Anthropic
Claude 3.7 Sonnet
v3.7 · frontier · Released February 24, 2025
Updated August 26, 2026
Claude shared chats containing sensitive personal and health data were indexed by Google, creating an unresolved data exposure concern for enterprise deployments. Until Anthropic confirms remediation and revised data handling controls, the model cannot retain a GREEN designation.
Enterprise guidance
Claude 3.7 Sonnet is Anthropic's primary enterprise-ready model and the recommended continuity option for organizations whose workflows depended on Fable 5 or Mythos 5. The API does not use your prompts to train models by default. For regulated industries, use Claude for Enterprise or AWS Bedrock, which include data processing agreements, HIPAA Business Associate Agreements, and zero data retention.
Data handling
Default data retention
Transient for API (no persistent storage of prompts for training); Enterprise: zero by default
Zero-retention available
YesVia: Claude for Enterprise; AWS Bedrock; Google Cloud Vertex AI
API data used for training
NoAnthropic does not train on API customer data by default. Claude.ai free tier: Anthropic may use conversations to improve models unless opted out in settings.
GDPR Data Processing Agreement
AvailableHIPAA Business Associate Agreement
AvailableClaude for Enterprise; AWS Bedrock
Data residency options
US (default); EU available via AWS Bedrock eu-west regions
Vendor compliance certifications
Key use restrictions
- —No CSAM or sexual content involving minors
- —No content facilitating mass casualty weapons (biological, chemical, nuclear, radiological)
- —No tools designed for non-consensual surveillance or stalkerware
- —No content designed to undermine legitimate AI oversight mechanisms
- —No cyberweapons intended to cause significant damage to critical systems
Safety documentation
Claude Model Specification published and regularly updated. Constitutional AI methodology published in peer-reviewed research. Responsible Scaling Policy (RSP) published with safety commitments. Extensive safety research papers and alignment work publicly available.
Safety documentation →Related governance resources
Governance controls
AI Vendor Due Diligence
Assess AI vendors against security, governance, and compliance criteria before procurement and at defined intervals during the vendor relationship.
AI Contractual Requirements
Set minimum AI vendor contract terms for data handling, transparency, audit rights, and incident notification.
AI Procurement Risk Assessment
Assess technical, legal, privacy, and operational risks before approving an AI system or service purchase. Document the findings.
Third-Party AI Model Evaluation
Evaluate third-party AI models against defined performance, safety, and bias criteria before deploying them in enterprise workflows.
Vendor Safety Commitment Verification
Check whether vendors honor published safety commitments, voluntary pledges, and contractual duties throughout the relationship.
Playbook guides
How do we ensure third-party AI vendors meet our standards?
Review AI vendors for model transparency, data handling, bias testing, and contractual liability for their outputs.
How do we maintain data privacy compliance when using AI?
Review training data sources, data minimization, cross-border transfers, and applicable explanation duties under GDPR and CCPA.
How are we managing third-party AI risks?
Govern external AI APIs and models embedded in vendor software. Review data handling, documentation, and ongoing monitoring.
Status history
August 26, 2026· green to yellow
The confirmed indexing of Claude shared chats by Google, including sensitive personal and health data, constitutes an unresolved data residency and exposure concern under the YELLOW criteria. No government action is required for this threshold; the exposure event itself is sufficient to trigger the flag.