LESSON 5 OF 5 · DEPLOYMENT ARCHITECTURE

Answer the security questionnaire in the room

By the end of this lesson you can answer the training, retention, and residency questions a client security review asks, and state exactly what ZDR does and doesn't cover.

The gate

The questionnaire is the first item in pre-kickoff for a reason

Every activation plan starts with the security onboarding questionnaire, because nothing else proceeds until it clears. Three questions decide it.

"Does our data train your models?"

Short answer: no, not under commercial terms. The full answer, including the one opt-in exception you must know about, is Topic 2.

"What do you retain, and for how long?"

Short answer: governed by your customer agreement; confirm the current retention window with your account team. ZDR is the no-server-side-persistence option on one specific path. Topics 2 and 3.

"Where does our data physically go?"

Short answer: it depends on the path you chose in 3.1, and one path behaves differently than clients assume. Topic 4.

You've already practiced the stakes: in the Meridian scenario, one wrong ZDR answer in front of a CISO cost more credibility than any architecture diagram earned back. This lesson gives you the complete answers, so the questionnaire becomes a meeting you run rather than a form you fear.

Next: Training and retention

Back: The gate

Training and retention

The answers, with the nuances that survive fact-checking

Half-right answers are worse than no answer, because security teams verify. These are the complete versions.

Training: Anthropic does not train generative models on code or prompts sent to Claude Code under commercial terms: Team, Enterprise, API, and the cloud paths alike. The one exception is explicit opt-in, such as the Development Partner Program, which an org admin must actively join, and which isn't even available on Bedrock or Vertex. Say "no, unless you explicitly opt in," not "no, never": the qualified version survives the client's own research. Retention: Server-side retention is governed by the customer agreement; confirm the current retention window with your account team or the Anthropic privacy documentation rather than quoting a number that may not match their plan. And the answer endpoint-security teams actually need: Claude Code also caches session transcripts locally on each developer's machine, in plaintext under the user's home directory, configurable via settings. That's a device-management conversation, not a cloud one.

Encryption at rest

Where inference data lives, by path

Anthropic direct

AES-256, ZDR available

Infrastructure-level disk encryption, with zero data retention as the no-server-side-persistence option for eligible Enterprise orgs. Topic 3 covers eligibility.

Amazon Bedrock

Client's AWS account, KMS optional

AES-256 with AWS-managed keys, customer-managed keys available through KMS. Retention and key policy are governed by controls the client already audits.

Google Vertex AI

Client's GCP project, CMEK optional

Google-managed encryption keys by default, customer-managed (CMEK) available. Same logic as Bedrock: the client's cloud governance applies.

Microsoft Foundry

The one that surprises people

Foundry is an Azure-native deployment — Azure billing, Microsoft Entra ID authentication, and Azure RBAC policies apply. Confirm the data routing path with Anthropic before advising clients with cloud-specific data residency requirements. The "data never leaves our tenancy" question belongs in the path conversation, not the post-mortem.

Next: ZDR, precisely

Back: Training and retention

ZDR, precisely

Zero data retention is a scope, not a slogan

ZDR applies to Claude Code on Claude for Enterprise, enabled per organization by the Anthropic account team after eligibility review. It is not in the standard Enterprise plan by default, and it is not available on the cloud paths.

What it covers

Claude Code inference, full stop

Prompts and model responses from Claude Code sessions are processed in real time and not stored after the response returns, regardless of model, except where law or abuse-handling requires it. Admin capabilities like cost controls, analytics, and audit logs keep working.

What it doesn't, and what it disables

The trade the client must choose

Not covered: claude.ai chat, Cowork, admin metadata like seat assignments, and anything third-party MCP servers process. Disabled outright because they require server-side storage: Claude Code on the web, remote sessions from the desktop app, and /feedback. And flagged sessions can still be retained up to 2 years under the usage policy. A client who wants ZDR and Claude Code on the web is choosing between them.

Also worth saying in the room: analytics under ZDR shows usage metrics but not contribution metrics, so the Day 30 scorecard should be designed around what will actually be measurable. Each new org under the same account needs its own enablement, which is a detail that bites multi-org enterprises at rollout.

Next: Residency and certifications

Back: ZDR, precisely

Residency and certifications

Residency follows the path. Certifications follow the Trust Center

If the client has a hard residency requirement, the cloud paths are where region control lives: Bedrock offers region selection across AWS regions, Vertex offers global, multi-region, and regional endpoints.

On the direct path, service availability follows Anthropic's supported countries; specific region-level processing guarantees are an account-team conversation, and the honest move is to say so rather than improvise one. For the certification half of the questionnaire, the artifact set is self-serve at trust.anthropic.com: SOC 2 Type 2, ISO 27001:2022, ISO/IEC 27017 and 27018 for cloud security and privacy, ISO/IEC 42001 for AI management systems, CSA STAR Level 2, HIPAA with BAA available, GDPR, NIST 800-171 attestation, FedRAMP High through Claude for Government, and annual third-party penetration test summaries. Knowing that list from memory is optional; knowing it's all downloadable the same day the CISO asks is not.

