cmek-coverage-claude-platform changedmanage-claude/cmek-coverage-claude-platform
Nearest release: v2.1.314, published under an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+16added
Lines−17removed
From line
4
where the diff opens
First seen
23 Oct 2026
this site's first read of the page
Recorded edits3to this page, all time
## Where CMEK does not apply: Claude Code telemetry
The whole hunk
from line 4, old and new numbered
/
from line 4
44description: Look up which Claude Platform data your key encrypts, what turns off or changes, and what stays under Anthropic's key.
55---
66
7For Claude Enterprise, see [What CMEK covers on Claude Enterprise](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise). Beta and research preview features that aren’t listed here might not be covered by customer-managed encryption keys (CMEK).
7For Claude Enterprise, see [What CMEK covers on Claude Enterprise](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise).
88
99## Encrypted with your key
1010
from line 13
1313* MCP and tool configuration.
1414* [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) (beta) data, including agent configurations, environments, webhooks, sessions and their events, [memory stores](https://platform.claude.com/docs/en/managed-agents/memory) (beta) and their memories and memory versions, and [dreams](https://platform.claude.com/docs/en/managed-agents/dreams) (research preview).
1515* Batch API and Skills API data stored at rest.
16* Tool data stored at rest by web search, web fetch, code execution, bash, text editor, MCP connector (beta), structured outputs, advisor tool (beta), computer use, browser use, and context management.
16* Tool data stored at rest by web search, web fetch, code execution, bash, text editor, MCP connector (beta), structured outputs, advisor tool (beta), computer use, browser use, and context management (beta).
1717* Backups and snapshots, which inherit the key.
1818
1919## Turned off or changed
2020
21Beta and research preview features that aren’t listed on this page might not be covered by customer-managed encryption keys (CMEK).
22
2123This list is not exhaustive. Review it with your team before you set up CMEK.
2224
2325| Feature | What changes |
from line 33
3133
3234The features that store this data stay available, but the data isn’t encrypted with your key. You can turn off some of these features in **Settings**.
3335
34| Data | Details |
35| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
36| Existing data | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). |
37| Data that isn’t at rest, and data with a TTL shorter than 24 hours | For example, cache. |
38| Activity Feed, audit logs, and telemetry network traffic such as OpenTelemetry | Kept under Anthropic’s key so that you can maintain compliance even if your key can’t be used. |
39| Claude Managed Agents [vault credential](https://platform.claude.com/docs/en/managed-agents/vaults) values, such as OAuth tokens and client secrets | Write-only and never returned in API responses. |
40| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | Profile fields such as `name` and `metadata`. Don’t store sensitive personal data in profile `metadata`. |
41| Claude Console feedback | Ratings and comments that members choose to send with the **Feedback** option. No setting turns it off. |
42| [OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry/api#add-a-destination) request headers, such as the API key header of your observability platform | Write-only and never returned in API responses. |
43| Account data for users in your organization | Includes names, email addresses, and profile pictures. |
44| Preserved records | Anthropic can preserve specific records [in three narrow cases](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#limited-preservation-outside-your-key). |
45
46## Where CMEK does not apply: Claude Code telemetry
47
48When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code’s operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.
36| Data | Details |
37| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
38| Existing data before key setup | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). |
39| Data that isn’t at rest, and data with a TTL shorter than 24 hours | For example, cache. |
40| Activity Feed, audit logs, and telemetry network traffic such as OpenTelemetry (beta) | Kept under Anthropic’s key so that you can maintain compliance even if your key can’t be used. |
41| Claude Managed Agents (beta) [vault credential](https://platform.claude.com/docs/en/managed-agents/vaults) values, such as OAuth tokens and client secrets | Write-only and never returned in API responses. |
42| [User profiles](https://platform.claude.com/docs/en/manage-claude/user-profiles) | Profile fields such as `name` and `metadata`. Don’t store sensitive personal data in profile `metadata`. |
43| Claude Console feedback | Ratings and comments that members choose to send with the **Feedback** option. No setting turns it off. |
44| [OpenTelemetry destination](https://platform.claude.com/docs/en/manage-claude/opentelemetry/api#add-a-destination) (beta) request headers, such as the API key header of your observability platform | Write-only and never returned in API responses. |
45| Account data for users in your organization | Includes names, email addresses, and profile pictures. |
46| Preserved records | Anthropic can preserve specific records [in three narrow cases](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#limited-preservation-outside-your-key). |
47| Claude Code telemetry | When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code’s operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation. |
4948
No line in this hunk matches that.