Anthropic announced Enterprise Frontier Safeguards (EFS) this week, replacing the data retention policy that had been a sticking point for business customers — particularly those in regulated industries who needed both AI safety monitoring and a defensible answer to “where does our data actually live.” Under EFS, activity data used for misuse detection is stored in infrastructure the customer controls — their own AWS S3, Azure Blob Storage, or Google Cloud Storage, under their own encryption keys and access policies — rather than on Anthropic’s servers. Automated monitoring still scans for misuse, but without a human at Anthropic reviewing customer data by default, and without Anthropic holding a persistent copy of it.
Anthropic says it built this with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail and the public sector — the exact sectors where “we don’t retain your data, but you need to trust us on that” was never going to be a satisfying answer to a compliance team. Rollout is phased through the autumn, and Anthropic isn’t charging for it.
Why this matters beyond Anthropic’s own customer base
This is a template, not just a policy update. The core tension EFS is solving — an AI vendor needs some visibility into usage to catch misuse, but a regulated customer needs to prove data sovereignty to its own auditors — applies to every AI vendor selling into healthcare, finance, or government, not just Anthropic. Expect competitors to be pushed toward similar customer-controlled-infrastructure models over the next year, because once one major vendor offers it, “trust us” from everyone else gets harder to accept. If you’re specifying AI tooling requirements for a regulated software build today, “where is monitoring data stored, and who controls it” is now a fair, answerable question to put to any vendor — not a hypothetical one.
So what
For teams building software that touches patient data, financial records, or other regulated information, this is a useful lens for evaluating any AI component in the stack: does the vendor’s safety and monitoring architecture actually respect your data boundary, or does it just say it does? We build this kind of due diligence into how we scope AI-assisted projects for regulated clients — see our healthcare software development work, or get in touch if you’re planning a build where data governance is non-negotiable.