cmek-data-retention changedmanage-claude/cmek-data-retention

Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 27 Oct 2026 18:58 UTC

Lines+6added

Lines−6removed

From line 4 where the diff opens

First seen 23 Oct 2026 this site's first read of the page

Recorded edits2to this page, all time

The whole hunk

from line 4, old and new numbered

lines

from line 4

44description: Why a workspace with a key retains data, what that means for ZDR, and what Anthropic can preserve outside your key.

55---

7On Claude Platform, customer-managed encryption keys (CMEK) and [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) can't share a workspace. On Claude Enterprise, an organization can use CMEK and ZDR together, but it then [can't turn on artifacts](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).

7On Claude Platform, customer-managed encryption keys (CMEK) and [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention) can’t share a workspace. On Claude Enterprise, an organization can use CMEK and ZDR together, but it then [can’t turn on artifacts](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).

99## A key needs a workspace that retains data

1010

11CMEK encrypts stored data, and under ZDR on Claude Platform, Anthropic doesn't store your prompts or responses. So you can attach a key only to a workspace with **Standard data retention** (30 days).

11CMEK encrypts stored data, and under ZDR on Claude Platform, Anthropic doesn’t store your prompts or responses. So you can attach a key only to a workspace with **Standard data retention** (30 days).

1212

13After you attach a key, you can't turn off data retention for that workspace. To return to ZDR, create a new workspace and move your traffic to it.

13After you attach a key, you can’t turn off data retention for that workspace. To return to ZDR, create a new workspace and move your traffic to it.

1414

1515## In a ZDR organization

1616

17A ZDR organization on Claude Platform can use CMEK. You switch one workspace to **Standard data retention**, accept the data retention terms, and attach your key to it. The workspace you switch can't be the default workspace, whose retention follows the organization's. Your other workspaces keep ZDR.

17A ZDR organization on Claude Platform can use CMEK. You switch one workspace to **Standard data retention**, accept the data retention terms, and attach your key to it. The workspace you switch can’t be the default workspace, whose retention follows the organization’s. Your other workspaces keep ZDR.

1818

1919[Choose your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up) and follow its attach step.

2020

from line 24

2424

2525* Where Anthropic is required by law to retain records (for example, material reported to NCMEC under 18 U.S.C. § 2258A)

2626* Exigent risk of serious harm (for example, CBRNE weapons development, offensive cyberattacks, or imminent threats of violence)

27* Violations of Section D.4 of Anthropic's [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) or equivalent terms in a customer's other applicable agreement with Anthropic

27* Violations of Section D.4 of Anthropic’s [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) or equivalent terms in a customer’s other applicable agreement with Anthropic

2828

29Outside of [CSAM screening](https://support.claude.com/en/articles/9020328-csam-detection-and-reporting), preservation requires a human reviewer's explicit decision and follows Anthropic's [retention policy for commercial data](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data). For every instance of preservation, a corresponding [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event is generated with a reason code conveying the purpose of the preservation. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) for details. Safety screening metadata is retained under Anthropic-managed encryption and remains readable after key revocation. These are records derived from Anthropic's automated safety scans, such as pattern identifiers and match indicators, not conversation content.

29Outside of [CSAM screening](https://support.claude.com/en/articles/9020328-csam-detection-and-reporting), preservation requires a human reviewer’s explicit decision and follows Anthropic’s [retention policy for commercial data](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data). For every instance of preservation, a corresponding [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) event is generated with a reason code conveying the purpose of the preservation. See [CMEK content preservation](https://platform.claude.com/docs/en/manage-claude/access-transparency#cmek-content-preservation) for details. Safety screening metadata is retained under Anthropic-managed encryption and remains readable after key revocation. These are records derived from Anthropic’s automated safety scans, such as pattern identifiers and match indicators, not conversation content.

3030