Working rule

Answer from the facts you can cite, name the one thing you'll verify, and never improvise a guarantee. Security teams forgive "I'll confirm the region commitment." They don't forgive a wrong yes.

Next: Scenario: the questionnaire, live

Back: Residency and certifications

Scenario · The questionnaire, live

Corvane Health's CISO reads the questions out loud

A life-sciences client, pre-kickoff, and the CISO wants answers in the meeting, not in a follow-up email. Five questions, ten points. This is the course's final gate.

Simulation

Corvane Health · Security review

Click a card to commit. Choices lock, consequences land. Green is a strong call, orange is defensible, grey costs you the room.

Credibility · 0 / 10

Question 1 of 5 · Training

"Will our source code be used to train your models?"

Choose your answer

"No, not under commercial terms, unless you explicitly opt in"

Commercial data never trains models. The only exception is an admin-level opt-in like the Development Partner Program, which you'd have to join deliberately.

Select

"It's anonymized before any training use"

Reassure them that personal and proprietary details are stripped before data reaches training pipelines.

Select

"Let me send you the data usage policy after this"

Point to the official documentation rather than risk a wrong word in the room.

Select

Question 2 of 5 · Retention

"If we go Enterprise direct without ZDR, what exactly is retained, and where?"

Choose your answer

"Server-side retention is governed by the agreement; check with your account team for the exact period"

The server-side answer, without the local transcript piece the endpoint team will need.

Select

"30 days server-side, plus local transcripts on each laptop"

The standard policy, and the part endpoint security needs: session transcripts cache in plaintext on developer machines for 30 days by default, configurable, which belongs in their device-management review.

Select

"Nothing is stored; sessions are ephemeral"

Claude Code is a real-time tool; conversations disappear when the terminal closes.

Select

Question 3 of 5 · ZDR

"We want ZDR, and our teams are excited about Claude Code on the web. Both, yes?"

Choose your answer

"Yes, both, that's the standard Enterprise package"

Keep the energy up; the details can be confirmed during onboarding.

Select

"They conflict. ZDR disables the web surface; let's choose deliberately"

ZDR disables Claude Code on the web, remote sessions, and /feedback because they require server-side storage. It's also enabled per org after eligibility review, not bundled. Frame the trade and let security and engineering decide together.

Select

"Let's secure ZDR first and revisit the web surface later"

Lock in the compliance win now; the product surface question can wait for the next phase.

Select

Question 4 of 5 · Residency

"We're an Azure shop, so we'd use Foundry, and everything stays in our tenancy. Correct?"

Choose your answer

"Broadly yes; I'll validate the specifics"

Azure-native billing and auth, with a follow-up to confirm the data flow details.

Select

"Correct, it's all inside your Azure boundary"

That's the point of going with the native cloud path; the data never leaves their subscription.

Select

"No, and that's worth pausing on: Foundry routes to Anthropic infrastructure"

Unlike Bedrock and Vertex, Foundry requests are served on Anthropic-operated infrastructure. If hard tenancy residency is the requirement, Bedrock or Vertex satisfies it the way they're assuming; Foundry doesn't.

Select

Question 5 of 5 · Evidence

"Fine. Send me your certifications and your latest pen-test results by Friday."

Choose your answer

"You'll have them today, from the Trust Center"

SOC 2 Type 2, ISO 27001 and 42001, HIPAA BAA documentation, and the annual pen-test summary are self-serve at trust.anthropic.com. Send the links before the meeting ends.

Select

"We're SOC 2 certified; that should cover your framework"

Lead with the certification most security teams anchor on and offer the rest if they need it.

Select

"I'll raise a request with Anthropic legal to compile a package"

Formal documents should come through formal channels; expect it within a couple of weeks.

Select

Engagement debrief

0 / 10

The path you took

Course artifact · Lesson 5 contribution

Deployment Decision Doc

This is the final section. With it, the doc carries everything an engagement lead needs to defend the deployment: path recommendation, parity-gap memo, network posture, gateway design, and compliance posture.

Write the compliance section for your sample client: the training answer, the retention answer including local transcripts, and the ZDR position with its trade-offs.

Add the residency statement for your recommended path and the list of certification artifacts you'd send, with the Trust Center as source.

Assemble all five sections into the finished doc, then have a colleague play the client CISO and red-team it for fifteen minutes. Every question they ask that the doc can't answer is your edit list.

With path recommendation, gateway design, and data residency complete, this document answers every question a client security review will raise before the rollout can begin.

Practice

Try this

You've covered the four deployment paths, the gateway decision, and the data residency questions that come up in every security review. Before moving on: take a sample client profile and recommend a deployment path. Write up the rationale — cloud commitments, data residency position, and the parity gaps that would affect this client. That's the core of the Deployment Decision Doc, and the judgment call you'll need to make on every engagement.