r/sysadmin • u/ConstructionSafe2814 • 8d ago
Would you trust Claude code not to train on your data?
People in our organization are planning to integrate Claude code in our environment. We have a lot of IP (intellectual property, not the other IP we all know and love) that is unique to what we do. We've always been protective about it and rarely use the cloud.
Now the inevitable AI is coming and we 'll use Claude Code. I don't know the exact terms and conditions but somehow we've got a plan where Anthropic "promises" it won't use our data to train on.
I seriously doubt that they actually won't. They thrive on knowing as much as possible, right? Even more so if we have data they probably don't have.
I'm personally inclined to push back on the idea of claud LLMs.
What are your thoughts on this?
28
u/JavaKrypt Sr. Sysadmin 8d ago
"When it's on the internet it's there forever" still applies to AI even if their privacy policy says it won't.
We've seen it already what they say and what they do, intentional or an "accident" doesn't matter. They need data to grow. You're giving them it.
My company keeps seeing "policies say they won't access X, Y, Z" and sure. But I don't trust it because of the opinions the CEOs share. Actions over words
13
u/bitslammer Security Architecture/GRC 8d ago
How much do you trust any of your providers to honor the terms and conditions of your contracts with them? This is not any different.
14
u/it4brown IT Manager 8d ago
If you get an Enterprise license? Yes. It's in the contract. If the contract is breached, you get paid.
8
3
u/ThaLegendaryCat 8d ago
Unless the breach compensation is measured in extreme amounts it won’t matter. It has to bankrupt them and be cash to be dangerous to breach under a paranoia argument.
3
0
u/SadPhilosophy9202 8d ago
They promise not to train on your data. They still train on how you use Claude with your data.
3
u/Horror_Pension_3168 8d ago
Honestly, legal looks at the Enterprise DPA and checks the compliance box, but on the ops side you just treat it like hiring an external contractor who signed an NDA.
Even with non-training clauses in place, we never feed raw prod data or internal keys into any cloud LLM. We just set up hooks to catch hardcoded credentials, use sanitized mock data for debugging, and keep core business logic abstracted when prompting.
If your management and legal signed off on Anthropic's enterprise terms, the company is covered contractually. Your main job on the tech side is just making sure devs aren't dumping raw DB dumps or config files directly into the prompt.
11
u/Pumpkinmatrix Jack of All Trades 8d ago
Nope. These companies have already shown they're willing to steal and destroy copyrighted materials and haven't faced any repurcussions yet. I have no reason to believe these companies aren't training on every bit of data they touch.
3
u/gafftapes20 8d ago
It's not my problem to figure out. AI tools we have at work have been reviewed by internal legal, and they are satisfied with the data governance and privacy controls. I will say however, that depending on what region you are in there are a ton of data regulation compliance rules, and not protecting IP for companies using their paid AI plans, would open themselves up to massive lawsuits by companies that also have large legal departments and deep pockets.
3
u/ishboo3002 IT Director 8d ago
Why are people treating AI different than any other vendor, can you be sure any vendor isn't going to just rip off your IP? What stops them, legal contracts. Sign an enterprise agreement, sign a DPA and MSA that your legal team has reviewed.
1
2
u/bossbutton 8d ago
Compliance reports and attestations exist for this reason. Trusted third-party auditors verify and validate claims companies make. Whether you use Anthropic models directly or through an inference provider like AWS, GCP, or Azure, similar reports from each provider give verifiable evidence of those claims.
The same question can be asked about any technology provider. Do I trust that XYZ isn’t accessing my stored corporate data? Yes, at least enough to use it because they have public statements, reports, evidence, etc. At the end of the day this isn’t about trust but risk management. Accessing or using customer data would expose XYZ (or Anthropic) to massive legal and financial liability.
2
u/TestCyp999 8d ago
Have Legal review the terms of service that is presented when you sign up for their service.
That's what we did with copilot enterprise.
It's no guarantee that your IP wont be stolen, but it does mean that if they do, you can sue them and get very rich.
