Claude Cowork

The Pro export (Settings > Privacy > Export data) arrives as an emailed link after an unspecified delay, and personal exports cannot be imported into another Claude account. The only documented restore on owner-run infrastructure is the Claude Desktop 3P import wizard, which first needs hand-set managed configuration (3P inference provider plus claudeAiImport.enabled, off by default). Both P1 shortfalls are present.

• Export your Claude data
• Import history from claude.ai (Claude Desktop on 3P)
• Claude Desktop on 3P overview

A personal export never includes project knowledge files or conversation attachments. It covers conversations, projects and memory, and the docs do not say it includes scheduled tasks, installed plugins/skills or connector configuration. Anthropic notes that projects and scheduled tasks do not carry over when moving to Claude Code. Connectors are authorised through Anthropic's server-side connector layer. At least two classes of state stay with the provider.

• Import history from claude.ai — What is and isn't included
• Use Claude Cowork on web, desktop, and mobile (October 6 changes)
• Claude Cowork architecture overview

By default the agent loop runs on Anthropic servers and needs a paid Anthropic account. Even the 3P desktop mode always downloads the VM workspace bundle and CLI binary from downloads.claude.ai at session start. The Consumer Terms let Anthropic suspend or terminate access at any time, so the right to run is revocable.

• Get started with Claude Cowork
• Claude Desktop on 3P overview (Anthropic-operated egress)
• Consumer Terms of Service

The Pro offering uses Anthropic's Claude models only. The documented gateway mode is described as serving Claude models through an Anthropic Messages API-compatible gateway, and there is no documented route to a local open-weight model.

• Claude Desktop on 3P — LLM gateway
• Claude Cowork overview

Default Cowork state lives in the Claude account on Anthropic servers. The Consumer Terms allow suspension or termination without notice and say that on termination Anthropic 'may at our option delete any Materials or other data associated with your Account'. No post-termination export window or shutdown plan is published.

• Consumer Terms of Service — Termination
• Get started with Claude Cowork

Conversations, projects and memory can be exported as a zip and memory can be viewed verbatim, but no public schema for the export is published. The Cowork-specific system instructions and server-side components are not readable. The action record lives in Anthropic's backend, readable only via the service or its export.

• Export your Claude data
• Import and export your memory from Claude
• System prompts (release notes)

Anthropic publishes core claude.ai system prompts, but the published list does not mention Cowork, and the Cowork agent prompt, reminders and classifier-layer context are not shown to the owner. Server-side behaviour changes (the workspace auto-updates at 'Setting up Claude's workspace') are not exposed as determinable settings. The model in use is visible in the picker.

• System prompts (release notes)
• Get started with Claude Cowork — Troubleshooting
• Use Claude Cowork safely — content classifiers

Anthropic keeps trust-and-safety classification scores for up to 7 years on flagged sessions, and the owner cannot see them. It also reserves open-ended retention 'as required by law, to resolve disputes' and for anonymised or de-identified data, which it 'may retain ... longer'.

• How long do you store my data?

Anthropic has publicly pledged that Claude will remain ad-free and that responses will not be influenced by advertisers, but this is a blog statement Anthropic says it may revisit, not a binding term. First-party defaults (Anthropic's plugin catalog as default marketplace, built-in browser) are disclosed and replaceable.

• Claude is a space to think (Anthropic)
• Install plugins (Cowork)

Session transcripts, scheduled-task run history and Dispatch child-task transcripts provide an action record. The docs do not say whether plugin hook executions are recorded or whether the owner is told when recording fails. Under G12 both count as shortfalls; OTel event export is Team/Enterprise only.

• Run tasks in the background with Dispatch
• Schedule recurring tasks in Claude Cowork
• Install plugins (hooks)
• Cowork monitoring (OTel, Team and Enterprise)

No hash-chaining, signing or other integrity data for session transcripts is documented, and there is no owner-side verifier.

• Claude Cowork architecture overview

In the default cloud mode, the agent loop and code execution run in the same per-session sandbox. No mechanism is documented that keeps the agent from altering or suppressing its own record.

