How to check Claude before you give it client PII, step by step
- Take stock of where PII already lives. List the online tools that already hold client PII: email, e-signature tools like DocuSign or PandaDoc, cloud storage like Google Drive or SharePoint, and any AMS that is not on a local server.
- Confirm SOC 2 on the Anthropic Trust Center. Go to trust.anthropic.com and confirm Claude's SOC 2 compliance, the same standard those other tools are audited against.
- Turn off training on your data. On any Claude plan, including the free plan, open your settings and disable Claude's ability to train on your data.
- Use Teams or Enterprise for the Data Processing Addendum. On a Claude Teams or Enterprise plan, your data is covered by Anthropic's Data Processing Addendum. Read Section H, Data Management.
- Choose Enterprise for HIPAA data. If you handle health information that needs HIPAA compliance, sign up for Claude Enterprise, which offers HIPAA compliance.
- Check with your compliance team. Share what you found with your compliance people or legal counsel, especially if your state has rules that differ.
The real question: is your PII online at all?
Insurance agents and brokers ask Ben almost every day whether they can put PII into Claude, what the rules are, and whether the data is safe. Ben's answer is yes, with the caveat that Ben is not anyone's legal counsel or advisor, and agents should still talk to their compliance people.
The question is not really whether PII goes into AI. It is whether your PII is online at all. If you send documents through DocuSign, PandaDoc or Adobe Acrobat eSign, email ACORD forms, or store files in an online AMS, Google Drive, Microsoft SharePoint, OneDrive, Dropbox or Box.com, that data is already being processed online. When an email arrives with an FEIN or a Social Security number in it or in an attachment, Gemini or Copilot is already reading it.
Offline data is different: a physical piece of paper handed to someone that has never been imported into an online tool. If your client data is already in digital tools, Claude is one more online service held to the same standard.
What SOC 2 compliance means
The security standard all of those tools adhere to is SOC 2 compliance, sometimes written SOC II. It is an audit from an independent third party confirming that a company or service provider has its security systems in check and has kept them working for the last 12 months or more.
Claude is SOC 2 compliant, and you can see that on the Anthropic Trust Center at trust.anthropic.com. Anthropic is the company behind Claude.
Ben keeps sensitive details in Claude personally, including a business FEIN, P&Ls, finances and a Social Security number. For health information that needs HIPAA compliance, Claude Enterprise offers it.
Turn off training, keep data separate
The first step on any Claude plan, even the free one, is to go into your settings and disable Claude's ability to train on your data.
On a Claude Teams or Enterprise plan, your data is also covered by Anthropic's Data Processing Addendum. Ben reads Section H, Data Management, word for word in the video: "All Customer Data stored by Anthropic is logically separated such that no customer is able to access the data of any other customer without authorization. Customer Data associated with a specific customer is easily identifiable. Further, Anthropic maintains reasonable and appropriate network-level segmentation to separate environments processing Customer Data from the internet, from development and testing environments, and from office workspaces."
In plain English: if Ben uses Claude and someone named Bob uses Claude, it is easy to tell which data is Ben's and which is Bob's, and the two never mix. Ben cannot reach Bob's files and Bob cannot reach Ben's. That covers your chat history, documents you upload, and your skills, plugins and connectors.
A strong signal from Charles Schwab
Charles Schwab announced, in an official press release on September 14, 2026, that it is working with Anthropic to bring Claude for Financial Advisors to the more than 16,000 independent registered investment advisors Schwab serves. Advisors can connect Claude to Schwab to help with work like portfolio reviews and meeting prep.
If a firm like Schwab is comfortable with advisors working on its customers' financial data in Claude, Ben sees that as a strong signal. Ben's answer to the question agents ask most often is yes, because of the compliance Claude lists on trust.anthropic.com. It is not legal advice, so check your state's rules and your own counsel.