cmek-coverage-claude-platform changedmanage-claude/cmek-coverage-claude-platform

Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 27 Oct 2026 18:58 UTC

Lines+7added

Lines−7removed

From line 4 where the diff opens

First seen 23 Oct 2026 this site's first read of the page

Recorded edits2to this page, all time

## Encrypted with Anthropic’s key ## Encrypted with Anthropic's key

The whole hunk

from line 4, old and new numbered

lines

from line 4

44description: Look up which Claude Platform data your key encrypts, what turns off or changes, and what stays under Anthropic's key.

55---

7For Claude Enterprise, see [What CMEK covers on Claude Enterprise](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise). Beta and research preview features that aren't listed here might not be covered by customer-managed encryption keys (CMEK).

7For Claude Enterprise, see [What CMEK covers on Claude Enterprise](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise). Beta and research preview features that aren’t listed here might not be covered by customer-managed encryption keys (CMEK).

99## Encrypted with your key

1010

from line 27

2727| [Organization webhooks](https://platform.claude.com/docs/en/manage-claude/organization-webhooks#errors) (beta) | Turned off for an organization whose default workspace uses a key. Requests return a 400 error. |

2828| Zero data retention (ZDR) | A workspace with your key retains data. See [CMEK, data retention, and ZDR](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention). |

2929

30## Encrypted with Anthropic's key

30## Encrypted with Anthropic’s key

3131

32The features that store this data stay available, but the data isn't encrypted with your key. You can turn off some of these features in **Settings**.

32The features that store this data stay available, but the data isn’t encrypted with your key. You can turn off some of these features in **Settings**.

3333

3434| Data | Details |

3535| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

3636| Existing data | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). |

37| Data that isn't at rest, and data with a TTL shorter than 24 hours | For example, cache. |

38| Activity Feed, audit logs, and telemetry network traffic such as OpenTelemetry | Kept under Anthropic's key so that you can maintain compliance even if your key can't be used. |

37| Data that isn’t at rest, and data with a TTL shorter than 24 hours | For example, cache. |

38| Activity Feed, audit logs, and telemetry network traffic such as OpenTelemetry | Kept under Anthropic’s key so that you can maintain compliance even if your key can’t be used. |

3939| Claude Managed Agents [vault credential](https://platform.claude.com/docs/en/managed-agents/vaults) values, such as OAuth tokens and client secrets | Write-only and never returned in API responses. |

40| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | Profile fields such as `name` and `metadata`. Don't store sensitive personal data in profile `metadata`. |

40| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | Profile fields such as `name` and `metadata`. Don’t store sensitive personal data in profile `metadata`. |

4141| Claude Console feedback | Ratings and comments that members choose to send with the **Feedback** option. No setting turns it off. |

4242| [OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry/api#add-a-destination) request headers, such as the API key header of your observability platform | Write-only and never returned in API responses. |

4343| Account data for users in your organization | Includes names, email addresses, and profile pictures. |

from line 45

4545

4646## Where CMEK does not apply: Claude Code telemetry

4747

48When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code's operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.

48When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code’s operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.

4949