Is Claude Safe for CRE Data? Depends Which Claude You Bought.

The single most load-bearing fact in a Claude security review is that Anthropic runs two regimes. Consumer plans, Free, Pro, and Max, including Claude Code used from those accounts, operate under consumer terms, and since a September 2025 update those users choose whether their chats may be used to improve models, with data retention extending to five years for those who allow it and remaining thirty days for those who do not. Commercial products are the other regime, and Anthropic’s update announcing the consumer change states plainly that it does not apply to services under its commercial terms, naming Claude for Work, which includes the Team and Enterprise plans, the API, Amazon Bedrock, Google Cloud’s Vertex AI, and the government and education products.

For the commercial regime, Anthropic’s enterprise materials state the default that matters to a compliance reviewer: your prompts, data, and results are not used to train Anthropic’s models by default. Its API documentation goes further for retained operational data, stating that retained data is never used for model training without express permission, and that zero data retention arrangements are available for qualifying API customers, under which inputs and outputs are not stored beyond abuse screening. The practical consequence for a CRE firm is blunt: an employee pasting a rent roll into a personal Pro account and a team working inside a Claude Enterprise workspace are in different legal and technical postures, and a firm that has not made the distinction organizationally has made it accidentally.

The table below organizes what Anthropic publishes as of August 16, 2026. The pattern to notice is that the controls a regulated manager needs concentrate at the top: Claude Enterprise carries single sign-on and SAML, domain capture, SCIM provisioning, role-based access control, audit logs, and data retention controls, and Anthropic lists SOC 2, ISO 27001, GDPR and CCPA compliance across the platform with a HIPAA-ready offering. A firm under SEC examination or investor side-letter obligations should treat those features not as luxuries but as the mechanism by which the firm can answer, in writing, who accessed what and when.

Two verification habits keep the review honest. First, check the primary pages at review time rather than relying on any summary, this article included: vendor terms move, and Anthropic maintains a trust center precisely so reviewers can pull current documents. Second, distinguish what the vendor controls from what the firm controls. Anthropic’s terms govern training and retention on its side. They do nothing about which employees can reach investor social security numbers, whether the diligence folder is overshared, or whether a departing analyst’s access was revoked. In PSV’s experience the sharpest data concerns CRE principals raise, investor PII, wiring details, LP correspondence, are governed almost entirely by the firm’s own permissioning, and connecting any AI tool simply inherits it.

Treat the Claude decision as a standard vendor review with one addition, and sequence it. First, classification: a one-page inventory of what the firm considers restricted, investor PII, banking and wiring detail, LP agreements, anything under NDA, and where it lives. Second, the plan decision: commercial terms for anything touching firm data, which in practice means Team at minimum and Enterprise where SSO, audit logs, and retention controls are required, with the consumer-account boundary written into policy so the personal-Pro-account posture cannot happen innocently. Third, permissioning: the restricted inventory becomes unreachable by ordinary seats before any AI connects, per the same least-privilege sequence PSV recommends for the Yardi connector. Fourth, the paper: pull the current terms, the trust center documents, and the data processing agreement, and file them with the review.

The addition specific to AI is an interrogation habit for outputs rather than inputs. The reviewer who signs the vendor approval should also name where AI-derived work products may go: a variance memo drafted with Claude can circulate internally, but nothing AI-derived reaches an LP, a lender, or a counterparty without a named person’s sign-off, which is the same approval gate PSV attaches to every production workflow. The output gate is not an Anthropic control and no vendor can sell it. It is the firm’s own operating standard, and it is what turns a safe tool into a safe practice.