For professions · reviewed 2026-11-01
Claude for professions bound by confidentiality
Tax advisers, legal counsel, advocates and accounting offices work with clients' personal data every day. bareminimum lets you use Claude on that work while names, addresses and Polish identifiers reach Anthropic as consistent stand-ins, and come back restored.
Your profession
- Tax advisers: confidentiality of client data when using AI tools, in your code of ethics since 2026.
- Legal counsel: professional secrecy and KIRP's recommendations on AI.
- Advocates: professional secrecy and the CCBE's guide on generative AI.
- Accounting and payroll offices: processing clients' data on their behalf.
Questions professionals ask
Is this anonymization?
No. The gateway can restore the originals and the stand-ins keep their context, so under GDPR art. 4(5) this is pseudonymization - what Anthropic receives remains personal data. It reduces what identifies your clients; it does not make a prompt anonymous.
What exactly reaches Anthropic?
Your conversation, with stand-ins for the people, addresses and identifiers found, and everything else as written. The privacy page lists what still crosses, and the verify page shows how to see it with your own data.
Where are the originals kept?
Nowhere at rest. They pass through the gateway's memory while a request and its reply stream; a stand-in is computed from a key, not looked up in a stored table.
What does the gateway's operator see and log?
Requests pass through its server's memory. Its logs hold your email, the model, token counts and time per reply, and per request the path, user agent and referrer - never the text.
What is not caught?
Health conditions, company names, a city on its own, an address abroad, URLs and driving licence numbers are left by design; a name in lowercase or in another language may be missed; and the facts of a matter can still point to a person. Images and PDFs are refused, not read.
Does this satisfy my chamber's rules or the GDPR?
It is one technical safeguard you can describe in your records. Whether it meets your professional and data protection duties is your assessment; the pages for each profession cite what its rules say.
Do I need a processing agreement?
The gateway's operator handles your clients' data on your behalf while it passes, and so does Anthropic. Whether GDPR art. 28 requires agreements for that chain, and with whom, is yours to assess.