Guide · Claude Code

Claude Code security: keep sensitive data out

What Claude Code sends to the provider, which files and commands it can reach, and how to set a controlled request path.

Last reviewed

Share

The short answer. Claude Code runs on your machine and sends each turn of a session to the model provider. That request carries your prompts, the contents of files Claude Code reads, and the output of the commands and tools it runs. A key in a .env file or a customer record in a log travels with it.

Claude Code security starts with three boundaries: what it may read or run, what enters the provider request, and who reviews the action and resulting change.

What reaches the model provider without a gateway

Anthropic’s documentation is direct about it. Claude Code runs locally, and to interact with the model it sends data over the network, including all user prompts and model outputs, encrypted in transit (Data usage). What the model sees is the session’s context window, which holds your conversation history, file contents, command outputs, and your CLAUDE.md (How Claude Code works).

  • Your prompts. Everything you type or paste, including a stack trace with a connection string in it.
  • Files it reads. Claude Code reads files in your project to do the task. A file it opens becomes part of the context.
  • Tool and command output. Test runs, logs, query results, and anything an MCP server returns feed back into the next request.

On the provider side, Anthropic states a standard 30-day retention period for commercial accounts (Team, Enterprise, and API), and 30 days or five years for consumer accounts depending on the model-improvement setting (Data usage). Claude Code also supports routing through an LLM gateway, which it reaches through the ANTHROPIC_BASE_URL variable (Other LLM gateways). Sentinel is that kind of gateway.

Set it up

On Windows, install the Sentinel app and click Connect; Claude Code is picked up automatically. On macOS or Linux, pip install superwise-sentinel-cli then sentinel quickstart. Each takes a few minutes. Mac users can read how to protect prompts with the Sentinel CLI on a Mac. IT teams can review Sentinel for IT.

Step-by-step in the docs

What Sentinel replaces

Each guardrail either replaces what it finds with placeholder text and forwards the request, or blocks the request outright. You choose per guardrail, and you can change the placeholder text (Guardrails).

WhatExamplesDocumented in
Email addressesA customer email in a log line or a support ticketPII redaction
Phone numbersUS and international numbersPII redaction
Account numbersBank account numbers, IBANs, and credit card numbersPII redaction
API keys and credentialsOpenAI, Anthropic, and Google API keys, AWS access keys, GitHub and Slack tokens, Stripe keys, JWTs, and bearer tokensSecret and credential detection
Government IDsSocial Security numbers and labeled tax IDsPII redaction

Before and after

A prompt as Claude Code would send it, and as the provider receives it through Sentinel.

Sent by Claude Code

Why does the export fail for jane.doe@example.com?
She called from 415-555-0132.
The job uses AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE

Received by the provider

Why does the export fail for {{REDACTED}}?
She called from {{REDACTED}}.
The job uses AWS_ACCESS_KEY_ID={{REDACTED}}

The replacement text shown is the default. The admin chooses whether Sentinel redacts or blocks, and sets the replacement text. Prompts go straight to the AI provider; the control plane receives only check metadata: counts, which rule fired, and latency (Data privacy).

Also worth setting in Claude Code

Sentinel cleans what is sent. Claude Code’s own permission rules decide what it may read in the first place. A deny rule such as Read(./.env) or Read(./secrets/**) blocks its file tools from reading those paths (Configure permissions). Anthropic’s security page covers permission modes, sandboxing, and prompt injection.

Next steps

Set the company rule first with the AI acceptable use policy template and kit.

Try the live demo

Run a prompt through a live gateway. No install, no sign-up.

Sentinel for Windows

The desktop app for Windows 10 and 11. Free for 30 days.

SUPERWISE Sentinel

Where it runs, what it covers, and how the gateway works.

Protect ChatGPT on Windows

Apply the same data-boundary approach to ChatGPT in Chrome and Edge.

Is Codex safe?

Review Codex CLI, IDE, cloud, sandbox, and data controls.

Claude Cowork security

Set cloud execution, file, network, and approval boundaries.

Is DeepSeek safe?

Read where its policy says data is stored and what regulators did.

Is Microsoft Copilot safe?

Separate the work account from the consumer app.

Is Gemini safe?

Compare Gemini Apps, Workspace, and the API.

Is Claude safe?

Compare consumer, Team and Enterprise, and API data handling.

Frequently asked questions

Is Claude Code secure?

Claude Code provides permissions and sandboxing controls. A secure company setup limits readable files, commands, network access, credentials, account access, and review authority for each task.

Does Claude Code send code to Anthropic?

Claude Code sends prompts and session context to the model provider. That context can include files Claude Code reads and output returned by commands and tools.

Can Claude Code access all files?

Claude Code can access files allowed by its operating-system, sandbox, and permission boundaries. Deny rules can block paths such as environment files and secrets directories.

Can Claude Code run commands?

Yes. Claude Code can run shell commands allowed by its permission mode and sandbox. Teams should limit commands and network access to the task and review the resulting changes.

Keep going

A practical next step

Sentinel catches sensitive values such as email addresses, phone numbers, card numbers, and API keys before a prompt leaves. For each request Sentinel records metadata only: counts, which rule fired, and latency. Prompts go straight to the AI provider; SUPERWISE receives only check metadata.
Share this page
LinkedInEmailXFacebook

Sources

All read on 2026-10-07.