Your spam filter has quietly scored your email for years. Claude now does the same to its own chats, and for a Canadian firm the plan your staff sign in on decides how long a flagged chat stays with the vendor.
- Claude conversation monitoring now includes a self-check after every reply, on every Claude model since Fable 5.
- Flags are rolled up by organization each night, and repeat high-priority flags go to human reviewers.
- Traffic under a zero data retention agreement is excluded today.
- On consumer plans, a flagged chat can be kept for up to 2 years.
- Under PIPEDA, client data your staff paste in is still your responsibility.
Claude conversation monitoring got a new layer this fall. In an October 16 post on its Safeguards blog, Anthropic said Claude now grades each chat for safety the moment it finishes replying, a step live on real customer traffic since the Fable 5 release in June. Whether a flagged chat then stays with Anthropic for 30 days or up to 2 years depends on the account your staff used, and traffic under a zero data retention agreement is not checked at all today. Our view is that the monitor itself is reasonable engineering. The part a Canadian business controls is which account its people use.
How does Claude conversation monitoring work now?
After each reply, Anthropic adds a hidden instruction asking Claude to judge the conversation. Claude answers in a fixed format: flagged or not, the harm category, a priority score for human review from 1 to 10, whether it refused, and a one-sentence reason. The user sees none of this, and the grading text is dropped before the next turn.
In production the check is passive. It flags for review and does not block anything. Anthropic says the extra work adds less than 2% to its inference compute and that it does not bill this cost to customers. Anthropic also says plainly that a flag is only a signal for further review. It is no finding that anyone broke its rules.
How does a flag reach a human reviewer?
Through your organization as a whole. Each night Anthropic groups the flags by customer account. When one organization collects several urgent ones, its enforcement staff take a look. The areas where this feeds enforcement include fraud and scams, weapons, violent extremism, influence operations, election integrity and child sexual abuse material.
That design is why one awkward question from a staff member is unlikely to matter, while a pattern might. Picture, as an illustration, a credit union fraud team in Saskatoon that spends a week asking Claude to explain new scam scripts is doing legitimate work in a flagged category. Anthropic’s post shows it can tell the monitor about approved work at deployment time, using an allowlist of vulnerability research targets in its own tests. Whether a given customer can get that treatment is a contract question we have not seen answered in public.
What PIPEDA asks of the firm, not the vendor
Because PIPEDA puts the duty on you. The Privacy Commissioner’s guidelines on processing across borders quote Principle 4.1.3: an organization stays responsible for personal information it transfers to a third party for processing, and must use contracts or other means to get a comparable level of protection.
A staff member who pastes a client’s file into a personal Pro account has moved that data outside any contract your firm signed. If that chat is flagged, the consumer retention terms allow Anthropic to keep it for up to 2 years. The monitor did nothing wrong in that story. The account choice did. Our guide to Anthropic’s usage policy changes covers the rules a flag is measured against.
What the vendor measured, and what it chose to stress
Anthropic’s own figures for Fable 5: when it tolerates wrongly flagging 1% of harmless chats, the self-check finds 78% of what a stronger grading model flags, rising to 94% for the most urgent cases. Anthropic built that stronger classifier, picked the traffic sample and graded the result, so this is a vendor measurement against a vendor baseline.
The post is candid about weak spots. In a red-team test, self-assessment as a blocker cut attack success only from 79% to 54% across 24 tasks. It concedes that a 1% error rate still means plenty of innocent chats get marked. Illustrative: a 40-person office that sends 5,000 chats a month would see about 50 harmless conversations flagged at that rate (5,000 × 1% = 50). Real rates on your own traffic are unknown.
What we ran and what we didn’t: we read the post, the retention pages and the Enterprise Frontier Safeguards announcement. We have not tested self-assessment and could not, because its verdicts are hidden from users.
What nobody outside Anthropic can check yet
Customers cannot see their own flags. On standard commercial plans today, nothing in the post says a business is told when its staff trip the monitor, so a firm learns about a pattern only if Anthropic escalates it. Anthropic’s Enterprise Frontier Safeguards plan says signals will go straight to customers and data can sit in the customer’s own cloud, rolling out in phases starting later this fall. Until a Canadian customer can confirm it has that, the visibility gap stays open.
The disclosure that would settle it
A published date for Enterprise Frontier Safeguards in Canadian cloud regions, plus a customer-facing flag report on standard plans, would close most of this gap. We will recheck when the phased rollout reaches general availability.
An afternoon audit: which Claude accounts touch client data?
- List every account. Ask each team lead which Claude logins their people use, including personal ones.
- Tag the plan. Consumer, commercial or zero data retention.
- Mark client data. Note which accounts have seen names, files or account numbers in the last 30 days.
- Ask your rep one question in writing. Can we see flags on our organization, and when?
For the security side of the same audit, our piece on forgotten AI API keys pairs well, and the AI tools for Canadian businesses hub lists other vendor checks.
FAQ
Does Anthropic monitor Claude conversations?
Yes. Claude conversation monitoring includes a self-check after each reply on models since Fable 5, plus other classifiers. Flags are reviewed by humans when an organization has several high-priority ones.
Does self-assessment run on zero data retention accounts?
No. Anthropic says chats under a zero data retention agreement are left out of the self-check for now.
How long does Anthropic keep a flagged chat?
On consumer plans, Anthropic may hold the chat itself for as long as 2 years and the safety score for as long as 7. Commercial plans moved to 30-day retention starting with Fable 5.
Is my business responsible under PIPEDA if staff paste client data into Claude?
Yes. Principle 4.1.3 keeps your firm accountable for client information it hands to an outside processor. Our practical AI tips section has more on setting staff rules.
Facts checked October 30, 2026.