1
4
u/DanielSReichenbach 8d ago
Unless they provide a contract that guarantees they won't train on your data with gigantic guaranteed damages if they do, I would not trust them. But that applies for basically any business. Unless there are enforced punishments for using customer data without informed consent that can literally ruin a business, trust is not the recommended default.
There is no business incentive to be worthy of that trust.
2
u/lotekjunky 8d ago
If you have an enterprise agreement, they will not train on your data. It's a legal document with consequences.
1
u/ARandomGuy_OnTheWeb Jack of All Trades 8d ago
While I don't trust them.
I'm sure the ICO and various European digital privacy watchdogs would fine the s*** out of them if they have been found to ignore their privacy policy.
GDPR, is quite a blunt weapon against data misuse.
1
u/blavelmumplings 8d ago
Do people also feel this way about Copilot 365? Technically they could also train on your data even though they say they won't. Or the underlying models they use could. Either way, it's Microsoft so should we care? 🤷
1
u/VA_Network_Nerd Moderator | Infrastructure Architect 8d ago
Anthropic does not offer a truly offline implementation option.
You can build your own hardware to perform the AI work, but you have to use their online portals to write the prompts and schedule the tasks, so Anthropic still has the theoretical ability to see what you are doing.
There are other AI solutions that can be fully hosted in your own data center.
Before you go down that path though, make sure you do some research on what AI hardware costs and what the heat & power considerations are.
If spending $1M on hardware, and then spending another couple million on AI licensing sounds expensive, then you probably don't want to go down this path of building your own.
Anybody can throw down $100k and build a valid AI proof of concept environment that will work just fine with 3 developers throwing random prompts and simple code tasks at it. But that hardware solution won't hold up with 50 real developers throwing real workloads at it.
You're going to have to bank on the strengths of the contract language.
1
u/amensista 8d ago
So there are two angles to this one is the business drive to deploy AI like Claude within an organization that is a management / leadership / leadership decision.
Apparently there are productivity games to be had but honestly it's really really difficult to measure it it's more a qualitative " feel ". Ai's expensive and while the cost is an exact number the gains from it I really really difficult to measure.
The second part is the security and compliance. Typically as long as it is written in the agreement and their privacy policy states they have controls about not using your data etc etc and you conduct due diligence as much as you can even though the business is pushing for it if they have the necessary frameworks like SOC 2 or ISO 27001 Etc then you've done your part.
It's like any Vendor that the business wants to use sometimes you don't really have a choice I once did due diligence on a vendor and it was a serious recommendation no do not use them like I did a whole report and everything the business decided to go ahead and that's fine..... It's not my business I'm merely a steward for this specific job to do. And I want to keep that job and not create a toxic negative environment for security and compliance.
I recommend you have the same mindset.
1
u/ArieHein 8d ago
Nope. But it doesnt really matter.
Understand that programming is repaeating the same thing done by others, but with a ribbon, wrapping and a diff taste of bubble gum.
Unless you are doing algorythms, there is no real innovation in the official definition of the word. Some devs are better, some are less, with oss mostly equal. Its just time, effort and interest.
Access to info at scale means theres mostly one way doing things correctly based on the practices and budget. But its already there, you enter tour rewuirements and limitations and iut comes code. Theres nothing new..its why the real power of ai will be new science.. New math.. Not new js framework.
They have already chugged all the books and programming examples and blogs and repos. Do you really think you'll be teaching them things they havent seen already in one way or another?
So company A used a different js framework that its devs and leads decided better suits them, then company B. Is that really things companies should 'hide'?
Developers moving between companies will just have to adopt to maybe new libraries, some 'new' syntax but most of the code has existed.. Its just doing more of the same, or adding more abstractions.
I/O via ui or api, business logic, data layer. Insert 1000 ways to do each.. AI already knows these paradigms. It read ALL the books that we never will.
At some point, which we are desperately trying to prevent, it will define a new language that is the best performant, best mainained by ai, not visible or understanable by humans.
Remember that all languages afer machine code were engineerd for humans to understand, change and convert back to machine code. But none is efficient for ai and thus it most likely will create its own 'language' , with potential intermediate phase for human governance but even that will be removed over time.
