{"resourceId":"claude-for-government-security-data-handling-no-inline-dlp","versions":[{"version":"external-3c2e816af18a033ebe4d8f575531ae34d1cb609c253d6f5e508609de4dfff665","resource":{"id":"claude-for-government-security-data-handling-no-inline-dlp","title":"Claude for Government docs: conversation content stays on-device; no inline DLP gate","organization":"Anthropic","sector":"AI platform vendor / government product documentation","geography":"United States (federal, state, local government customers)","publishedAt":"Undated Claude for Government documentation (retrieved 2026-11-06)","publicationDate":null,"eventDate":null,"sourceName":"Claude for Government docs","sourceLabel":"Vendor security and data-handling guide for agency reviewers","sourceUrl":"https://claude.com/docs/government/security/security-and-data-handling","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","governance-procurement","operating-model","infrastructure"],"finding":"Anthropic’s Claude for Government security and data-handling guide states conversation content stays on the user’s device, Anthropic-bound error/usage telemetry is always disabled, and there is no inline content-inspection or DLP gate. Agencies can optionally export selected content categories to their own OpenTelemetry collector (nothing selected by default). The guide also covers sandbox isolation, approvals, connectors, web search egress disclosures, and local storage expectations for Chat, Cowork, and Code. This is product documentation, not a measured deployment study. Newly relevant alongside Nov. 5–6 Claude Enterprise hook/DLP announcements because CFG still documents a different inspection model.","sledRelevance":"Cross-tag state-government: federal and SLTT agencies evaluating or expanding Claude for Government must design records, FOIA, legal-hold, and DLP strategies around on-device history and the absence of vendor inline DLP—especially when Enterprise buyers are being told hooks now provide prompt inspection. Interpretation: do not assume Enterprise security features transfer to the FedRAMP High desktop product.","evidence":"Opened documentation page answers explicitly: conversation content stays on the user’s device; OpenTelemetry export is customer-directed and optional; Is there an inline DLP or inspection point? No. Also notes available inspection points are the agency network proxy and after-the-fact OpenTelemetry tool-call metadata. No independent audit results in the page.","architectureImplications":"Interpretation: plan endpoint backup/eDiscovery of the fixed app data directory, optional OTel collector inside the agency boundary, proxy inspection where possible, and separate designs for Chat vs Cowork vs Code. Do not rely on Anthropic-held chat archives.","governanceImplications":"Interpretation: records officers and counsel must decide whether on-device Claude history is an agency system of record, enable content capture for roles that create records, and document residual risk from the no-inline-DLP design before ATO or statewide expansion.","securityPrivacyImplications":"Vendor design keeps content off Anthropic systems, which reduces vendor breach/subpoena exposure but shifts DLP, retention, and spoliation risk to the agency endpoint. Default telemetry content capture is off.","caveats":"Vendor documentation without a stated publication date on the retrieved page; features and defaults can change. Not an independent evaluation. Does not measure agency FOIA performance. Newly paired with Enterprise hook news for contrast, not because the CFG page itself is newly dated.","streamIds":["anthropic","state-government"],"roles":{"sales":"For government buyers comparing Claude Enterprise hooks to Claude for Government, lead with the documentation contrast: CFG keeps chats on the device and states there is no inline DLP gate. Ask who owns records capture, legal hold, and endpoint backup before expanding seats. Offer a CFG operating-controls workshop with records, counsel, and CISO. Unsupported: that FedRAMP High removes the need for agency DLP or records design, or that Enterprise hooks automatically apply inside CFG.","engineering":"Engineering should implement the optional OpenTelemetry content capture path for nominated cohorts, verify collector health because unreachable collectors can drop batches silently, confirm full-disk encryption on managed devices, and document proxy visibility limits. Keep CFG desktop architecture separate from Enterprise webhook hooks so teams do not accidentally design to the wrong product. Proof of value is a successful capture of a test prompt and response to the agency collector plus a restore test from endpoint backup of the application data directory.","delivery":"Delivery work includes a records decision memo, enabling content capture for FOIA and policy cohorts, adding Claude application-data collection to reimage runbooks, and training admins that capture defaults are off. Dependencies include an OTel collector inside the boundary, MDM and backup tooling, and counsel sign-off on records status. Risks include a laptop refresh wiping the only copy and staff assuming Enterprise DLP hooks cover Claude for Government."},"roleDetails":{"sales":{"customerProblem":"Agencies need clarity that Claude for Government’s security model differs from Claude Enterprise DLP hooks.","stakeholders":["Authorizing official","CISO","Records officer","General counsel","IT operations"],"discoveryQuestions":["Is on-device Claude history treated as an agency record?","Is an OTel collector already in the boundary?","Who signs residual risk for no inline DLP?"],"valueHypothesis":"Interpretation: documenting the on-device/no-inline-DLP model early prevents ATO surprises and FOIA gaps.","potentialEngagement":"A CFG records-and-controls design engagement spanning security, records, and counsel.","unsupportedClaims":["That FedRAMP High includes vendor-held chat archives","That Enterprise inference hooks apply to CFG","Guaranteed FOIA readiness without agency capture"]},"engineering":{"fit":"Required reading for any CFG deployment; contrasts with Enterprise hook architectures.","architectureIntegration":"Desktop app with local history; optional customer OTel export; proxy as network inspection point; no vendor inline DLP.","prerequisites":["MDM-managed devices","Full-disk encryption","Agency OTel collector if capture required","Written records classification"],"constraints":["No inline DLP gate","Default content capture off","Local history managed on endpoint"],"security":"Monitor collector reachability; encrypt endpoints; limit connectors; review web-search approval defaults.","proofOfValue":["Test prompt captured to collector","Reimage runbook collects app data first","Proxy logs reviewed for expected egress"]},"delivery":{"work":"Produce decision memo, enable capture for nominated groups, update reimage/legal-hold procedures, train admins.","dependencies":["Counsel/records decision","Collector platform","MDM/backup team","Anthropic admin access"],"ownership":"Records officer owns schedule mapping; CISO owns residual DLP risk; IT ops owns backup/reimage.","skillsAdoption":"Admin and power-user training on what is and is not retained server-side.","governanceCheckpoints":["Pre-ATO records decision","Capture enablement review","First refresh drill"],"acceptanceCriteria":["Written position on records status","Capture on for designated cohorts","Reimage checklist updated"],"risks":["Silent collector outage","User deletion of sole copy","Confusion with Enterprise security features"]}},"retrievedAt":"2026-11-07T04:07:11Z","enrichedAt":"2026-11-07T04:12:49Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed.","procurementImplications":"Interpretation: CFG orders should include agency-side capture/backup requirements in the implementation plan, not assume vendor-side journaling.","operatingModelImplications":"Interpretation: operations must treat endpoint collection and collector monitoring as standing duties for as long as CFG is used.","sourceVerification":{"openedUrl":"https://claude.com/docs/government/security/security-and-data-handling","referenceExcerpt":"Claude for Government does not include an inline content-inspection or DLP gate.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}