Agentforce
Enterprise Frontier Safeguards: what changes for Claude inside Salesforce
Anthropic's Enterprise Frontier Safeguards move the activity data used for misuse detection out of Anthropic's systems and into cloud storage you control, under your keys. If your sellers use Salesforce in Claude, your engineers use the Claude Code plugin, or your agents call Claude through Bedrock, this affects you. This is what it is, what it does not change, and the two things to confirm with your account teams.
Zero data retention has been the phrase that gets Claude through a Salesforce customer’s security review. It is also a phrase with a hole in it. A provider that keeps nothing cannot watch for an attacker who spreads a misuse pattern across many sessions, and a provider that keeps enough to watch is keeping your data.
Anthropic’s answer, announced on September 1, is Enterprise Frontier Safeguards. The activity data used for misuse detection lives in your cloud storage, under your keys, and the automated detection sends its flags to your security team. Nobody at Anthropic reads it. The rollout is phased from this fall.
For a Salesforce customer this lands in a specific place, because Claude now runs in several of your surfaces at once: Salesforce in Claude for sellers, Slackbot and Claude Tag in Slack, the Claude Code plugin for developers, and Bedrock underneath Agentforce. This post is about what EFS means for each of those, what it leaves untouched, and what to ask before you sign anything that mentions it.
What Enterprise Frontier Safeguards is
The design has three parts. Activity data for a customer is stored in cloud infrastructure the customer controls, in Amazon S3, Azure Blob Storage or Google Cloud Storage. The customer holds the encryption keys, sets the access policies and keeps the audit logs. Anthropic’s automated systems analyse traffic for misuse patterns, and when something is flagged, the alert goes to the customer’s security team rather than to a person at Anthropic.
The context is a change Anthropic made earlier this year. With the Fable 5 models it introduced a 30-day retention period so it could monitor for threats that span sessions and time. That retention is what a zero-data-retention customer had opted out of. EFS is the reconciliation: keep the monitoring, move the retained data into the customer’s environment.
Anthropic says EFS applies across Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, the Claude Platform on AWS, Google’s Agent Platform and Microsoft Foundry, with equivalent controls on the three clouds. Eligible customers keep zero data retention until EFS launches for them. Rollout is phased from fall 2026 with broad availability targeted for later in the season.
The customers Anthropic quoted describe the arrangement in their own terms. Wells Fargo’s CISO said the logs stay in a Wells-managed environment under Wells-managed keys. Stripe’s head of security described conversation logs in Stripe’s AWS environment under Stripe’s controls. Cognition’s CEO said customer data and identities never leave their side.
Where Claude touches a Salesforce customer
The reason this matters more for a Salesforce customer than for most is that Claude arrived in four places within a few months.
Salesforce in Claude, the Claudeforce plugin, is now in beta for all customers. Sellers ask Claude about their pipeline and Claude reads and writes CRM records as that user. The Claudeforce page promises zero data retention on the Sonnet, Opus and Haiku models behind it.
Claude inside Salesforce products, meaning the default model in Agentforce Coworker, Vibes and parts of the reasoning engine, runs through Amazon Bedrock inside the Salesforce trust boundary. The AWS announcement at Dreamforce restated that the Bedrock path keeps zero data retention enforced.
Slack now runs on Claude by default, and Anthropic’s own Claude Tag can be added to channels on Claude Enterprise and Team plans.
And developers may be running the Claude Code plugin for Salesforce, which puts org metadata and Apex in front of Claude Code.
Each of those is a different contract. Some run on your Anthropic agreement, some on Salesforce’s, some on AWS’s. EFS is an Anthropic programme, so the first question is which of the four it reaches for you, and that depends on who holds the paper.
What EFS does not change
Three things stay exactly where they were, and it is worth saying so because the announcement will be read as broader than it is.
The Einstein Trust Layer is Salesforce’s, not Anthropic’s. Its masking, its toxicity checks and its audit trail in Data 360 apply to Agentforce agents whatever model sits behind them. EFS governs what happens to activity data on Anthropic’s side of the line. The Trust Layer governs what crosses the line and what Salesforce keeps. You need both switched on, and the Trust Layer’s audit collection is off until you enable it.