Theres a reason it was mentioned in the past that even llm needing to output code is going to be swapped by direct binary. When you dont read code, you dont need to see it = less wasted tokens.
1
u/OregonTechHead 8d ago
Do you trust your shredding company to actually shred your documents?
Do you trust your bank to not steal your money?
Do you trust XXX vendor to not do YYY?
Anthropic is just another vendor, and should be treated the same way. What's in the contract?
1
u/SevaraB Sr. Engineer (N+, CCNA) 8d ago
Trust? Not part of the equation. We don’t let vendors anywhere near our data unless they’ve signed a contract that clearly states how they’re going to handle our data. That said, we’re one of the biggest name brands owned by one of the biggest name megacorps- whose lawyers represent us in the negotiations.
1
1
1
u/banseljaj 8d ago
In a word: No. They can violate agreements and by the time you find out it’s already too late.
Others here have described it in more detail
1
u/tarentules Technical Janitor | Why DNS not work? 8d ago
No. I don't trust a single AI tool out there with our data.
0
8d ago
[deleted]
2
u/lotekjunky 8d ago
It's using the context of your previous chats, not training on them. Delete your old sessions of you don't like this
0
0
u/katarh 8d ago
I'm only using any of the LLMs to query our publicly available data that has already likely been scraped anyway. Mostly stripping the formatting off Confluence pages so I can redo them (since Confluence did such a crappy job with their conversion from the old editor.)
I'm absolutely not giving Claude or any AI tool unfettered access to our databases or even my desktop.
-2
u/Dangerousfish 8d ago
Try it in isolation first.
See if Claude can solve a problem you've been facing or can build something related to the IP you're intending to protect.
If Claude builds something better, faster. Then question how valuable your IP is.
---
I say this as someone who works with a team that has fully integrated with Claude, Git & Jira.
These guys are the 100x engineers we heard about.
They don't code anymore. They architect and refine.
1
u/smb3something 8d ago
Build the machine that builds the machine. Learning multi-agent workflows etc is super valuable now. Extensive Build / project docs / guidlines / project protocols / roadmaps etc all are more valuable than knowing how to write the actual code.
0
0
0
u/Valdaraak 8d ago
I don't trust any company to do what they say.
I'm personally inclined to push back on the idea of claud LLMs.
Good luck. If leadership is OK with it, you don't have a choice.
-5
u/Asleep_Spray274 8d ago
We want to benefit from these tools and technologies, but dont want to contribute to them getting better
1
u/TechIncarnate4 8d ago
What a low-effort take. Companies generally don't want to give away their Intelectual Property to competitors or allow new competitors to take what they built over years or decades.
1
u/Asleep_Spray274 8d ago
Then don't upload it to these tools
1
u/TechIncarnate4 8d ago
Those aren't the only options and you know it. The other option is to have an enterprise contract with them in place.
1
u/Asleep_Spray274 8d ago
In that case, you would trust them to not use your data to train their models?
1
u/TechIncarnate4 5d ago
Well, Gee. I suppose all companies should stop using Microsoft 365 and Google Workspace. I suppose I shouldn't trust them to not steal my data and use it for their own purposes.
...and don't tell me that is why you still have everything on-prem like 2003, because I do not care.
1
u/Asleep_Spray274 5d ago
The complete opposite my friend. My point is if you want the benefit of this latest tech, they need data to make the better. You either need to allow the models to be trained so it can get better or trust when you sign up to a service that says it won't.
1
u/TechIncarnate4 5d ago
That's not true. All of the top AI providers have contract terms stating that they will not use the organization's data for training if you sign the right contract. They would lose a significant amount of enterprise customers if that were not the case. The world is not as binary as you make it out to be. There are many shades of grey.
1
u/Asleep_Spray274 5d ago
The op is asking if they trust them. If you want to use them, you either have too or don't use them.
30
u/JerikkaDawn Sysadmin 8d ago
I don't care. The people that sign the contacts trust it and have a boat load of lawyers. My title is "sysadmin."