Home Docs Claude Documentation 13 Oct 2026

One change · claude-docs

Security and data handling changedclaude-tag/concepts/security-and-data

Nearest release: v2.1.299, published 7 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 13 Oct 2026 17:06 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.

Upstream edited 13 Oct 2026 17:06 UTC

Recorded here 22 Oct 2026 18:07 UTC

Lines+25added

Lines−25removed

From line 6 where the diff opens

First seen 14 Aug 2026 this site's first read of the page

Recorded edits28to this page, all time

The whole hunk

from line 6, old and new numbered

lines

from line 6

66>

77> Claude Tag is in public beta. Features and behavior described here may change before general availability.

9In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts.

9In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts.

1010

1111Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox only through Agent Proxy and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use the connectors an admin adds in those sessions.

1212

13One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account instead and are covered separately on [How agent identity works](/docs/claude-tag/concepts/agent-identity#direct-message-channels). For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#access-in-a-direct-message-from-a-member-without-a-claude-account).

13One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account instead and are covered separately on [How agent identity works](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account).

1414

1515## How a request travels

1616

from line 21

2121| Checkpoint | The guarantee |

2222| :- | :- |

2323| The sandbox | Holds none of the credentials you provision |

24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites), [allowed domain](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential), or [environment network access level](/docs/claude-tag/admins/add-connections#broad-web-access-through-the-environment) allows |

24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites), [allowed domain](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential), or [environment network access level](/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) allows |

2525| Your systems | See the agent's own accounts, so its actions there are attributable |

2626

2727### Compute and the sandbox

from line 33

3333* **Persists:** The thread, its visible work, and anything pushed to a branch, opened as a pull request, or posted into Slack.

3434* **Does not persist:** Files that existed only inside the sandbox. To keep generated files, ask Claude to push them to a branch or post them in the thread.

3535

36Claude Tag retains channel memory and session transcripts. Because of that retention, Claude Tag isn't available to organizations with Zero Data Retention (ZDR) enabled. Claude Tag also isn't available to organizations with a customer-managed encryption (CMEK) policy, or to organizations that have the [HIPAA configuration applied to Claude Code (local mode) and Cowork (local mode)](/docs/claude-tag/admins/healthcare#plan-and-organization-requirements).

3737

3838### Credential storage

3939

40Credentials you provision are kept in a separate credential store, not in the proxy itself. When an outbound request matches a rule, [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy), the network layer between the sandbox and any external host, retrieves the credential from that store and injects it at the boundary, so the model and the sandbox are not given the key.

40Credentials you provision are kept in a separate credential store, not in the proxy itself. When an outbound request matches a rule, [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy), the network layer between the sandbox and any external host, retrieves the credential from that store and injects it at the boundary, so the model and the sandbox are not given the key.

4141

4242This means:

4343

4444* **A saved credential is not displayed again.** The setup screens are write-only.

4545* **The credential travels only to the hosts you named** when you added it.

46* **You can narrow the credential further**, to one host, one path prefix, or read-only methods; see [Restrict by path or method](/docs/claude-tag/admins/add-connections#restrict-by-path-or-method).

4747

4848### Network egress

4949

50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](/docs/claude-tag/admins/connections/custom#fill-out-the-custom-tool-form), the [allowed domains](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) for what happens to a request under each layer.

50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.

5151

5252![Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable.](https://mintcdn.com/claude-ai/f29MqpCRlPctgTn5/images/claude-tag/diagrams/proxy-decision.svg?fit=max\&auto=format\&n=f29MqpCRlPctgTn5\&q=85\&s=f87bc9ca2d2de09e4feda0a60695e9bd)

5353

54Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) and [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential).

54Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).

5555

56Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](/docs/claude-tag/admins/add-connections#allow-all-hosts).

5757

5858### Service accounts

5959

60In channels, Claude acts under service credentials of its own, not under the account of the person who tagged it. The Slack surface is the Claude app, code work goes through the Claude GitHub App, and every other connected tool uses a service account whose credential a [connector](/docs/claude-tag/concepts/glossary#connection) holds. See [How agent identity works](/docs/claude-tag/concepts/agent-identity) for the full model.

60In channels, Claude acts under service credentials of its own, not under the account of the person who tagged it. The Slack surface is the Claude app, code work goes through the Claude GitHub App, and every other connected tool uses a service account whose credential a [connector](/docs/claude-tag/concepts/glossary.md#connection) holds. See [How agent identity works](/docs/claude-tag/concepts/agent-identity.md) for the full model.

6161

62A connector's credential belongs to that agent identity and is shared by everyone in the channels where it applies. Anyone in one of those channels can ask Claude to act with the credential, so whatever the connected account can read or write is available to every member of those channels. Connect a dedicated identity you control for each service, such as a `[email protected]` seat or a native service account, rather than a personal login. A dedicated account keeps the agent's actions separately auditable in each tool's logs and lets you revoke its access without affecting a person; see [Create a dedicated account per service](/docs/claude-tag/admins/add-connections#create-a-dedicated-account-per-service).

