Follow Discord
Sweep 06 Nov 2026 · 01:32Z Build v2.1.319 537 read Stable v2.1.311 Latest v2.1.319 Next v2.1.319 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Documentation 24 Oct 2026
One change · claude-docs

Security and data handling changedclaude-tag/concepts/security-and-data

Nearest release: v2.1.310, published 4 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 24 Oct 2026 02:17 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 24 Oct 2026 02:37 UTC.

Upstream edited
Recorded here
Lines+8added
Lines−6removed
From line 8 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits31to this page, all time

The whole hunk

from line 8, old and new numbered
/
lines
from line 8
88 
99In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](https://claude.com/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts.
1010 
11Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox only through Agent Proxy and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use the connectors an admin adds in those sessions.
11Every channel request, whether a person typed it or a schedule triggered it, follows the same path: it runs in an isolated sandbox, and the credentials you provision aren't placed in that sandbox. In an Anthropic-hosted environment, requests leave that sandbox through Agent Proxy, or through a separate GitHub proxy for [GitHub API requests and git operations](#network-egress), and reach your systems under the agent's own accounts. Sessions in a [self-hosted environment](https://code.claude.com/docs/en/self-hosted-environments) run on runners inside your network, and Claude can't use the connectors an admin adds in those sessions.
1212 
1313One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account instead and are covered separately on [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). For DMs from members who haven't, see [Direct messages from members without a Claude account](https://claude.com/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account).
1414 
1515## How a request travels
1616 
17Each Slack thread runs in its own sandbox. In an Anthropic-hosted environment, every outbound call from that sandbox passes through the same checkpoints.
17Each Slack thread runs in its own sandbox. In an Anthropic-hosted environment, each outbound call from that sandbox, other than a [GitHub API request or a git operation](#network-egress), passes through the same checkpoints.
1818 
19![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=lijct3C2aoA3LHFn\&q=85\&s=10d796e77738a52a505dcab2c9950cda)
19![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like an issue tracker, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/y3Hxae32FdEU67_n/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=y3Hxae32FdEU67_n\&q=85\&s=0cf396f807a5bc0ed4aec73a9feb5d06)
2020 
2121| Checkpoint | The guarantee |
2222| :- | :- |
2323| The sandbox | Holds none of the credentials you provision |
24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites), [allowed domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential), or [environment network access level](https://claude.com/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) allows |
24| Agent Proxy | Injects credentials from the credential store at request time, and blocks a request that no [credential's allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites), [allowed domain](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential), or [environment network access level](https://claude.com/docs/claude-tag/admins/add-connections.md#broad-web-access-through-the-environment) allows; GitHub API requests and git operations go through the separate [GitHub proxy](#network-egress) instead |
2525| Your systems | See the agent's own accounts, so its actions there are attributable |
2626 
2727### Compute and the sandbox
from line 47
4747 
4848### Network egress
4949 
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
50In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny, apart from its GitHub API requests and git operations. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](https://claude.com/docs/claude-tag/admins/connections/custom.md#fill-out-the-custom-tool-form), the [allowed domains](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](https://claude.com/docs/claude-tag/concepts/glossary.md#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy) for what happens to a request under each layer.
5151 
5252![Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable.](https://mintcdn.com/claude-ai/f29MqpCRlPctgTn5/images/claude-tag/diagrams/proxy-decision.svg?fit=max\&auto=format\&n=f29MqpCRlPctgTn5\&q=85\&s=f87bc9ca2d2de09e4feda0a60695e9bd)
5353 
54Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
54Because requests to any other host are blocked, data leaves the sandbox only to hosts an allow layer covers and to GitHub through the GitHub proxy. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites) and [Allow a host without a credential](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential).
5555 
5656Allow-all egress is a `*` domain. The entry admits requests to any host on the ports it lists, still without credentials. Private and internal network addresses and cloud metadata endpoints remain blocked. See [Allow all hosts](https://claude.com/docs/claude-tag/admins/add-connections.md#allow-all-hosts).
57 
58In an Anthropic-hosted environment, a channel session's GitHub API requests and git operations go through a dedicated GitHub proxy, which keeps the GitHub credential outside the sandbox. A credential's allowed websites, an allowed domain, and the environment's network access setting don't govern them. Instead, GitHub API requests, source archive downloads, and anything in a private repository are limited to the repositories an admin granted to the channel. The GitHub proxy refuses them for a repository the session doesn't have. Git may still be able to clone public repositories that an admin didn't grant, with no credential. See [How granted repositories reach a session](https://claude.com/docs/claude-tag/admins/configure-github.md#how-granted-repositories-reach-a-session) for how a granted repository becomes one Claude can use, and [GitHub proxy](https://code.claude.com/docs/en/cloud-environments#github-proxy) in the Claude Code docs for the push and GraphQL restrictions it also applies.
5759 
5860### Service accounts
5961 
Feedback