace, with folders limited to the matter, connectors enabled deliberately, Manual approvals and the network policy set, yes for most business confidential material. For regulated data check the BAA and retention terms first: Cowork in the cloud is outside Anthropic's BAA, and connectors are outside it in every mode.

Does Claude Cowork upload all my files?

No. It reads and writes only inside folders you connect, and only what the task needs. In cloud sessions that content is processed in a temporary sandbox that is destroyed when the session ends. It does not index your drive.

What are the main Claude Cowork security risks?

Prompt injection through documents, web pages and connector results; over-broad connectors that expose more than the user should see; approvals granted without reading; personal accounts handling company data; and third-party MCP servers that nobody reviewed. Each has a control above.

Can our EDR or DLP tools see what Cowork does?

Not inside the sandbox. Anthropic states that EDR cannot inspect activity inside the local VM and cannot observe cloud sessions. Microsoft 365 DLP policies still apply to the Microsoft 365 connector because it uses delegated permissions, and Graph calls appear in the Microsoft 365 audit log; for everything else, rely on the Compliance API and OpenTelemetry.

Is Claude Cowork enterprise security different from Team?

Enterprise adds audit logs, the Compliance API with chat and file content, custom data retention, role-based access, IP allowlisting, customer-managed encryption keys and a default of no network access for cloud sessions. Team has SSO, connector controls and spend caps. Both keep data out of training by default.