Claude Code Enterprise Security & Compliance

Claude Code introduces a new category of access control challenge for enterprise security and compliance teams.

It is not a passive tool. It is an agent with file system access, shell execution capability, and connections to internal systems via MCP. Securing it at enterprise scale requires governance layers that most teams have not built yet.

Key Takeaways

• Anthropic holds SOC 2 Type I and II, ISO 27001:2022, and ISO/IEC 42001:2023: Verified credentials, but compliance is your responsibility, not Anthropic’s.
• HIPAA BAA is available but narrow: Enterprise plans only (50+ seats, sales-assisted). Standard Enterprise plans do not include BAA coverage without specific activation.
• Claude Code features excluded from HIPAA scope: Desktop remote mode, Web, Code Review, Computer Use, and Remote Control are all outside the BAA.
• ZDR excludes key features: Batch API, Files API, Skills API, code execution, programmatic tool calls, and the MCP connector are all out of ZDR scope.
• Subagents are a new access control category: Each subagent inherits tool access from the main session by default, including MCP connections.
• EU AI Act high-risk requirements apply from August 2026: Organizations using Claude for high-risk use cases face conformity assessment obligations.

Anthropic’s Compliance Certifications

Anthropic publishes the following compliance credentials for its commercial API and Enterprise products. All certifications are verifiable through trust.anthropic.com.

Always verify against the live Trust Center before acting. Anthropic revises BAA scope and certification coverage frequently.

HIPAA: What Is and Is Not Covered

HIPAA compliance for Claude is the most misunderstood area in enterprise procurement. Several common assumptions are wrong.

What HIPAA coverage requires:

• A sales-assisted Enterprise plan with a minimum of 50 seats
• Explicit BAA activation by a Primary Owner of the Enterprise account (not automatic)
• Individual and Team plans (Free, Pro, Max) have no BAA option at all

Claude Code features covered under HIPAA BAA:

• The first-party API (Messages API is the primary covered surface)
• Claude for Enterprise web interface (with restrictions)

Claude Code features explicitly NOT covered under HIPAA BAA:

Signing an Enterprise contract does not make Claude HIPAA compliant. The BAA must be explicitly activated by a Primary Owner. Until that activation occurs, the account operates under standard data handling terms.

Alternative HIPAA path via AWS Bedrock:

Claude models are available on AWS Bedrock as first-class foundation models. Bedrock is a HIPAA-eligible service under the AWS BAA. Prompts, inputs, and outputs stay inside AWS infrastructure. Anthropic never receives the data.

For most healthcare organizations, Claude on Bedrock under the AWS BAA is simpler than the Anthropic-direct BAA path: one BAA, data residency control, and integration with existing AWS security infrastructure.

Zero Data Retention (ZDR)

Zero Data Retention prevents Anthropic from storing prompt and response data beyond what is required to complete the request. It is available on the Messages and Token Counting APIs.

Features excluded from ZDR scope:

• Batch API
• Files API
• Skills API
• Code execution
• Programmatic tool calling
• MCP connector

For enterprise teams with strict data retention requirements, ZDR on the Messages API covers the core use case. Any workflow that requires Batch API, Files API, or MCP connectors must be evaluated separately.

EU AI Act Obligations

Key provisions of the EU AI Act are now in effect. High-risk AI system requirements apply from August 2, 2026.

The steepest fines reach 7 percent of global annual revenue for the most serious violations.

EU AI Act obligations for enterprises using Claude:

Organizations must evaluate their specific Claude use cases against the EU AI Act’s Annex III high-risk categories before August 2026. Deploying Claude for high-risk use cases without a completed conformity assessment creates regulatory exposure.

For GDPR, a Data Protection Impact Assessment (DPIA) is required for processing likely to pose high risk to individuals’ rights and freedoms. Enterprise AI deployments may trigger this requirement depending on the specific use case.

Subagent Access Control: The Gap Most Enterprise Teams Miss

Claude Code’s subagent architecture is a new access control category that most enterprise security policies have not addressed.

When Claude Code spawns a subagent:

• The subagent inherits tool access from the main session by default
• This includes all MCP server connections established by the main session
• The subagent can access any data source the main agent can reach
• Multiple subagents can run concurrently in the background

This means your access control policy must answer: which subagents can run, what tools can they access, who approved their permissions before launch, and how are their actions logged separately from the main session?

Enterprise subagent governance requirements:

• Document which subagents are permitted in your CLAUDE.md and policy documentation
• Implement tool restrictions using --allowedTools for subagent-specific contexts
• Audit subagent tool call logs separately from main session logs
• Review subagent permissions when any MCP server is added or modified
• Version-control subagent configurations with the same review process as any production configuration

Enterprise Deployment Architecture

A secure enterprise Claude Code deployment has four layers between developers and the systems Claude Code can access.

Layer 1: Identity and Authentication

Replace shared API keys with individual user authentication via SSO.

• Integrate Claude Code with your existing identity provider (Okta, Microsoft Entra ID, or similar)
• Each developer authenticates with their corporate credentials
• Every Claude Code action is traceable to an individual user, not a shared API key
• Terminate access immediately when an employee leaves by revoking their identity provider credentials

Layer 2: AI Gateway

Route all Claude Code traffic through a centralized AI gateway rather than direct API connections.

