Securing Claude For Enterprise Usage

Most organisations that use Claude in the workplace do so on the Enterprise plan, and for good reason. With the Enterprise plan, organisations get:

• Centralised sign-in
• Training turned off on your data by default and by contract
• Audit logs for cloud sessions
• Retention controls, from a 30-day standard window down to zero data retention for qualified accounts only

However, using Claude on the Enterprise plan still has significant risk for enterprises concerned with keeping their data sovereign, being compliant with data privacy regulations and protecting their intellectual property. The risk comes from three gaps:

1. No plan tier governs what is inside a prompt. That is as true on claude.ai as anywhere else.
2. On the desktop app, even the governance that exists in the cloud largely stops.
3. You don't choose where your data is processed. For organisations answering to GDPR, DPDP or sovereign data rules, that leaves the residency question without an answer.

Let's take them one at a time, and then look at what Mavs AI does to close all three.

Gap 1: The Content of Prompts Is Not Governed, on Any Surface

Training turned off answers one question: your data will not teach the next model. It says nothing about what the model processes today. No plan tier inspects the content of a prompt before it is sent, in the browser or anywhere else, so there are no guardrails against data being processed that should never have been:

• Files spread through shared context. A document uploaded into a shared project becomes part of the context everyone in it works with, and can surface to people it was never meant to reach.
• Long context windows carry data forward. Claude's context window is large, so data from a file uploaded earlier in a session could be processed for a later, unrelated request.
• Nothing governs whether the data should be processed at all. If a payroll file sits in an attached bundle, nothing checks the prompt to ask whether those values should reach the model in the first place.

Anthropic's own guidance on using Cowork safely acknowledges as much: it tells users to "avoid granting access to files with sensitive information", which is where the work is.

All three trace to the same missing piece: there is no inline runtime prompt security on the Enterprise plan. You govern the account, not the content of the prompts.

Gap 2: On the Desktop, Even Audit Trail Has Limitations

Claude is two different things depending on where it runs.

On claude.ai:

• A chat window.
• The model sees what someone types or uploads.
• It answers in the conversation.
• Your admin sees workspace logs and the Compliance API.

On Claude Desktop (Cowork):

• An agent on the employee's machine.
• The model sees whatever lives in the folders and apps it can reach.
• It opens files, edits and deletes them, pulls from connectors, runs code, and writes files to disk.
• Your admin cannot see or export the session: its files and chat history stay on the machine, whatever plan you are on.

One distinction matters here. Cowork also runs on web and mobile, and those sessions are covered by the Compliance API like any other cloud session. The gap is the desktop app, which is exactly where employees point Claude at local folders.

None of this is a consumer-plan limitation. Anthropic's documentation for Team and Enterprise plans says local session files and chat history "cannot be centrally managed or exported by admins". The Compliance API does not cover desktop sessions on any plan tier, and what Anthropic offers instead, OpenTelemetry, by its own description "doesn't replace audit logging for compliance purposes".

That is the bind: an agent doing more on the machine, with less of it visible to you.

Gap 3: You Don't Choose Where Your Data Is Processed

Every prompt has to reach a model somewhere. Even on the desktop, where the work feels local, it isn't: Anthropic says the work Claude does in a session, "including any local files it opens through the desktop app, is processed on Anthropic's servers rather than staying on your computer" (Use Claude Cowork safely).

This can be a data residency issue. Claude.ai and the desktop app offer no region choice: prompts and files are processed on Anthropic's infrastructure, wherever it runs. Regional processing does exist in Claude's ecosystem, but through the API on AWS Bedrock, Google Cloud Vertex and Microsoft Foundry, not on the surfaces your employees use. For an organisation answering to GDPR, DPDP or sovereign data rules, that leaves the residency question open.

Why Your Existing Stack Can't Close These Gaps

The natural next question is whether the security tools you already own can. They can't, and the reason is structural. Prompt content passes through none of them for inspection, and on the desktop the files and the chat history stay on the machine. Nothing moves.

