Before You Put Client Files in Claude Cowork

Before adding client files to Claude Cowork, identify the information the task actually needs and check your organization's approved use. A new privacy announcement doesn't automatically change the terms of your account.

On September 1, 2026, Anthropic announced Enterprise Frontier Safeguards, or EFS. The planned system stores monitoring data in customer-controlled cloud infrastructure. Rollout is scheduled in phases beginning later in the fall, with interim zero-retention access for eligible customers. This is a specific enterprise program, not a blanket promise for every Cowork user. Read Anthropic’s announcement.

What does that mean for a small business today?

Start with the account you actually use. Anthropic's Fable product page describes 30-day retention for safety monitoring by default, alongside the eligible enterprise exceptions. Review the Fable data-retention section.

Don't assume that “not used for training,” “not retained,” and “not visible to other people” mean the same thing. When you assess a tool, ask separate questions about storage, model training, sharing, and who can access the connected systems.

This article is a practical training exercise. It doesn't determine whether your organization's contracts or obligations permit a particular upload.

How much information does the task need?

Consider a simple job: turn meeting notes into an action list.

The AI may need the decisions, responsibilities, and deadlines. A practice version probably doesn't need customer phone numbers, account balances, home addresses, or private background information.

Create a fictional note that preserves the work:

Practice customer: Example Bakery. Decision: update the catering menu draft. Owner: the marketing coordinator. Due: next Thursday. Open question: whether delivery is included. Prepare an action list with an owner, deadline, and unresolved question for each item.

That is enough to teach the skill. A real customer file wouldn't make the beginner exercise more useful.

What should staff learn to check before connecting an app?

Have each participant identify three things in the proposed assignment:

1. Inputs: Which documents or accounts would the AI read?
2. Actions: Would it only prepare a draft, or also change something?
3. Recipients: Who would see the result?

Give the group a second version of the task: “Send the action list to everyone who attended.” Ask what changed. The writing assignment has become a communication assignment involving recipient selection and external delivery.

This is where a clear workplace rule helps. Name who can approve outgoing messages and which systems are allowed for customer information. Put that rule where staff can find it while working.

What should you do after a practice run?

Inspect the output for information that didn't belong. Did the summary include an irrelevant personal detail? Did it turn an uncertain date into a firm commitment? Did it introduce a person who wasn't in the notes?

Revise the input and the instruction, then repeat the small task. You're teaching people to recognize the boundaries of a job, not simply to click through a permission screen.

For a small team, a shared example and a clear review habit can be a useful starting point. JOSA.AI provides custom AI training across Florida, including exercises shaped around the everyday responsibilities of corporate teams, workforce programs, and educators.