An AI gateway provides:

• Centralized API key management (developers never hold raw keys)
• Rate limiting and cost controls per user or team
• Prompt and response logging for audit trails
• PII detection and redaction before prompts reach the API
• Model access control (restrict which models specific teams can use)

Layer 3: MCP Governance

Maintain an approved MCP server list and enforce it through managed settings.

• Document all approved MCP servers in a centralized registry
• Require security review before any new MCP server is added to the approved list
• Use managed settings to block unapproved MCP servers at the permission level
• Log all MCP tool calls with full parameters for audit review

Layer 4: Observability

Export OpenTelemetry data for a complete audit trail of Claude Code actions.

Claude Code supports OpenTelemetry export for tool call logging. Configure it to capture:

• All tool calls with parameters and results
• Session identifiers linked to individual user accounts
• Timing data for cost attribution
• Error and exception events

Route this data to your existing SIEM or audit log infrastructure. For SOC 2 compliance, tool call logs must be retained and reviewable for the audit period.

SOC 2 Considerations for Claude Code Deployments

Enterprise teams using Claude Code in development workflows face SOC 2 implications in several control areas.

Access control (CC6):

Claude Code’s role-based access controls (added to Enterprise in 2026) map tool and data access to existing roles. Document which roles have Claude Code access, what tools each role can reach, and your offboarding procedure.

Change management (CC8):

Claude Code can commit and push code. This activity must be captured in your change management audit trail. Either require human review before commits, or ensure your VCS audit logging captures Claude Code-initiated changes.

Risk assessment (CC4):

Your risk register must include Claude Code as a new risk category covering: prompt injection, unauthorized data access via overpermissioned file system or MCP, secrets exposure, and subagent access scope.

Monitoring (CC7):

Real-time monitoring of Claude Code tool invocations, Bash commands, and file operations is a baseline SOC 2 requirement. OpenTelemetry export and a PreToolUse hook for shell command logging together meet most auditor requirements in this category.

Compliance Configuration Checklist

For the full technical security audit covering hooks, secrets handling, and CI/CD pipeline controls, see the Claude Code security audit checklist.

Need Help Building Enterprise Claude Code Governance?

Most enterprise security teams understand traditional application security. Claude Code introduces agentic access patterns, subagent inheritance, and MCP integration that fall outside existing governance frameworks.

Phos AI Labs is an embedded AI consulting firm for small and mid-market businesses.

We identify the right AI problems, build the strategy, handle implementation, and train your team until AI is how the business actually runs.

• Strategy before systems: We establish which Claude Code workflows require which compliance controls before any implementation begins.
• AI Foundations that hold: We install the operating context, decision rules, and configuration standards your team runs on for years.
• Real team training: We build compliance fluency inside your actual workflows, not in generic training sessions.
• Private AI Workspace: We design a company-wide AI environment built around your knowledge base and existing stack.
• AI Implementation: We rebuild the workflows that matter most with compliance and governance built in from the start.
• Honest judgment, every time: We tell you which compliance controls apply to your specific use cases and which do not.
• We stay until it compounds: We are not done when the policy document is delivered. We are done when the controls are running.

400+ engagements. Clients include Zapier, Coca-Cola, Medtronic, Dataiku, and American Express.

For certified Claude Code development with compliance-aware architecture from day one, LOW/CODE Agency is one of the first Anthropic partners worldwide with 10+ CCA-F certified developers on staff.

If you want your Claude Code compliance posture to hold under audit, talk to the team at Phos AI Labs.

Frequently Asked Questions

Is Claude Code HIPAA compliant?

Not by default. HIPAA requires an Enterprise plan, explicit BAA activation by a Primary Owner, and avoiding excluded features (Desktop remote mode, Web, Code Review, Computer Use, Remote Control).

What compliance certifications does Anthropic hold?

SOC 2 Type I and II, ISO 27001:2022, and ISO/IEC 42001:2023. Verify current certifications at trust.anthropic.com before procurement decisions, as scope changes frequently.

What is Zero Data Retention and what does it exclude?

ZDR prevents Anthropic from storing prompt and response data, available on the Messages and Token Counting APIs. Excluded from ZDR: Batch API, Files API, Skills API, code execution, programmatic tool calls, and the MCP connector.

Do subagents in Claude Code inherit the main session’s permissions?

Yes. Each subagent inherits tool access from the main session by default, including all MCP connections. Enterprise teams must document and restrict subagent tool access as a separate access control category.

When do EU AI Act high-risk requirements apply?

High-risk AI system requirements apply from August 2, 2026. Organizations using Claude for HR screening, credit assessment, or critical infrastructure management face conformity assessment obligations. Maximum fines reach 7 percent of global annual revenue.

Can I use Claude Code under a HIPAA BAA via AWS?

Yes. Claude models on AWS Bedrock are covered under the AWS BAA. Data stays inside AWS infrastructure and Anthropic does not receive it. This is often the simpler path for healthcare organizations already on AWS.