Enterprise AI buyers have been stuck between two things they both need. Regulated teams need a zero data retention (ZDR) guarantee, so no prompt or agent transcript sits on a vendor’s servers. Security teams need misuse detection, which historically required the vendor to hold that same data long enough to correlate it.
This week, Anthropic announced Enterprise Frontier Safeguards (EFS), an architecture that tries to give both. EFS stores monitoring data in cloud infrastructure the customer controls, not Anthropic’s. Detection stays with Anthropic. Custody, keys, and human review stay with the customer.
Is it deployable today? Not yet. EFS rolls out in phases with the goal of broad availability later this fall, and access is request-based. Until it ships, eligible customers can run Claude Fable 5 and Fable 5.1 under ZDR.
The technical problem EFS is solving
Anthropic’s stated reason for retention is detection quality, not training data. The company introduced 30-day data retention starting with Fable 5, and says plainly that it has never trained on enterprise data without explicit permission.
The argument for holding data is narrow and worth restating. The most sophisticated misuse Anthropic has observed spreads across many tasks, sessions, and accounts, including cases involving stolen or misappropriated enterprise credentials. Running an automated classifier on each interaction and instantly discarding it cannot catch that shape of attack. Correlation needs a window. Anthropic has documented this pattern in its own espionage disruption work.
Regulated customers understood the security logic and still could not adopt it. So Anthropic moved the window rather than removing it.
What EFS actually changes
Anthropic built EFS with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail, and the public sector, together with AWS, Google Cloud, and Microsoft Azure. Contributors included the Analysis and Resilience Center for Systemic Risk, whose membership includes CISOs at Goldman Sachs, Morgan Stanley, Citi, Bank of America, and Wells Fargo, plus teams at Comcast, KPMG, Mastercard, Salesforce, and Visa. Anthropic says the design conversations covered a quarter of the Fortune 100 and every US global systemically important bank.
Three design decisions came out of that process:
Storage moves to the customer: Activity data used for monitoring can live in the customer’s own cloud account, under their encryption keys, access policies, and audit logging. Enterprises told Anthropic that onboarding another trusted data vendor triggers customer notifications and contract updates, so the architecture avoids creating one.
Review moves to the customer: When monitoring detects a pattern worth attention, the signal goes directly to the customer. Anthropic’s position is that automated review handles the scan; a person still adds value confirming real misuse and clearing false positives, and in regulated environments that person must be cleared for privileged legal material, non-public information, or drug-safety reports. EFS runs automated safety monitoring with no Anthropic human review required.
Detection stays with Anthropic: Automated systems analyze a rolling window of traffic for serious misuse, specifically attempts to build offensive cyber or biological capability and signs of stolen or leaked credentials.