From the Anthropic edition of November 6, 2026
Claude for Government docs: conversation content stays on-device; no inline DLP gate
Anthropic · AI platform vendor / government product documentation · United States (federal, state, local government customers)
- Publisher
- Claude for Government docs
- Original publication
- Undated Claude for Government documentation (retrieved 2026-11-06)
- Source retrieved
- 2026-11-07
What happened
Anthropic’s Claude for Government security and data-handling guide states conversation content stays on the user’s device, Anthropic-bound error/usage telemetry is always disabled, and there is no inline content-inspection or DLP gate. Agencies can optionally export selected content categories to their own OpenTelemetry collector (nothing selected by default). The guide also covers sandbox isolation, approvals, connectors, web search egress disclosures, and local storage expectations for Chat, Cowork, and Code. This is product documentation, not a measured deployment study. Newly relevant alongside Nov. 5–6 Claude Enterprise hook/DLP announcements because CFG still documents a different inspection model.
Why it matters
Cross-tag state-government: federal and SLTT agencies evaluating or expanding Claude for Government must design records, FOIA, legal-hold, and DLP strategies around on-device history and the absence of vendor inline DLP—especially when Enterprise buyers are being told hooks now provide prompt inspection. Interpretation: do not assume Enterprise security features transfer to the FedRAMP High desktop product.
Evidence and measured results
Opened documentation page answers explicitly: conversation content stays on the user’s device; OpenTelemetry export is customer-directed and optional; Is there an inline DLP or inspection point? No. Also notes available inspection points are the agency network proxy and after-the-fact OpenTelemetry tool-call metadata. No independent audit results in the page.
Limitations and uncertainty
Vendor documentation without a stated publication date on the retrieved page; features and defaults can change. Not an independent evaluation. Does not measure agency FOIA performance. Newly paired with Enterprise hook news for contrast, not because the CFG page itself is newly dated.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-07; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies need clarity that Claude for Government’s security model differs from Claude Enterprise DLP hooks.
- Stakeholders
- Authorizing official
- CISO
- Records officer
- General counsel
- IT operations
- Discovery questions
- Is on-device Claude history treated as an agency record?
- Is an OTel collector already in the boundary?
- Who signs residual risk for no inline DLP?
- Value hypothesis
- Interpretation: documenting the on-device/no-inline-DLP model early prevents ATO surprises and FOIA gaps.
- Potential engagement
- A CFG records-and-controls design engagement spanning security, records, and counsel.
- Unsupported claims
- That FedRAMP High includes vendor-held chat archives
- That Enterprise inference hooks apply to CFG
- Guaranteed FOIA readiness without agency capture
Pre-sales engineering
Role takeaway
- Fit
- Required reading for any CFG deployment; contrasts with Enterprise hook architectures.
- Architecture and integration
- Desktop app with local history; optional customer OTel export; proxy as network inspection point; no vendor inline DLP.
- Prerequisites
- MDM-managed devices
- Full-disk encryption
- Agency OTel collector if capture required
- Written records classification
- Constraints
- No inline DLP gate
- Default content capture off
- Local history managed on endpoint
- Security
- Monitor collector reachability; encrypt endpoints; limit connectors; review web-search approval defaults.
- Proof of value
- Test prompt captured to collector
- Reimage runbook collects app data first
- Proxy logs reviewed for expected egress
Delivery
Role takeaway
- Work
- Produce decision memo, enable capture for nominated groups, update reimage/legal-hold procedures, train admins.
- Dependencies
- Counsel/records decision
- Collector platform
- MDM/backup team
- Anthropic admin access
- Ownership
- Records officer owns schedule mapping; CISO owns residual DLP risk; IT ops owns backup/reimage.
- Skills and adoption
- Admin and power-user training on what is and is not retained server-side.
- Governance checkpoints
- Pre-ATO records decision
- Capture enablement review
- First refresh drill
- Acceptance criteria
- Written position on records status
- Capture on for designated cohorts
- Reimage checklist updated
- Risks
- Silent collector outage
- User deletion of sole copy
- Confusion with Enterprise security features
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Plan endpoint backup/eDiscovery of the fixed app data directory, optional OTel collector inside the agency boundary, proxy inspection where possible, and separate designs for Chat vs Cowork vs Code. Do not rely on Anthropic-held chat archives.
Governance
Who approves, reviews and stays accountable for outcomes?
Records officers and counsel must decide whether on-device Claude history is an agency system of record, enable content capture for roles that create records, and document residual risk from the no-inline-DLP design before ATO or statewide expansion.
Security and privacy
What data, permissions and controls need testing?
Vendor design keeps content off Anthropic systems, which reduces vendor breach/subpoena exposure but shifts DLP, retention, and spoliation risk to the agency endpoint. Default telemetry content capture is off.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Not addressed.
Procurement
What should contracts, pricing and exit terms secure?
CFG orders should include agency-side capture/backup requirements in the implementation plan, not assume vendor-side journaling.
Operating model
Which teams own the service once it runs?
Operations must treat endpoint collection and collector monitoring as standing duties for as long as CFG is used.
Publication history
- 2026-11-06Anthropic · Issue 095 resources
Stable resource ID: claude-for-government-security-data-handling-no-inline-dlp