Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Zero Data Retention Cover Claude Computer Use Screenshots?
No: a zero data retention agreement governs what Anthropic keeps after a response, and the tool's own page says Anthropic "processes the screenshot images and action requests in real time as part of the API call" while the request is open. Ask what your request carries before you ask what the vendor stores.
A registrar's office lets an agent work the student self-service portal to answer a term-balance question, and the first step is to open the account summary page and take a screenshot. The image holds a student name, a student ID, a term balance and a list of account activity, and the model reads every field before it chooses what to click. The office holds a zero data retention agreement with Anthropic and treats that clause as the answer to the screenshot question.
A retention agreement says what the vendor keeps once a request has completed. A screenshot is content that the request carries, and the model reads it while the request is still open, so the clock the agreement describes has not started when the image is already in the model's context. That gap is where a work account's exposure sits, because the values an institution is asked to protect are the values a portal draws on its summary page. Whether the agreement covers the image turns on what the request carries, which is a question about the tool rather than about the contract, and the difference shows up in the first screenshot the agent takes.
Key findings
- For a portal screenshot to be safe under any retention term, the values on the page would have to be replaced with consistent tokens before the model reads it, so the image holds STU_4021 and BAL_1180, with the balance a figure the retention review does not use, in place of the record's identifier and balance (What Is Render-Layer Tokenization?).
- It would also require a named person approving each submission or record change the agent proposes and a record of what the model received on every screen; a storage clause describes neither (Does Anthropic Store Claude Computer Use Screenshots?).
- Anthropic's data retention page scopes the agreement to what is kept after the API response, and it describes no step that changes what a computer use request carries to the model (Anthropic, API and data retention, 2026).
- Anthropic's computer use page states that screenshots and session files are "captured and stored in your environment, not by Anthropic," and that Anthropic "processes the screenshot images and action requests in real time as part of the API call" (Anthropic, Computer use tool, 2026).
- The Privacy Center article limits the agreement to "eligible Anthropic APIs" and products that use a Commercial organization API key, and says requests are "reviewed and applied on a per-organization basis" (Anthropic, Zero data retention agreement, 2026).
- Anthropic's privacy center states that for API users it deletes inputs and outputs "within 30 days of receipt or generation," and keeps a flagged session "for up to 2 years" (Anthropic, How long do you store, 2026).
What does a computer use request carry before any response exists?
Claude never opens a browser on Anthropic's side. The computer use page calls the tool "a client-side tool," says screenshots and session files "are captured and stored in your environment, not by Anthropic," and notes that the application attaches "a screenshot as an extra image block on the last result in the batch" (Anthropic, Computer use tool, 2026). The camera sits in the customer's harness and the image in the request it builds.
The portal page makes the order concrete. A student self-service account summary holds "The total amount you owe," "Any holds on your account" and a link into a "Payment portal" (North Carolina Central University, 2026), along with the student's name and identifier. An agent working the page the way a student does reads the summary, finds the pay-now control and sends the frame on its next request. The frame is an input rather than a response, so the balance is in the model's context before Anthropic returns anything.
Deleting the vendor's copy afterwards leaves that run unchanged: the model read the numbers, proposed an action from them, and every later turn carries what it wrote. OWASP describes the outcome, since "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, 2025). Does Anthropic Store Claude Computer Use Screenshots? separates where a captured frame is written from what the request carries.
The values leave the organization's control at the request, and that happens on every turn of the loop.
What does a retention agreement govern, and what does the model still receive?
Anthropic states the promise in one sentence: "Under a ZDR arrangement, Anthropic does not store customer prompts or responses at rest after the API response is returned" (Anthropic, API and data retention, 2026). That covers the vendor's copy of a screenshot, because the image travels inside the request. It does not say the image was never read.
Three limits sit around the promise. The agreement "is enabled per organization; each new organization requires ZDR to be enabled separately by your account team." The Claude Teams and Claude Enterprise product interfaces "are not ZDR-eligible." And Anthropic "may retain data where required by law or where it has been flagged by Anthropic's automated trust and safety systems" (Anthropic, API and data retention, 2026), with a flagged session kept "for up to 2 years" (Anthropic, How long do you store, 2026).