Salesforce’s own storage of conversations, session traces and transcripts is unchanged. Where an Agentforce conversation lives, and how long, is a Salesforce and Data 360 question, and I mapped it earlier this month.
And EFS does not apply to data the model provider never held. If a surface already ran with zero data retention and no monitoring, EFS adds monitoring with the data in your bucket. It does not add retention to something that was not retained.
The caveat that came with the announcement
The day after, The Register reported Anthropic’s own guidance that zero data retention is a configuration customers must confirm is in effect, rather than a default to assume. The same applies to EFS once it arrives. A programme that stores activity data in your S3 bucket needs a bucket, a key policy and someone to receive the flags. If nobody set those up, the safeguards are a slide.
Put it on the checklist as a named task with an owner: confirm, in writing, which retention mode each Claude surface runs in today, and which it will run in once EFS is switched on for your organisation.
The two conversations to have
With your Anthropic account team, if you have one: which of your Claude surfaces are eligible, when EFS reaches your tier, which cloud the activity data will land in, and what the flag delivery looks like. Ask for the retention mode you are on now, in writing. If you run Claude Tag or the Claude Code plugin, this is the conversation that covers them.
With your Salesforce account team: how Claude inside Salesforce products and Salesforce in Claude are contracted, whether EFS applies to the Bedrock path Salesforce operates, and where Salesforce’s zero-data-retention promise on the plugin stands once EFS changes what Anthropic retains. Salesforce has not published anything connecting the two, so expect to be the one raising it.
If your data residency is outside the US, add a third question to both: where the EFS storage sits, and whether your cloud region is supported in the first phase. The announcement names the three clouds but not regions.
What I would do before the fall
Inventory the Claude surfaces in use, by contract holder. Most organisations discover a fifth one in the process, usually a team that adopted Claude Code on its own.
Turn on the Trust Layer audit collection for Agentforce if it is not on, because EFS does nothing for the Salesforce side of an agent conversation and that log cannot be backfilled.
Write the retention mode for each surface into your AI register, with a date, and revisit it when EFS reaches you. The register is the thing an auditor will ask for, and the announcement is the reason it will change this year.
Then decide who receives the flags. EFS routes misuse signals to your security team. If nobody owns that inbox, the signal goes nowhere, and the whole design assumes someone is reading.
Understanding the basics
What is Enterprise Frontier Safeguards?
An Anthropic programme, announced on September 1, 2026, that stores the activity data used for misuse detection in cloud storage the customer controls, in S3, Azure Blob Storage or Google Cloud Storage, under the customer’s own keys, access policies and audit logging. Anthropic’s automated systems detect misuse and send flags to the customer’s security team without Anthropic staff reading the data. It rolls out in phases from fall 2026.
Does Enterprise Frontier Safeguards replace zero data retention?
It pairs with it. Zero data retention meant the provider kept nothing and could not monitor across sessions. EFS keeps the monitoring but moves the retained activity data into the customer’s environment. Eligible customers stay on zero data retention until EFS is available to them.
Does EFS apply to Claude inside Salesforce?
Anthropic lists Amazon Bedrock among the platforms EFS covers, and Claude inside Salesforce products runs through Bedrock within the Salesforce trust boundary. Salesforce has not published how EFS applies to the surfaces it contracts on your behalf, so ask your Salesforce account team directly.
Does EFS change the Einstein Trust Layer?
No. The Trust Layer is Salesforce’s control on what crosses to the model and what Salesforce keeps, including the audit trail in Data 360. EFS governs activity data on Anthropic’s side. Both need to be configured, and the Trust Layer’s audit collection has to be enabled explicitly.
Custody, not trust
The interesting word in the announcement is custody. For two years the argument for enterprise AI was that the provider would not keep your data. EFS reframes it: the provider keeps enough to protect you, and you hold it.
For a Salesforce customer with Claude in four surfaces, the work is to know which surface is under which contract, confirm the retention mode on each, and name the person who receives the flags. Do that, and EFS is a better arrangement than the one it replaces. Skip it, and it is a promise nobody verified.
If you want the Claude surfaces across Salesforce, Slack and your developer tools inventoried and their retention modes confirmed before EFS reaches you, talk to us, or start with the org health scorecard.