6363

64One-to-one DMs with `@Claude` from a member who has connected a Claude account run on that member's own claude.ai account instead, with that member's personal connectors, and work there is attributed to them, except pull requests, which the Claude GitHub App authors from DMs as well. For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#access-in-a-direct-message-from-a-member-without-a-claude-account). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages).

64One-to-one DMs with `@Claude` from a member who has connected a Claude account run on that member's own claude.ai account instead, with that member's personal connectors, and work there is attributed to them, except pull requests, which the Claude GitHub App authors from DMs as well. For DMs from members who haven't, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access.md#allow-or-disable-direct-messages).

6565

66Claude uses a user's [personal connectors in a channel](/docs/claude-tag/concepts/personal-connectors) only for that user's own tasks, after the user allows it. The work runs with that user's permissions and is recorded under their name. Requests other people make to Claude in the task's thread run with the channel's own access, not with that user's connectors. Claude is designed to take direction from the connector's owner, treating what other people post in the thread as information for the task rather than as instructions, and the owner can tell Claude in the task's thread to stop. On the Enterprise plan, an admin can require [the user's review of every result](/docs/claude-tag/concepts/personal-connectors#admin-controls-for-personal-connectors) before it posts. See [Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors).

66Claude uses a user's [personal connectors in a channel](/docs/claude-tag/concepts/personal-connectors.md) only for that user's own tasks, after the user allows it. The work runs with that user's permissions and is recorded under their name. Requests other people make to Claude in the task's thread run with the channel's own access, not with that user's connectors. Claude is designed to take direction from the connector's owner, treating what other people post in the thread as information for the task rather than as instructions, and the owner can tell Claude in the task's thread to stop. On the Enterprise plan, an admin can require [the user's review of every result](/docs/claude-tag/concepts/personal-connectors.md#admin-controls-for-personal-connectors) before it posts. See [Personal connectors in channels](/docs/claude-tag/concepts/personal-connectors.md).

6767

6868### Isolate credentials between channels

6969

from line 71

7171

7272* **The channel itself.** Access added on the channel's page, or a bundle applied to the channel, reaches that channel only.

7373* **The channel's workspace.** Access added on the workspace's page, or a bundle applied to the workspace, reaches every channel of that workspace.

74* **All of Slack.** Access added on the **Slack** page, or a bundle applied there, reaches every channel of every paired workspace. The first credential you add for a service on the **Connectors** tab is on here as soon as you save it. See [how scopes inherit](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit).

7575* **A channel rule.** A bundle an Owner applies to a channel name pattern reaches every matching channel in all of Slack or in one workspace, including channels created or renamed later.

7676

7777Access applied anywhere else in your organization is invisible to the session, and no request from the session's sandbox can carry a credential that doesn't apply to its channel.

from line 84

8484 * In a bundle whose **Where it applies** list holds only that channel.

8585 * From the channel's page. Under **Claude's access**, click **Add** and select **Connector**. On the dialog's **Connectors** tab, select the service under **Connect new** and click **Continue**. The credential you enter in the connect form applies in that channel only.

8686 * On the page of a connector already on the **Connectors** tab, select **Add credential** from the **⋮** menu at the top of the page. The new credential is off everywhere until you pick it in the channel's row under **Assign access**, selecting **Add place** if the channel isn't listed.

872. Keep the channel private. Access on a public channel [reaches anyone who joins](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel).

872. Keep the channel private. Access on a public channel [reaches anyone who joins](/docs/claude-tag/admins/attach-to-scope.md#attach-to-a-channel).

88883. Open the channel from the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) and check its **Claude's access** table. It lists the access that reaches the channel, and an item a bundle brings is listed under that bundle's row. The **Inheritance** column shows whether each bundle, and each item outside a bundle, was added on the channel's page or inherited from the workspace or from **Slack**.

8989

90In a channel shared with another company through [Slack Connect](/docs/claude-tag/admins/restrict-access#slack-connect-channels), once Claude is turned on there, it has the connector credentials from the [bundles attached directly to that channel](/docs/claude-tag/admins/restrict-access#what-access-claude-has-in-a-slack-connect-channel), including bundles attached before the channel was shared. It also has those from any bundle attached specifically for Slack Connect channels, and it can use them for anyone it answers there, including the other company's people. Credentials inherited from the workspace or the **Slack** page don't reach that channel, and neither do members' [personal connectors](/docs/claude-tag/concepts/personal-connectors). Before you share a channel that already has bundles, check its **Claude's access** table and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope#choose-where-a-bundle-applies) you don't want used for the other company's people.

90In a channel shared with another company through [Slack Connect](/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), once Claude is turned on there, it has the connector credentials from the [bundles attached directly to that channel](/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel), including bundles attached before the channel was shared. It also has those from any bundle attached specifically for Slack Connect channels, and it can use them for anyone it answers there, including the other company's people. Credentials inherited from the workspace or the **Slack** page don't reach that channel, and neither do members' [personal connectors](/docs/claude-tag/concepts/personal-connectors.md). Before you share a channel that already has bundles, check its **Claude's access** table and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope.md#choose-where-a-bundle-applies) you don't want used for the other company's people.

