Claude work done on your own laptop can now be pulled by your employer.

What changed

Anthropic's Compliance API covers Claude Cowork across the desktop app, web and mobile, and Claude Code in the CLI and desktop app, for Enterprise customers, and moved this session coverage to general availability on 26 August 2026. Session endpoints return prompts, responses and tool activity together as one server-hosted transcript, through the Compliance Access Key teams already hold. Claude Code on the web, sessions through the Claude Platform, and anything running on Amazon Bedrock, Google Vertex AI or Microsoft Foundry sit outside it, and local sessions under zero-data-retention or in HIPAA-ready organisations are not captured. Enterprise administrators can retrieve local session content, and the platform documentation now also describes selective deletion of a specific conversation or file, so the earlier beta gap where retrieved content could not be deleted no longer holds.

Why it matters

Plenty of people assumed that work done in a desktop app stayed on the desktop. On an Enterprise plan that is no longer safe to assume, and the distance between what staff believe and what an admin can pull is exactly where trust breaks. A transcript is also thinner evidence than its length suggests: it shows what was typed in one tool, not whether the file was current, what was agreed in the meeting afterwards, or what the person understood at the time.

Who should care

• Security and compliance teams investigating incidents across AI tools
• Managers and staff who assumed local Cowork history stayed private

What to do

Tell your team what is retrievable before you ever retrieve anything. When something genuinely needs investigating, start with activity signals such as tool calls, file access and approvals, and open conversation content only when those cannot answer the question. Write down who may ask for it and what reason has to be recorded.