What Claude sees, and what it never does.

Only the connected accounts, and only what the signed-in person can already see. A Claude for Work workspace is connected to your Google Workspace or Microsoft 365, and where useful to your accounts package and shared folders. Each connection is scoped: read-only where read-only is enough, limited to the folders and mailboxes the workflow needs.

Claude does not crawl your whole business. It does not see systems that were not connected. It sees, per request, the documents or emails relevant to what a staff member asked it to do, under that staff member's own permissions.

• Connections are made under named staff accounts, not a shared login.
• Each connection is written down at handover: what is connected, at what scope, and how to disconnect it.
• Anything not on that list is not connected.

Under Anthropic's commercial terms, which govern Claude for Work, Team and Enterprise plans and the API, Anthropic does not use customer content to train its models. That is a contract term, not a setting someone can forget to tick.

Consumer plans have different rules. That is one reason an FMOps install always uses a business plan, on your own workspace, and never staff members' personal accounts. Anthropic's privacy centre and trust centre hold the current detail on retention, security controls and certifications; I do not restate figures here that may change.

Claude drafts. A person decides. Every workflow I build that would send an email, issue an invoice, post to a customer, change a record or move money stops and waits for a named person to click approve. This is a design rule, not an option.

It also answers Article 22 of the GDPR: no decision with a legal or similarly significant effect on a person is made by automated processing alone. A machine can prepare a quote, chase an overdue invoice or draft a reply to a complaint. A person sends it.

Your emails, files and accounts stay where they are, in Google Workspace, Microsoft 365 or your accounts package, under the data-location terms you already have with those providers. A Claude install does not copy your data into a new system.

When Claude processes a request, the content of that request is handled by Anthropic under its Data Processing Addendum, which includes the standard contractual clauses used for transfers outside the European Economic Area. Before anything is connected we agree which categories of data may be used in workflows and which stay out (payroll and health data are common exclusions). That decision is written into your DPA.

If your business has a rule that certain data must never leave the EU, say so on the first call. Some workflows are still possible; some are not; I will tell you which.

• Anthropic's DPA covers what Anthropic does with your content as a processor: anthropic.com/legal/data-processing-addendum.
• FMOps signs a data processing agreement with every client covering what I do during setup and support: what I can access, for how long, that I do not copy your data, and that access is removed at handover. Read the FMOps DPA (PDF).

Both are in place before any account is connected.

At the end of setup I remove my own access to your accounts, hand you the admin role on your Claude workspace, and give you a written note of every connection and how to disconnect it. Nothing stays open in my name. If you keep the monthly, support access is granted per job and removed after, and that is logged.