Anthropic Claude EU Data Residency 2026: Enterprise, Team, Bedrock and Vertex Compared

Claude for Enterprise is Anthropic's commercial tier of Claude, launched in September 2024 and expanded through 2025 and 2026. The product ships with SOC 2 Type II, ISO 27001:2022, ISO/IEC 42001:2023, a HIPAA-ready configuration, no training on customer data by default, a Data Processing Addendum with Standard Contractual Clauses that is part of the commercial terms, SSO, SCIM, role-based permissions, audit logs and a Compliance API.

What it does not ship with is EU data residency. An earlier version of this review said otherwise, and that was wrong. Anthropic's privacy centre states that customer data is stored in the US and that traffic may be routed to the US, Europe, Asia or Australia unless agreed otherwise; the only geographic control is US-only inference. The platform documentation is equally clear: the inference_geo parameter accepts global or us, and us is the only workspace geography. If you need Claude to run inside the EU, the route is AWS Bedrock or Google Cloud regional endpoints, where the hyperscaler is the data processor. The EU data residency section below walks through every option.

Anthropic still publishes more on training and safety than OpenAI: the Acceptable Use Policy, model cards with documented limitations, and an ISO 42001 AI management system certification that few vendors hold. None of that is sovereignty, but all of it helps when your DPO is building a Transfer Impact Assessment.

This review is for the AI governance owner choosing between Claude for Enterprise, Claude via an EU hyperscaler, and EU-headquartered alternatives. For the broader comparison, see our EU enterprise AI matrix. For the ChatGPT Enterprise counterpart, see the ChatGPT Enterprise EU review.

At the platform layer Claude for Enterprise is comparable to ChatGPT Enterprise in feature breadth, with two EU-relevant strengths and two structural weaknesses.

Strength 1: Contract and certification depth. The Data Processing Addendum with EU Standard Contractual Clauses is incorporated into the commercial terms automatically, so there is no separate paper to negotiate. No training on customer data is the default for every commercial product. Anthropic holds SOC 2 Type II, ISO 27001:2022 and ISO/IEC 42001:2023, the AI management system standard that auditors increasingly ask for under the AI Act.

Strength 2: Documentation that feeds Annex IV. Anthropic publishes its constitutional AI methodology, model cards with documented limitations, and the Acceptable Use Policy. Deployers building EU AI Act Annex IV technical documentation can reuse a good part of it. ChatGPT Enterprise's equivalent material is thinner.

Weakness 1: No EU data residency. This is the point the earlier version of this review got wrong. Claude Enterprise and the first-party API offer global or US-only inference and US workspace storage. OpenAI, by contrast, has offered EU data residency for ChatGPT Enterprise and the API since February 2025. If in-region processing is a hard requirement, Claude only meets it via AWS Bedrock or Google Cloud, with a different processor and a different contract.

Weakness 2: Single-vendor lock-in. Claude for Enterprise is Anthropic-only. Multi-LLM platforms route to Claude alongside other providers; Claude for Enterprise itself does not. For buyers with a vendor-independence policy, this is the same gap ChatGPT Enterprise has.

Claude for Enterprise in 2026 is a strong US frontier model with an unusually complete compliance file: SOC 2 Type II, ISO 27001, ISO 42001, a DPA with SCCs baked into the terms, no training by default, and audit tooling that includes a Compliance API. It is not the most EU-friendly US option on data residency, because it has none: OpenAI offers EU residency for ChatGPT Enterprise, Anthropic does not.

It is still US-incorporated. Schrems II analysis still applies, and without EU residency the transfer is the rule rather than the exception. Annex III conformity assessment for HR-AI is still on the deployer. Betriebsvereinbarung KI is still your work in EU subsidiaries. For EU-headquartered companies with strict residency requirements or vendor-independence procurement policies, an EU-hosted multi-LLM platform that can route to Claude on Bedrock or Vertex, alongside Mistral or Aleph Alpha, remains the more defensible choice. Use our EU enterprise AI matrix to map your buyer profile.

The operational reality for most German and Austrian enterprises in 2026: if the model quality of Claude is what you want, run it through an EU hyperscaler region or through an EU-hosted platform that does so for you, and keep the direct Claude Enterprise contract for teams whose data can leave the EU under a documented TIA. Most enterprises end up running both.

There are four ways to buy Claude, and they differ more on data location than on anything else. Anthropic's data residency documentation and regional compliance page are the primary sources; everything below is checked against them as of August 2026.

Claude for Enterprise and Claude Team (claude.ai). Conversations, files and projects are stored in the US. Inference is routed globally by default; Enterprise customers on usage-based billing can switch on US-only inference. There is no EU setting.

Claude API (first party). The inference_geo request parameter accepts global or us; US-only inference costs 1.1x list price on Claude 4.6 and later models. Workspace geography, which governs storage at rest and endpoint processing, is us only and cannot be changed after creation.