Without an arrangement the Privacy Center gives the default for API users: inputs and outputs are deleted "within 30 days of receipt or generation" (Anthropic, How long do you store, 2026). The clock starts on receipt, the event that put the image in front of the model, so a shorter window shortens the copy and not the exposure.
The agreement is one promise among several. The commercial terms add that "Anthropic may not train models on Customer Content from Services" (Anthropic, Commercial Terms, 2026), which sits beside the retention clause rather than inside it.
What do the vendors themselves say?
Anthropic describes both halves and leaves the join to the customer. The retention page defines the agreement by storage after the response and lists computer use as eligible, describing it as a "Client-side tool where screenshots and files are captured and stored in your environment, not by Anthropic" (Anthropic, API and data retention, 2026). The tool page says the images are "processed in real time as part of the API call" (Anthropic, Computer use tool, 2026).
None of the pages describes a step that replaces values on a rendered screen before the screenshot is composed. The review of 15 agents, Claude Computer Use among them, found no product that describes replacing the customer data a working page shows with tokens the agent can work with (Do AI Agents Ask Before Making a Payment?). The classifier scans "what the tools return, such as screenshots," which is after the image exists, and the tool page carries a caution rather than a control: "Do not use Claude for tasks requiring perfect precision or sensitive user information without human oversight" (Anthropic, Computer use tool, 2026).
| Dimension | Anthropic, per its documentation | What a buyer should verify |
|---|---|---|
| What the agreement covers | Prompts and responses "at rest after the API response is returned" | That the term names your organization and the API product you call |
| Computer use eligibility | A "Client-side tool where screenshots and files are captured and stored in your environment" | That eligibility is written into the signed agreement |
| What the request carries | Images "processed in real time as part of the API call" | Which frames the harness attaches and what they show |
An agreement that empties the vendor's copy can still leave a flagged session on file for two years (Anthropic, How long do you store, 2026).
Who approves the submission the agent makes on that page?
The pages reviewed place no approval step inside the tool. The computer use page hands the loop to the harness: the model returns an action, the application executes it, and nothing in that exchange is an approval (Anthropic, Computer use tool, 2026). An approval exists only if the team that runs the harness put one there.
Two shapes recur. The first is a queue showing a task name and a timestamp, where the person approves a summary of a screen they cannot see. The second is a destination the approver did not read, where the frame is right and the submit goes elsewhere, the failure How Do I Control Where a Browser Agent Can Submit Data? works through. An open login compounds it (Can a Browser Agent Read My Session Cookies?).
A retention agreement is silent on both. The record an institution needs carries the screen as the model reads it, the action, the destination and the name of the approver, exported to its own monitoring.
Approval has to arrive before the action, since a reviewer confirming a step already taken is confirming a log line. A page carrying hidden instructions is the other half: a value already in the model's view is reachable by whoever controls the next page (How Do I Capture a Token the Moment It Appears on Screen?). The regulated standard points at the request too, because covered entities "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request" (Cornell Law School, 2026).
What does a governed environment change?
It moves the control to where the page is drawn. Values a policy names are replaced with consistent tokens before any model reads the screen, so the summary renders with an identifier token and a balance token while the layout, the holds and the pay-now control stay intact. The model still works the page and proposes the click; what changes is what the frame is worth to whoever reads it later.
Real values resolve only at an approved destination, at the moment of an approved action. On the portal the balance resolves when a named person approves the payment and travels to the payment form, not into the screenshot, the trace or the transcript. A named person approves each submission and record change, and every screen as tokens, every action and every approval lands in a record that exports to the organization's own monitoring.
Set against a retention agreement, the two controls answer different questions. The agreement limits what the vendor keeps after the response, and the environment limits what the request carries while the response is produced. An institution needs both, because a request that carries a balance exposes it whether or not a copy survives. The same substitution applies to a token page a developer reads back to confirm a key was created (Does a GitHub Fine-Grained Token Replace a Secure Agent Workspace?), and How Do You Run Claude Computer Use on Customer Records Without Exposing PII? works it through a claims record.
