Recently I was baffled when Claude code read the customer table data from a production environment, while triaging an issue, and that made me wonder. Sure you should NOT give the access to read the prod data but does it sounds practical in the real time debugging session?
Ask HN: How companies are protecting Claude Code from reading IP and PII data
1–7 of 7 posts
Re: Ask HN: How companies are protecting Claude Code from reading IP and PII data
#2Our take has been that if you are working with one of these large companies, you cannot expect anything to be private. We've worked with a smaller more focused product where we were able to negotiate the necessary controls
Re: Ask HN: How companies are protecting Claude Code from reading IP and PII data
#3Sign an enterprise agreement that speaks to data retention and destruction requirements. Part of what you pay for is to shift the liability to the inference vendor.
Re: Ask HN: How companies are protecting Claude Code from reading IP and PII data
#4Sign an enterprise agreement that speaks to data retention and destruction requirements. Part of what you pay for is to shift the liability to the inference vendor.
These data retention contracts are black boxes; you never know how your IP was leaked, and it could end up in the model's training data. It's like trusting META with your privacy settings.
Re: Ask HN: How companies are protecting Claude Code from reading IP and PII data
#5Our take has been that if you are working with one of these large companies, you cannot expect anything to be private. We've worked with a smaller more focused product where we were able to negotiate the necessary controls
And what are those necessary controls?
Re: Ask HN: How companies are protecting Claude Code from reading IP and PII data
#6Sign an enterprise agreement that speaks to data retention and destruction requirements. Part of what you pay for is to shift the liability to the inference vendor.
These data retention contracts are black boxes; you never know how your IP was leaked, and it could end up in the model's training data. It's like trusting META with your privacy settings.
A contract satisfies our infosec program and cyber insurance requirements, confirmed by a corporate legal team. Our role is to manage enterprise risk and potential exposure within our risk appetite, not eliminate it.
(already minimizing sensitive data storage and transit whenever possible, as an entity operating in a regulated industry)
Re: Ask HN: How companies are protecting Claude Code from reading IP and PII data
#7Our take has been that if you are working with one of these large companies, you cannot expect anything to be private. We've worked with a smaller more focused product where we were able to negotiate the necessary controls
And what are those necessary controls?
Either it needs to run on our hardware, or we need explicit contractual guardrails around use of the data for their purposes. Obviously anything you give Anthropic etc. is going into their training pipeline for instance, and they change their terms of use every week so it's impossible to work with as a small company with no leverage