{"resourceId":"claude-covered-models-30-day-retention-fable-5-2-20261109","versions":[{"version":"external-23ada14a25958fac79d7ed037512748613e7a32a2b3d4884db88fdab838f4411","resource":{"id":"claude-covered-models-30-day-retention-fable-5-2-20261109","title":"Claude Help Center: Covered Models (now incl. Fable 5.2) require 30-day retention on every surface; ZDR only via limited eligibility or EFS","organization":"Anthropic","sector":"AI platform vendor / privacy policy","geography":"Global","publishedAt":"Undated help article; lists Fable 5.2 (launched Nov. 9, 2026)","publicationDate":null,"eventDate":"2026-11-09","sourceName":"Claude Help Center","sourceLabel":"Vendor policy documentation","sourceUrl":"https://support.claude.com/en/articles/15425695-covered-models","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","governance-procurement","infrastructure"],"finding":"Anthropic's Covered Models policy, which now names Claude Fable 5.2 alongside Fable 5.1 and 5, requires prompts and completions to be retained at least 30 days on every surface, including Amazon Bedrock, Google Cloud Agent Platform and Microsoft Foundry, and states ZDR is not available where covered models are accessed. Retained data is reviewed by automated safety systems. Enterprise Frontier Safeguards, rolling out in phases from fall 2026, lets eligible customers keep monitoring data in their own cloud; eligible customers also get time-limited ZDR as a transition. The linked retention article says human review occurs only via a controlled, logged path.","sledRelevance":"Interpretation: this is the controlling document for state, local, HHS and campus privacy reviews of Fable 5.2. Agencies with ZDR commitments in contracts, public-records retention schedules, or CJIS/HIPAA constraints must decide whether 30-day vendor or cloud-held retention is acceptable or keep using non-covered Claude models. Retained prompts may also raise public-records questions.","evidence":"Vendor policy text listing covered models, surfaces, retention period, review mechanism and EFS transition; separate article describes per-surface configuration (e.g., Bedrock retention data stays in AWS; Azure requires a separate subscription).","architectureImplications":"Interpretation: ZDR-configured organizations need separate retention-enabled workspaces, accounts or Azure subscriptions to use covered models, which complicates tenancy and logging design.","governanceImplications":"Interpretation: privacy officers should document a decision per workload: stay on non-covered models, accept 30-day retention, or pursue EFS/ZDR eligibility.","securityPrivacyImplications":"Retention creates a data store subject to breach risk and legal process; Anthropic cites a documented security program and tamper-proof access logs for human review.","caveats":"Undated; the listing of 5.2 implies a Nov. 9 update but the page shows no revision date. Vendor policy, not an independent audit. Cross-tagged state-government and health-human-services because 30-day retention affects records, CJIS, HIPAA and Medicaid data handling decisions.","streamIds":["anthropic","state-government","health-human-services"],"roles":{"sales":"Frame this as the privacy-review document buyers will ask for. Anthropic's policy now lists Fable 5.2 as a covered model with at least 30-day retention on every platform, with ZDR only for eligible customers or via Enterprise Frontier Safeguards. Ask privacy officers which workloads have ZDR or records commitments. Offer a bounded data-handling decision workshop. Do not claim ZDR is available or that retention satisfies CJIS or HIPAA by itself.","engineering":"Engineering should design for two retention classes. Prerequisites: separate retention-enabled workspaces or cloud accounts for covered models, clear routing so ZDR-bound data never reaches them, and logs proving which model handled each request. Constraint: the policy applies on Bedrock, Vertex and Foundry too. Proof of value: test routing rules that block ZDR-bound data from covered models and confirm retention settings per surface.","delivery":"Delivery work is a data-handling decision and configuration project: classify workloads, document privacy decisions, configure separate workspaces or accounts, and update records-retention guidance for retained prompts. Dependencies include privacy, records and legal counsel. Ownership sits with the privacy office and AI platform owner. Risks include misrouted regulated data and contractual ZDR commitments breached by default model changes. Acceptance means every workload has a documented retention decision."},"roleDetails":{"sales":{"customerProblem":"Agencies with ZDR or strict retention commitments cannot adopt Fable 5.2 without a documented privacy decision.","stakeholders":["Privacy officer","Records manager","Legal counsel","CISO","HHS compliance lead"],"discoveryQuestions":["Which contracts promise zero data retention?","Would retained prompts be subject to public-records requests?","Are you eligible for EFS or transitional ZDR?"],"valueHypothesis":"A clear per-workload decision lets agencies adopt covered models where acceptable without breaching commitments.","potentialEngagement":"Data-handling decision workshop and routing design.","unsupportedClaims":["30-day retention satisfies CJIS or HIPAA","ZDR is available by default","EFS is generally available"]},"engineering":{"fit":"Required reading before any covered-model deployment.","architectureIntegration":"Separate retention-enabled workspaces/accounts; routing controls; model ID logging.","prerequisites":["Workload data classification","Separate workspaces or subscriptions","Routing policy"],"constraints":["30-day minimum retention on all surfaces","EFS phased rollout","ZDR only for eligible customers, time-limited"],"security":"Retained data protected by vendor security program; human review only via logged controlled path.","proofOfValue":["Routing tests blocking regulated data from covered models","Per-surface retention verification"]},"delivery":{"work":"Classify workloads, configure retention classes, update records guidance.","dependencies":["Privacy office","Records management","Legal"],"ownership":"Privacy office with AI platform owner.","skillsAdoption":"Train users on which models are approved for which data.","governanceCheckpoints":["Privacy impact assessment","Records retention review","Contract review"],"acceptanceCriteria":["Proposed: documented decision for each workload","Proposed: zero ZDR-bound requests to covered models in logs"],"risks":["Misrouted regulated data","Breach of contractual ZDR commitments"]}},"retrievedAt":"2026-11-10T04:09:34Z","enrichedAt":"2026-11-10T04:18:20Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed.","procurementImplications":"Interpretation: contracts and data-use agreements (e.g., Maryland's Attachment Y) should state covered-model retention terms explicitly.","operatingModelImplications":"Interpretation: platform teams must manage two retention classes of Claude models in parallel.","sourceVerification":{"openedUrl":"https://support.claude.com/en/articles/15425695-covered-models","referenceExcerpt":"Accordingly, zero data retention is not available in workspaces, Claude Enterprise organizations, or third-party platforms (e.g., Azure Subscriptions) where Covered Models can be accessed.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}