Anthropic is backing off a data retention policy that enterprise customers have quietly hated since June. The company had been storing all customer data from its Mythos and Fable models — along with future flagship releases — for 30 days on its own servers, ostensibly to detect new cyberattacks that weaponize the technology. That’s now changing: the retention window stays, but the data will sit in the customer’s own cloud environment instead of Anthropic’s infrastructure.
Anthropic admitted in a report that the policy was both unpopular and a genuine business risk. The company spent months building the new system alongside more than 100 customers from regulated industries, according to Bloomberg. That’s not a trivial cohort — banks, healthcare providers, and government contractors don’t hand over data retention questions lightly, and their collective pushback clearly registered. Developer Boris Cherny confirmed the plans on X, with the rollout expected this fall.
The move mirrors what OpenAI is attempting with Databricks and Microsoft, though OpenAI is testing a different technical approach to the same core tension: how do you monitor for abuse without holding onto sensitive customer data yourself? Security teams want visibility. Compliance teams want custody. For years those two demands were treated as irreconcilable, and Anthropic’s initial 30-day policy was a blunt compromise that satisfied neither side.
What’s notable here is the speed of the reversal. Anthropic shipped the retention rule in June and is already walking it back before the end of the year. That’s fast for an enterprise policy change, and it signals how much leverage large customers have in the foundation model market. When OpenAI, Google, and Anthropic all offer broadly similar capabilities, data governance becomes a deal-breaker rather than a nice-to-have. Anthropic appears to have learned that lesson the expensive way — by watching deals stall in regulated sectors where the 30-day window was a non-starter. Whether the customer-cloud approach actually satisfies auditors remains to be seen, but it certainly removes the most obvious objection.