• Network DLP and CASB see one encrypted stream to the model API. They can block it; they can't look inside it.
• Endpoint DLP and app control have two settings for a desktop agent: allow or deny. Deny it and you don't have Cowork. Allow it and they see a permitted application opening files the user is entitled to open, with no exfiltration event to flag. On an unmanaged device, neither is in the path at all.
• DSPM classifies data at rest in your cloud repositories. This file is on an employee's machine.
• API monitoring never receives the local session at all, so there is nothing for an admin to query.

Permissions don't close the gap either: once an agent can reach a data source, it can ingest all of it. The one thing that reliably leaves the machine is the prompt, so that is where the control belongs.

What the Mavs AI Runtime Control Layer Enables

That is where Mavs sits. Mavs AI supported Claude Desktop puts the Mavs runtime layer in front of Claude as a secure gateway. Every prompt generated from Claude Desktop, whether it comes from Chat or from Cowork, is evaluated by Mavs before it reaches the configured Anthropic model, so your policy applies while the work is happening. That makes Claude Cowork governable, and lets you give it to people to use on real work rather than rationing it to a trusted few.

The layer closes all three gaps: prompt security governs what is inside every request, the gateway restores the visibility the desktop took away, and region pinning decides where inference happens.

Runtime Prompt Security

Every prompt is evaluated by Mavs before it reaches the model.

• Sensitive business data and PII are replaced with synthetic values before the prompt reaches the model, then mapped back on the way out, so the file your team opens holds the real values.
• Coverage extends past formatted PII to what is sensitive to the business: deal codenames, unannounced pricing, M&A terms, key accounts.

Enterprise Governance

1. AI policy enforcement

Set policy for Claude Cowork and have it enforced at runtime, so your teams can do deep knowledge work on sensitive data.

2. Conversation auditability and investigations

Prompts, tool calls and policy decisions are recorded in tamper-evident logs, so a specific session can be reconstructed when compliance or security needs to know what happened. This covers desktop app sessions, which Anthropic's Compliance API does not reach on any plan.

3. Connector access decided centrally, by team

An admin decides which connectors each team can use, rather than each user deciding for themselves.

4. Security and productivity dashboards

See which teams are using Claude Cowork, for what, and where your biggest risks are. Measure your enablement alongside your risk posture.

5. Authentication through your identity provider

Push and configure through your existing MDM, and have users sign in through Mavs AI with your enterprise identity provider, such as Microsoft Entra ID. Access follows the same identity, group membership and offboarding path as the rest of your estate.

Data Sovereignty and Residency

With Mavs in the path, the picture splits in two, and each half lands where you want it.

Conversation history never leaves the user's machine: it is stored on the local disk, not on Anthropic's servers.

Prompts are different. Every prompt has to reach a model somewhere to get processed, and inference is the part that crosses a border. With Mavs in the path, the prompt reaches Anthropic's API with the sensitive values already replaced, pinned to a region you choose. That answers the residency question that GDPR, DPDP and sovereign data rules ask. The audit record is produced at the gateway, so you get the evidence without centralising the transcripts.

There is one more network benefit. The standard Claude desktop app loads its interface from claude.ai over the internet each time it runs. In the Mavs-supported build, that interface ships inside the app itself, so the app connects to a short, fixed list of destinations that your network team can allowlist.

For organisations that need processing inside their own environment, local options for inference and processing are on the way.

With Mavs AI, Cost Follows Usage, Not Headcount

Token consumption is billed against your Anthropic API licence rather than per seat. That removes the per-head cost of giving someone access, and moves the spending controls to you:

• Give Claude Cowork to more users without buying a licence for each one.
• See adoption and usage by team on the productivity dashboard.
• Set token limits by team or user.

Employee Experience Doesn't Change

Everything Claude Cowork can do, it still does with the Mavs runtime security layer in place: the same tasks, files, projects, skills and the plugins you allow, at the same speed. Mavs runs inline at sub-second latency, and prompts are processed rather than blocked, because Mavs protects the sensitive data inside a request instead of refusing the request. What changes is that every one of those actions is now governed and secured at runtime, without the employee doing anything differently.

See how it works on the Claude Desktop page, or book a demo.