9191

92When you ask Claude in one channel to post into another, Claude works with the access and instructions of the channel you asked in, not the target channel's. From a private channel, Claude doesn't post anywhere else, and nothing asked elsewhere makes Claude post into a private channel. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works#what-claude-can-do-in-other-channels) covers where Claude can post from each place you ask.

92When you ask Claude in one channel to post into another, Claude works with the access and instructions of the channel you asked in, not the target channel's. From a private channel, Claude doesn't post anywhere else, and nothing asked elsewhere makes Claude post into a private channel. [What Claude can do in other channels](/docs/claude-tag/concepts/how-it-works.md#what-claude-can-do-in-other-channels) covers where Claude can post from each place you ask.

9393

94Isolating a credential doesn't isolate what Claude knows. The [workspace notes](/docs/claude-tag/users/memory) it saves from a public channel are read by sessions in every channel of the workspace, and it can [search public channels by keyword](/docs/claude-tag/admins/restrict-access#controls-that-aren%E2%80%99t-available) without being added to them, the same way any workspace member can.

94Isolating a credential doesn't isolate what Claude knows. The [workspace notes](/docs/claude-tag/users/memory.md) it saves from a public channel are read by sessions in every channel of the workspace, and it can [search public channels by keyword](/docs/claude-tag/admins/restrict-access.md#controls-that-aren%E2%80%99t-available) without being added to them, the same way any workspace member can.

9595

9696## Artifact visibility

9797

98A session can publish an artifact, a web page hosted on claude.ai with the link posted in the thread, and the page stays available after the sandbox is released. Anyone with access to the source Slack channel can open it, which in a public channel covers everyone in the workspace. Someone who opens the link without that access can't see the page and has no option to request access. There is no share setting for anyone to change. Updates go through Claude: ask in the Slack thread, or [send Claude a comment on the page](/docs/claude-tag/users/use-cases/create-artifacts#comment-on-the-page-to-ask-for-changes), which anyone who can post in the channel can do.

98A session can publish an artifact, a web page hosted on claude.ai with the link posted in the thread, and the page stays available after the sandbox is released. Anyone with access to the source Slack channel can open it, which in a public channel covers everyone in the workspace. Someone who opens the link without that access can't see the page and has no option to request access. There is no share setting for anyone to change. Updates go through Claude: ask in the Slack thread, or [send Claude a comment on the page](/docs/claude-tag/users/use-cases/create-artifacts.md#comment-on-the-page-to-ask-for-changes), which anyone who can post in the channel can do.

9999

100While a Slack guest is in a channel set to [**Channel only**](/docs/claude-tag/admins/restrict-access#how-channel-only-works), Claude doesn't publish artifacts there.

100While a Slack guest is in a channel set to [**Channel only**](/docs/claude-tag/admins/restrict-access.md#how-channel-only-works), Claude doesn't publish artifacts there.

101101

102102Artifacts you publish from your own Claude Code sessions work differently: they belong to you, and you control who can open them, with sharing options that depend on your plan and organization settings. See the [Claude Code artifacts documentation](https://code.claude.com/docs/en/artifacts).

103103

from line 108

108108* **Team plans**: **Restrict to your organization** limits Claude to people with a Claude account in your organization

109109* **Enterprise plans**: **Restrict to roles with Claude Tag access** limits Claude to members whose role grants the **Claude Tag in Slack** capability

110110

111See [Restrict who can use Claude](/docs/claude-tag/admins/restrict-access#restrict-who-can-use-claude). The restriction governs DMs as well as channels.

111See [Restrict who can use Claude](/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude). The restriction governs DMs as well as channels.

112112

113113## Related resources

114114

115* [How agent identity works](/docs/claude-tag/concepts/agent-identity): the identity model in full, including DM attribution

116* [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle): what Anthropic stores, how long it's kept, and what each action deletes

117* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): the controls that exist and the ones that don't

118* [Audit Claude Tag activity](/docs/claude-tag/admins/audit): the trails for tracing what it did

115* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): the identity model in full, including DM attribution

116* [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle.md): what Anthropic stores, how long it's kept, and what each action deletes

117* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): the controls that exist and the ones that don't

118* [Audit Claude Tag activity](/docs/claude-tag/admins/audit.md): the trails for tracing what it did

119119

This page’s history 28 edits

13 Oct 2026 +25 −25 · this one
13 Oct 2026 +5 −9
13 Oct 2026 +1 −1
9 Oct 2026 +1 −1
5 Oct 2026 +35 −26
5 Oct 2026 +1 −1

The page’s own history →

Where it came from

The captureclaude-docs
Upstream pageclaude.com

Around it

Every changethe ledger
That day13 Oct 2026