Claude Code ZDR vs Zero Data Protocol

What is Claude Code ZDR?

Claude Code is Anthropic’s agentic coding environment. Local use runs on the developer’s machine while model requests are sent over the network. Claude Code can inspect project context, propose or apply code changes, execute approved tools and return model outputs.

For commercial customers, Anthropic documents a standard retention period and a separate Zero Data Retention arrangement. ZDR is available for Claude Code on Enterprise and eligible API configurations, subject to approval. It is enabled per organization rather than inherited automatically by every account or workspace.

ZDR is not the consumer default: Claude Free, Pro and Max accounts using Claude Code follow consumer retention and privacy settings. A user should never infer ZDR merely from the Claude Code product name.

Where data moves during a coding session

1Local project contextClaude Code can read selected repository files, instructions, terminal output and other context made available during the session.

2Model requestRelevant prompts and context are transmitted to the configured model provider through an encrypted connection.

3Model outputThe service returns analysis, code, tool requests or proposed changes needed to continue the task.

4Local executionApproved commands and edits may create durable files, logs, commits, build artifacts or other results on the developer’s systems.

5Session transcriptThe local client stores plaintext session transcripts for resumption by default, with a configurable cleanup period.

6Optional servicesTelemetry, error reporting, feedback, web tools and third-party providers can introduce distinct data flows and policies.

What Claude Code ZDR covers—and what remains

Covered inputs and outputsUnder an approved ZDR arrangement, Anthropic does not store eligible inputs or outputs except for documented legal, abuse-prevention or harm-related needs.

Local session cacheClaude Code stores session transcripts locally in plaintext under the user’s project data directory for 30 days by default. The cleanup period is configurable.

Safety informationAnthropic states that User Safety classifier results are retained to enforce its Usage Policy even under qualifying ZDR arrangements.

Operational telemetryLatency, reliability and usage metrics may be recorded. Anthropic says ordinary telemetry does not include source code or file paths.

Feedback submissionsUser-initiated feedback can upload transcripts and code. Separate retention rules apply, and ZDR organizations do not receive the transcript-sharing follow-up.

Repository and outputsSource repositories, local edits, commits, generated files and external systems remain outside the narrow server-side input/output retention question.

ZDR depends on the access route

Claude Code route	Retention position	Key consideration
Consumer account	Consumer settings and retention apply	Free, Pro and Max use does not become ZDR automatically
Commercial standard	Anthropic documents a standard 30-day period for Team, Enterprise and API data	Product features allowing session history may retain information to provide that experience
Claude Code Enterprise ZDR	Available to qualified organizations and enabled per organization	Confirm the exact organization, workspaces, integrations and models covered
Anthropic API with ZDR	Eligible APIs and products using the commercial organization key may qualify	Approval and configuration must be verified in privacy controls and contractual terms
Bedrock or cloud provider	Provider-specific retention and credentials apply	The cloud environment—not the Claude Code label—governs the retention setting
Covered-model configuration	Some specially designated models require limited retention	They may be unavailable to workspaces or organizations with ZDR enabled

Why ZDR does not mean “no data exists”

Code must still be processedRelevant prompts, code and tool results enter the active context so that the model can perform the requested task.

Local copies can persistSession transcripts, repositories, branches, commits, build caches and generated files remain on customer-controlled infrastructure.

Tools create new recordsGit hosting, issue trackers, CI systems, terminals, package registries and monitoring tools have their own retention policies.

Security exceptions remainSafety classifier results and narrowly defined information may be retained for policy enforcement, legal compliance or harm prevention.

This does not make ZDR ineffective. It means that ZDR is a precise control over a specific storage boundary, not a claim that every trace of a development activity disappears.

What Zero Data Protocol adds

Zero Data Protocol is an independent architectural framework that evaluates the full data dependency of the coding workflow:

Zero CollectionDo not expose files, secrets, customer records or repository history that the coding task does not require.

Zero RetentionAvoid persistent server transcripts, local caches, diagnostic bundles and derived records beyond operational necessity.

Zero ExploitationDo not reuse code, prompts, repository context or derived knowledge for unrelated training, profiling or commercial purposes.

