Is Claude Safe for Confidential Bid Work? The Plan and Settings to Use

Is Claude safe for confidential bid work? Yes, on a Team or Enterprise plan with a few settings changed, and a personal Free, Pro or Max account is the wrong place for a buyer’s RFP.

Team and Enterprise fall under Anthropic’s Commercial Terms, which say Anthropic may not train models on your content and treat it as your confidential information. The exception is a chat someone rates, kept for up to five years unless an owner switches feedback off.

Whether a buyer’s RFP may go into Claude at all depends on that buyer’s confidentiality terms, so read them before anyone uploads it.

This guide is part of a series on using Claude across a bid, and each rule carries its Anthropic page’s date, as read on November 9, 2026.

Put Buyer Documents on a Team or Enterprise Plan

Anthropic runs consumer rules for individual plans and the Commercial Terms for Team, Enterprise and the API, and a buyer’s confidential documents belong under the Commercial Terms. There is also the short version in our ChatGPT or Claude comparison.

Sources, all Anthropic: the commercial training article (August 18, 2026), consumer training article (March 16, 2026), commercial and consumer retention articles (July 1, 2026), Commercial Terms (effective June 17, 2025) and pricing page, which lists Ultra as an individual plan (read November 9, 2026).

Why a Personal Pro Account Is the Wrong Home for a Buyer’s RFP

Earlier advice, including AutoRFP.ai’s own AI Go/No-Go webinar and its Claude Cowork security questionnaire video, said to use a paid subscription with data sharing off. That gets one thing right: turning training off stops Anthropic training on future chats. On Pro and Max, it leaves three gaps:

• No Commercial Terms. The no-training clause and the line that “Customer Content is Customer’s Confidential Information” (clause E.1) don’t apply.
• No company control. The setting belongs to each person, so the company can’t see or enforce it.
• No organization-wide feedback switch. No owner can turn feedback off for everyone.

Move the team onto Team or Enterprise first, then change the settings. Enterprise adds custom retention and, per Anthropic’s connectors article (November 6, 2026), a US-only inference setting.

Does Claude Train on Your Data?

On Team, Enterprise and the API, Anthropic says it will not use your inputs or outputs to train its models by default. On individual plans, it trains on chats only if the user allows it.

Anthropic’s commercial training article, updated August 18, 2026, says: “By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.” The exceptions it names are feedback or bug reports you explicitly send, or another choice to allow it.

On individual plans:

• The choice dates from 2025. Anthropic’s consumer terms update of August 28, 2025 gave existing users until October 8, 2025 to decide, and says the updates “do not apply to services under our Commercial Terms.”
• Switching off stops future training only. Data already in a training run that has started, or in a trained model, stays there (Anthropic’s settings article, August 3, 2026).

Switch Off Thumbs-Up and Thumbs-Down Feedback

Feedback is the main exception. When someone rates a chat, Anthropic stores “the entire related conversation, including any content, custom styles, conversation preferences, or model settings” for up to five years and may use it for training, minus raw connector content that wasn’t copied into the chat (August 18, 2026).

Team and Enterprise owners can turn the buttons off with Rate chats under Organization settings > Data and Privacy. Switch it off, or tell the team never to rate a chat that holds a buyer’s document.

How Long Does Claude Keep Your Data?

Claude keeps chats until someone deletes them, and only Enterprise lets an owner set a retention period, of at least 30 days. Projects follow their own clock.

Custom retention has exceptions, such as standalone Claude Design, cloud features that run Claude Code and artifacts published with a public link (Enterprise retention article, November 4, 2026).

Pro tip: A tender project the team opens every week never ages out. Close it when the bid ends, archiving or deleting it as the buyer’s terms require.

Check the Buyer’s Confidentiality Terms Before Upload

Anthropic’s terms protect your content once it is in Claude, but the buyer’s confidentiality terms and any NDA your team signed decide whether its RFP may go in at all.

Under clause L.1 of the Commercial Terms, the customer “represents and warrants that it has all rights and permissions required to submit Inputs to the Services,” so Anthropic can’t clear a buyer’s NDA for you. Read three things first:

• The RFP’s confidentiality section: what the buyer treats as confidential.
• Any NDA signed to receive the documents: common on private, invite-only RFPs, and a case for legal or IT.
• Your own client contracts: they govern the references and case studies you plan to use.

Unless the terms allow it, keep pricing, named client references, draft contracts and anything the NDA lists out of shared Claude projects, and paste only the part a task needs.

General-purpose assistants are already part of how many bid teams read an RFP. Stargazy surveyed bid teams for its 2026 RFP analysis report together with a company that sells bid software:

How to Answer an AI Disclosure Question in a Tender

When a tender asks whether you used AI, answer truthfully and specifically: which tasks Claude helped with, which plan and settings protected the buyer’s documents, and who checked every answer.

In the UK, the reference point is PPN 017: Improving transparency of AI use in procurement, published by the Cabinet Office on February 17, 2025:

• AI use is allowed. Suppliers’ use of AI “is not prohibited during the commercial process,” and buyers should weigh it as they would a supplier’s use of a bid writer.
• Its example questions are for information. Annex B asks whether AI tools were used and whether AI-generated content was “checked and verified for accuracy,” and PPN 017 says to use them “for information only.”
• Scored AI questions must be declared in the tender documents.
• Buyers may restrict training. PPN 017 suggests controls so suppliers don’t use the buyer’s confidential information as AI training data.

Keep one legal-approved paragraph that names the tasks, controls and check in the tender’s format, and update it when your setup changes:

Outside the UK, follow the tender’s instructions, and ask the buyer through the official channel when a question is unclear.