AWS Bedrock. Claude runs in-region in Ireland, Stockholm, Frankfurt and Paris depending on the model, with an EU cross-region inference profile that keeps routing inside the EU geography. AWS is the data processor, and your existing AWS DPA and BaFin or C5 documentation apply. Anthropic's own retention rules for Covered Models still require 30-day retention, but the retained data stays in your cloud tenant.

Google Cloud (Vertex AI, renamed Gemini Enterprise Agent Platform in April 2026). Regional endpoints such as europe-west3 (Frankfurt) and, since 15 May 2026, an EU multi-region endpoint that fails over only within the EU geography. Google is the processor.

Microsoft Foundry. Claude is generally available on Foundry, but as of August 2026 there is no EU data zone; deployments use global or US Data Zone routing. Anthropic lists Foundry in Europe as coming in 2026 without a date.

Anthropic's pricing page lists two business plans. Team is the self-serve tier for 2 to 150 seats: $20 per standard seat per month on annual billing ($25 monthly), with premium seats at $100 ($125 monthly) that carry roughly five times the usage and access to the newest models inside plan limits. Usage is included in the seat price. Team includes Claude Code, Cowork, SSO, central billing and admin control over connectors, and no training on your content by default.

Enterprise is $20 per seat as a base fee, with usage billed separately at API rates. That is the number that surprises finance: a busy team of 50 can spend more on usage than on seats. In exchange you get role-based access with fine-grained permissions, SCIM provisioning, audit logs, the Compliance API for observability, custom data retention controls, network access control and IP allowlisting, US-only inference, and a HIPAA-ready configuration for eligible organisations. Zero data retention is not part of the standard plan; it is enabled per organisation for qualified accounts.

There is no published seat minimum for Enterprise, but it is sold through sales, and the usage-based model means small teams rarely get a quote that beats Team. For an SMB in the DACH region the realistic comparison is Team versus an EU-hosted multi-LLM platform, not Team versus Enterprise.

Claude Code, the terminal and IDE agent, is included in both business plans and is where most of the 2026 admin work landed. Anthropic added user groups with custom roles, per-user and per-organisation spend caps, managed Claude Code policies and a Compliance API for Enterprise in spring 2026. In practice the controls that matter for a European rollout are:

Managed settings. Admins push tool permissions, file-access restrictions and an allowlist of MCP servers to every developer, so a Claude Code session cannot reach a data source the organisation has not approved.

Spend limits per seat. Because Enterprise bills usage at API rates, per-user caps are the only way to keep an agentic coding session from turning into an unbudgeted invoice.

Analytics per user and repository. Usage breaks down by person, group and repository, which is what a Betriebsrat will ask about before it agrees to a Betriebsvereinbarung KI. Note that Anthropic's Compliance API retains an activity feed for six years, and local session transcripts follow the same six-year default unless the organisation sets a shorter retention.

Backend choice. Claude Code can run against Bedrock or Vertex instead of the first-party API, which is how EU teams keep coding sessions in-region. See Claude Code on Team and Enterprise for Anthropic's own summary.

Zero data retention for Claude Code is available on Enterprise for qualified accounts; with metrics logging enabled, productivity statistics are exempt and may still be retained.

Anthropic's Data Processing Addendum, effective 24 February 2025, is incorporated into the Commercial Terms of Service automatically: accepting the terms for the API or Claude Enterprise accepts the DPA, so there is nothing separate to sign, though you should still file a copy. It includes the 2021 EU Standard Contractual Clauses (Module 2 controller-to-processor, Module 3 processor-to-processor), and Anthropic acts as processor for commercial customers. Commercial data is not used for training unless you join the Development Partner Program. The certification list names SOC 2 Type I and II, ISO 27001:2022, ISO/IEC 42001:2023 and a HIPAA-ready configuration with BAA.

Retention defaults, from the API and data retention documentation: API inputs and outputs are deleted within 30 days; conversation content is not retained by default except for Covered Models, which require 30-day retention; content flagged by trust-and-safety systems can be kept up to two years; ZDR and custom retention are available by agreement. In August 2026 Anthropic said it would move that 30-day retained data for its newest models into customer-controlled clouds rather than holding it itself.

The Schrems II position follows from the residency facts. The SCCs are in place and the EU-US Data Privacy Framework exists, but Anthropic is a US company subject to FISA 702 and the CLOUD Act, and without an EU processing option every prompt from Claude Enterprise is a third-country transfer. Your Transfer Impact Assessment has to carry the whole weight. Routing through AWS or Google in an EU region does not remove the US-company question, since both are US-headquartered too, but it does keep processing and storage in the EU and gives you contracts your DPO has already assessed. Our EU AI chat DPA checklist lists the Art. 28 clauses to verify in any of these contracts.