• Claude Cowork architecture overview — Cloud session architecture

Required components (Claude Desktop, the Cowork cloud agent loop and sandbox infrastructure, the VM workspace bundle) are closed and proprietary. The Consumer Terms reserve all rights in the Services.

• Consumer Terms of Service — Anthropic Software / ownership
• Claude Desktop on 3P overview

The agent has no identity of its own. It acts through the owner's Anthropic account and connector authorisations held by Anthropic, which Anthropic can suspend or revoke.

• Claude Cowork architecture overview (connector tokens server-side)
• Consumer Terms of Service

There is no documented change log, attribution or rollback for instructions, memory, tools, permissions, settings or runtime version. Memory changes apply immediately without history, and conversation branching is not available in the new experience.

• Use Claude's chat search and memory
• Claude Cowork and chat are one Claude — Current limitations

The owner can set global, project and folder instructions, upload and toggle skills and plugins, and edit plugin files. The Cowork base system prompt and injected reminders cannot be replaced.

• Get started with Claude Cowork — Global and folder instructions
• Use skills in Claude

Global memory is itemised by topic with edit and delete controls. Project memory and the per-project summary are documented as separate stores, but their itemisation and editing are not documented; the owner can only reset memory wholesale. Under G12 that counts as one store not settled.

• Use Claude's chat search and memory
• Organize your tasks with projects in Claude Cowork

Pro users can add custom remote MCP connectors, upload plugins and add Git marketplaces without review, and can disable plugins and skills. Some built-ins cannot be removed; for example, the new experience has no web search toggle.

• Get started with custom connectors using remote MCP
• Install plugins (Cowork)
• Claude Cowork and chat are one Claude — What's in a new place

Some provider protections are owner-adjustable, such as opting in to sensitive-topic memory. Others are locked: deletion prompts in every mode, content classifiers on all untrusted content, the cloud sandbox, and categories never saved to memory.

• Use Claude Cowork safely — Our safety measures
• Use Claude's chat search and memory — Sensitive topics

The Consumer Terms allow manual or automatic software updates 'without advance notice', and the cloud workspace updates itself server-side. Pro owners cannot pin the runtime or decline changes; for example, local execution is being removed on 2026-10-06.

• Consumer Terms of Service — Software updates
• Use Claude Cowork on web, desktop, and mobile — October 6 changes

Pro offers folder scoping and per-connector-tool permissions, but network egress is only an on/off toggle for Pro (domain allowlists are Team/Enterprise). There is no control over whom the agent takes instructions from. Egress rules do not apply to web fetch, web search, MCPs or Claude in Chrome, and computer use bypasses the permission checks that gate other tools.

• Create and edit files with Claude (network egress settings)
• Use Claude Cowork safely

The owner can set each connector tool to Needs approval and use Manual mode, and deletions always require approval. Computer use within an approved app acts 'without the permission checks that gate other Cowork tools', so one path bypasses the gate.

• Get started with Claude Cowork — permission modes
• Use Claude Cowork safely

The owner can stop a task and pause or delete scheduled tasks one by one. There is no documented single control that stops all cloud sessions, scheduled runs and Dispatch child tasks at once.

• Schedule recurring tasks in Claude Cowork
• Run tasks in the background with Dispatch

The Consumer Terms state Anthropic may use Materials for training 'unless you opt out'. Content flagged by safety systems, and feedback, is used for training even after opt-out. Term changes bind on continued use without specific consent.

• Consumer Terms of Service — Our use of Materials; Changes to these terms
• Is my data used for model training?
• How do I change my model improvement privacy settings?
• Privacy Policy

Connectors are listed under Customize > Connectors and can be disconnected one by one, and Anthropic discloses that connector tokens are held server-side. The docs do not say that no copy is kept after revocation, so the pass is withheld under G12.

• Claude Cowork architecture overview
• Get started with Claude Cowork

Pro account deletion takes several steps: cancel, wait for the period to end, then delete, and sometimes a support request. Safety-flagged content (2 years), classification scores (7 years) and data already in training runs or trained models survive deletion.

• Delete your Claude account
• How long do you store my data?
• Delete or rename a conversation