How to Guard Against Prompt Injection in Tender Files

Prompt injection is text hidden in a document or web page that tries to give Claude new instructions, and it can arrive in any file the team didn’t write, from buyer attachments to web research.

Anthropic’s Cowork safety article, updated October 30, 2026, says an attack needs both untrusted content for Claude to read and actions it could take to harm you, so removing either makes it harder. It adds that “the chances of an attack are still non-zero.”

A hypothetical example: white text in a buyer’s attachment tells the assistant to email the folder to an outside address, or to mark every requirement “compliant.”

A bid team can set four controls:

• Scope: give Claude only the tender folder and the connectors the task needs.
• Approval: set write and send tools to Needs approval.
• Reading: read every request to share data or take an action before approving it.
• Checking: check drafted claims against the source documents.

Claude Code starts terminal and VS Code sessions in auto mode, where a classifier blocks actions it judges unsafe (Anthropic’s security documentation, read November 9, 2026). Manual mode, which asks before Claude edits files or runs commands, suits a tender folder; see setting up Claude Code on a tender folder.

What One Public Tender’s Terms Allowed Into Claude

On a public tender, the buyer’s pack is usually the safe input and your own material is the part to protect. This series uses State of Maine RFP# 202506081, a state agency case management software tender issued July 15, 2025 (Maine procurement archive), answered by Tallowfield Systems, a fictional bidder. Nothing was submitted.

What the RFP’s own terms say:

• Submissions become public. After the award decision, “all submissions in response to this RFP will be public records” under Maine’s Freedom of Access Act.
• Confidentiality must be claimed. A bidder must mark any confidential information and cite legal authority for it.
• The NDA comes with the contract. The awarded bidder signs an IT Service Contract “with Confidentiality and Non-Disclosure Agreement (NDA).”
• No AI question. The RFP and its Q&A ask nothing about AI use in preparing a bid.

So the tender pack could go into Claude. The fictional bidder’s pricing, references and client names were the sensitive part: kept out of shared projects, and, in a real response, marked confidential with the legal authority cited, since the state publishes submissions after award.

Check any public tender the same way: what becomes public after award, what you must mark, and when an NDA starts to apply.

Approve Each Connector, Folder and Skill Separately

Every connector, connected folder and installed skill widens what Claude can read or do, so each needs its own approval and a named owner.

Check What Each Connector Can Reach

Anthropic’s connectors article (November 6, 2026) says a connector works with each person’s own permissions, and connected services process data “on their own infrastructure, under their own terms.”

• Hold writes: owners can block write tools and turn off “Share chats that use connectors.”
• Check SharePoint first: the Microsoft 365 connector searches the whole SharePoint tenant (Anthropic’s setup article for that connector, November 4, 2026).

The connectors guide explains how Claude connectors reach SharePoint and other apps.

Give Cowork One Folder per Tender

Anthropic says Cowork tasks run on its servers and reach your computer only through the folders you connect, and anything Claude opens there is processed on Anthropic’s servers (October 30, 2026).

• One folder per tender: never one that also holds pricing models or HR files.
• Scheduled tasks: take care, because they run when nobody is watching.

Vet a Third-Party Skill Before You Install It

Anthropic’s skills article, updated October 30, 2026, says to install skills only from trusted sources and, for a less-trusted skill such as one a colleague shares, to read its bundled files first. Run five checks:

1. Source: who published it, and where did the file come from?
2. Instructions: read SKILL.md and every reference file.
3. Scripts: list any scripts and the packages they import.
4. Network: look for network calls or instructions to send data.
5. Writes: check what the skill asks Claude to change.

Two free skill packages, unlocked with an email address, show the range (read November 9, 2026): the PDF Insight Finder skill ships one 77-line script that writes a highlighted PDF with no network calls, and the AI Go/No-Go skill is instructions only. To write your own, see building your own bid skill.

AutoRFP.ai as the Approved Source Claude Reads

AutoRFP.ai lets Claude read a bid team’s approved answers, each linked to its source, so drafting on a confidential bid starts from governed content and needs no search across every SharePoint folder.

The AutoRFP.ai connector serves approved answers at two levels: read scopes (tags:read, projects:read, content:read) for lookups in projects, requirements and approved content, and full scopes (projects, content, tags) that add writing to projects and content. Either way, Claude acts as the signed-in person with their AutoRFP.ai permissions, and approvals stay inside AutoRFP.ai’s workflow.

A sensible team rule, and the team’s own choice: read scopes for most people, full scopes for the named roles that maintain projects or the library.

Inside AutoRFP.ai, every answer is written only from content the team has approved and cites the sources behind it, and a question the content can’t support is routed to a person. AutoRFP.ai also keeps confidential bid content inside each customer’s boundary:

• Scoped retrieval: every search and retrieval is scoped to the customer’s own organization at the query level.
• Team-exclusive collections: they limit what colleagues, and the AI drafting for them, can retrieve.
• Separate confidential projects: kept apart from reusable content.
• No training on customer content: AutoRFP.ai doesn’t train its own models, or anyone else’s, on it, and each AI request sends model providers under contract only the excerpts that answer needs.

AutoRFP.ai is SOC 2 Type II and ISO 27001 certified, both independently audited, so a security reviewer can assess it from the reports in AutoRFP.ai’s Trust Center. See how AI proposal software that drafts from approved content fits alongside Claude.

What to Send IT Before a Bid Team Uses Claude

Send IT one page that names the plan, the settings, the connectors and an owner for each, so security approves a known configuration.

Attach this guide’s dated Anthropic links, name who re-checks them each quarter, and send the page before the next private RFP arrives.