How do I keep Social Security numbers out of Claude?

Take them out before the file or text reaches Claude. Redact them with a real redaction tool or replace them with placeholders like XXX-XX-XXXX. A system prompt, project instructions, or a CLAUDE.md file can’t do it, because by the time Claude reads the instruction the file has already been sent to Anthropic. To skip the manual work, put a PII cleaner in front of Claude or run the AI on a server in your office.

Does Claude train on what I upload?

On Free, Pro, and Max plans, Anthropic trains on your chats and Claude Code sessions if the model improvement setting in your privacy settings is on, and can keep that data for up to 5 years. With it off, a chat you delete is removed from Anthropic’s systems within 30 days. Anthropic says it doesn’t train on Team, Enterprise, or API data unless the customer opts in.

Does a CLAUDE.md file stop Claude Code from sending sensitive files?

No. CLAUDE.md is guidance for the model, not a block. Claude Code sends your prompts and whatever it reads to Anthropic. Read deny rules in settings.json, such as Read(./clients/**), stop Claude’s file tools from opening a path, but Anthropic calls them best-effort and they don’t cover scripts that open files themselves. The safest choice is to keep real client data out of the folders Claude Code works in.

How to keep Social Security numbers out of Claude

Short answer

Take the SSN out before Claude sees it. Black it out with a real redaction tool, or swap it for a placeholder like XXX-XX-XXXX. A system prompt, project instructions, or a CLAUDE.md file can’t do this for you: by the time Claude reads “don’t look at SSNs,” the file is already on Anthropic’s servers. Turning off training doesn’t stop storage either. If you don’t want to rely on staff catching every number by hand, run the scrubbing, or the AI itself, on a computer in your office.

Why “ignore the SSNs” doesn’t work

An instruction only changes what Claude does with a file after Anthropic already has it. When you upload a W-2, the whole file goes to Anthropic first, and Claude reads your instructions after that. Claude Code works the same way: Anthropic’s docs say it sends your prompts and the model’s outputs over the network, and that includes the contents of every file it opens. A line in CLAUDE.md that asks it to skip clients/ is a request to the model. Nothing in Claude Code enforces it.

What Anthropic keeps

	Free, Pro, Max	Team, Enterprise, API
Trains on your chats	Yes, if model improvement is on in Privacy settings	No, unless your company opts in
How long it’s kept	Until you delete the chat, then up to 30 days. Training copies up to 5 years if model improvement is on	Chats until you delete them, then up to 30 days. API data up to 30 days
Chats flagged for a safety review	Kept up to 2 years	Kept up to 2 years
Zero data retention	No	By agreement, for qualified accounts

Sources: consumer retention and commercial retention (both updated July 1, 2026), and the Claude Code data usage page, checked October 30, 2026. Terms change; check them before relying on this table.

Five ways to keep SSNs out

Redact before you upload. Use the redact tool in your PDF editor, which deletes the text. Drawing a black box over it often leaves the number in the file, and Claude reads that text. Claude also reads text in scans and photos, so check those and your spreadsheets too. Do the same for bank account and routing numbers.
Use placeholders. Replace each SSN with XXX-XX-XXXX, or with SSN_1, SSN_2 if Claude needs to tell people apart. Claude can still work on the amounts and dates.
Turn off model improvement. On Free, Pro, and Max, switch it off in your privacy settings. That stops training on your chats. Anthropic still stores them, keeps a deleted chat for up to 30 days, and keeps a flagged one for up to 2 years.
Move to a business plan. Team and Enterprise don’t train on your data by default. Your files still go to Anthropic and sit there for the retention period. Zero data retention is a separate agreement you ask Anthropic for.
In Claude Code, block the folder. Add a deny rule such as Read(./clients/**) to your settings.json. Anthropic calls these rules best-effort: they don’t cover a script that opens files itself or a search across the whole folder. Turn on the sandbox for a hard block, and keep real client data out of the folders Claude Code works in.

Some things you should never paste in at all: card numbers and CVVs, passwords, and API keys.

The catch: people miss things

Each of these steps only works if someone remembers to do it on every file. In tax season, one busy staff member uploads a W-2 they forgot to scrub, and that SSN is now on Anthropic’s servers. You can change a password after a leak, but a Social Security number is very hard to change. For tax preparers, sharing return information without consent can also break Section 7216.

Or run your own AI

If you’d rather not count on people catching every number, you have two options:

Keep Claude, clean the files first. Our PII Cleanser is a small computer in your office. It swaps every name, SSN, and account number for a placeholder before the question goes to Claude, and puts the real values back in the answer. The table that links them never leaves your office.
Skip the cloud. A private AI server runs an open model in your office, so nothing goes to Anthropic or anyone else. Ours start from $40,000.

See what Claude would see

Bring a few sample files with fake names and numbers. We’ll show you what the Cleanser removes and what comes back.

Book a call How the Cleanser works

This page is general information, not legal or tax advice. Claude and Anthropic are trademarks of Anthropic; On Premises is not affiliated with Anthropic. See our Terms for how site content should be read.

Last updated: October 30, 2026