How companies are protecting Claude Code from reading IP and PII data
Recently I was baffled when Claude code read the customer table data from a production environment, while triaging an issue, and that made me wonder. Sure you should NOT give the access to read the prod data but does it sounds practical in the real time debugging session?
Our take has been that if you are working with one of these large companies, you cannot expect anything to be private. We've worked with a smaller more focused product where we were able to negotiate the necessary controls
Sign an enterprise agreement that speaks to data retention and destruction requirements. Part of what you pay for is to shift the liability to the inference vendor.