Claude Code ZDR can provide a strong implementation of the second pillar at the Anthropic service boundary. ZDP then extends the assessment to the developer workstation, repository, cloud provider, tools, identities, generated outputs and every downstream system.

Claude Code ZDR vs ZDP

Dimension	Claude Code ZDR	Zero Data Protocol
Primary objective	Prevent server-side persistence of eligible coding inputs and outputs	Remove unnecessary data dependence throughout the system
Meaning of “zero”	Zero retention within the approved service scope, subject to defined exceptions	Zero unnecessary collection, retention and exploitation
Availability	Qualified commercial organizations; configuration-specific	Technology-neutral design framework
Starting point	Code and prompts are submitted for model processing	First asks which code and data need to be exposed
Server retention	Eligible inputs and outputs are not persistently stored under the agreement	Persistent storage challenged across all providers and components
Local retention	Plaintext session caching exists by default and is configurable	Local transcripts and artifacts are included in lifecycle minimization
Safety metadata	Classifier results and narrow exceptions may remain	Any retained signal must be necessary, limited and non-exploitable
Model training	Commercial data is not used for training by default unless the customer opts in	Unrelated training or secondary reuse is structurally rejected
Type	Product configuration and contractual data-handling arrangement	Independent architectural framework
Relationship	Claude Code ZDR can satisfy a valuable ZDP retention control, but full ZDP alignment requires evidence across the entire development environment

The decisive difference: service retention versus system architecture

Claude Code ZDR answers a precise question: does Anthropic persist the eligible inputs and outputs handled under this approved configuration?

ZDP asks a broader series of questions: Which repository files were exposed? Were secrets or personal records necessary? What was cached locally? Which tools received the output? What durable changes were created? Could any of the information be reused for another purpose?

In one sentence: Claude Code ZDR limits persistence at an important service boundary; Zero Data Protocol maps and minimizes the entire coding-data lifecycle.

A ZDP-oriented Claude Code checklist

Verify the organization. Confirm that ZDR is enabled for the exact Enterprise organization or API organization being used.
Verify every workspace and model. Do not assume a setting applies across separate organizations, sandboxes or model classes.
Restrict repository scope. Keep secrets, production exports, customer records and unrelated directories outside the accessible context.
Manage local transcripts. Set an appropriate cleanup period and protect the plaintext session directory with device-level controls.
Disable unnecessary traffic. Review telemetry, error reporting, surveys, feedback commands and optional network services.
Control tools and permissions. Apply least privilege to shell commands, file edits, web access, connectors and external automation.
Map durable outputs. Include commits, pull requests, issue comments, generated files, logs, test fixtures and CI artifacts.
Document exceptions. Record safety, legal and abuse-prevention data that can remain despite the ZDR label.

Frequently asked questions

Is Claude Code Zero Data Retention enabled by default?

No. Anthropic describes it as available to qualified commercial organizations, enabled separately for each organization. Consumer accounts follow their own privacy and retention settings.

Does ZDR stop Claude Code from reading my code?

No. Claude Code must process the project context submitted or made available for the task. ZDR concerns persistence after processing, not the absence of processing.

Does Claude Code store transcripts locally?

Yes. Anthropic documents local plaintext session transcripts retained for 30 days by default to support session resumption. The cleanup period can be changed.

Does Anthropic train on commercial Claude Code data?

Anthropic states that it does not train generative models on code or prompts submitted under commercial terms unless the customer has explicitly opted to provide data for improvement.

Does ZDR cover every model and integration?

No assumption should be made. Model eligibility, cloud-provider routing, optional features and contractual coverage can differ. Current documentation and account settings must be checked.

Is Claude Code ZDR equivalent to ZDP?

No. It can strongly support Zero Retention at one boundary. ZDP also covers Zero Collection and Zero Exploitation throughout the surrounding architecture.

About the author and framework
Lajos Nagy develops and documents Zero Data Protocol as an independent architectural framework. ZDP is not a product certification, a regulatory approval or a substitute for legal and security assessment.

Editorial notice: Anthropic, Claude and Claude Code are cited for identification and independent comparative analysis only. No affiliation, endorsement or equivalence with Zero Data Protocol is claimed. Product settings, model eligibility, retention rules and contractual terms can change. Verify current Anthropic documentation and the exact configuration of each organization before making privacy, security or compliance decisions.