What the record shows
A retention agreement answers a question about storage, and the frame a model reads is a question about content. Anthropic's pages say computer use is eligible because the images stay in the customer's environment, and the images are processed in real time as part of the API call (Anthropic, Computer use tool, 2026). Those statements leave the agreement covering the vendor's copy only. The answer changes before capture: values replaced with consistent tokens on the rendered page, a named person approving the submission, and a record of what the model read. A team can test the gap in an afternoon by naming one agent and one portal task, capturing the request payload for a single run, and comparing the image with the page the portal drew. If the balance and the identifier are legible, the agreement did not change what the model saw.
Methodology and limitations
The page rests on five Anthropic documents (the API retention page, two Privacy Center articles, the computer use tool page and the commercial terms), one university knowledge base article, the OWASP entry on sensitive information disclosure, and the minimum-necessary standard as republished by Cornell's Legal Information Institute. Vendor pages were read between October 21, 2026 and October 24, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product named here was tested for this page. A statement that a page does not cover something means the pages reviewed do not state it, not that the capability is absent; vendor features change and the page carries its date. The portal example describes a record type, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations about whether a workflow meets a contractual, education-records or privacy requirement belong to counsel, assessors and the organization's own compliance officers, and nothing here replaces a pilot of one workflow on its own screens.
Frequently asked questions
Does zero data retention cover Claude computer use screenshots?
No, not as a control on what the model reads. The agreement governs what Anthropic keeps after the API response is returned, and the computer use page states that the screenshot images and action requests are "processed in real time as part of the API call." The vendor's copy is covered and the reading is not. What covers the reading is a change to the page before the screenshot is taken.
Does zero data retention mean the model never sees the screen?
No. Retention and transmission are separate questions, and the tool page answers them separately: screenshots are "captured and stored in your environment, not by Anthropic," and Anthropic "processes the screenshot images and action requests in real time as part of the API call." A frame can reach the model on every turn of a task and leave no copy behind. What it showed still happened.
What does a computer use request send to the model?
It carries the image the harness captured, attached as "an extra image block on the last result in the batch," plus the instructions and the running transcript of the task (Anthropic, Computer use tool, 2026). On a portal that image holds the student name, the identifier, the balance and the activity list the page drew. A field hidden from a script but painted on the screen is in the picture, so substitution has to happen before capture.
Who approves a payment the agent submits from a student account page?
The person the harness puts in front of it. The documentation reviewed describes no approval step inside the tool and recommends isolating the model from sensitive data and actions instead. That leaves approval to the application running the loop, which should show the approver the frame, the amount and the payee before the submit. A queue that shows a task name and a timestamp asks for trust rather than a decision.
What record does Anthropic keep without a zero retention agreement?
It keeps inputs and outputs, deleted "within 30 days of receipt or generation," and a flagged session "for up to 2 years" (Anthropic, How long do you store, 2026). The clock starts when the request arrives, so the screenshot sits inside that window. None of it names the person who approved an action, because the record is about the request and not the decision that followed it.
What should a team ask for in writing before an agent reads those pages?
Four answers: whether the retention agreement names the organization and the product, what the model receives from a rendered screen on each task, which named person approves a submission, and where the record of screens and approvals is exported. Ask for each as a sentence the vendor will stand behind, then run one task with test values and compare the answers with what the harness sent.
How RedactSure Keeps a Student Account Page Out of the Request
A retention agreement limits what the vendor keeps, and the screenshot has already reached the model when that limit applies. Anthropic's computer use page says the screenshot images are "processed in real time as part of the API call."
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opened the account summary and the model received the student name, the identifier, the balance and the activity list, and the harness wrote the frame to disk. Inside the governed environment, the page renders with the identifier and the balance as tokens, a named person approves the payment, and the real balance resolves only at the payment form at the moment of that approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A retention agreement changes what Anthropic keeps, not what the screenshot showed the model. Bring one student account task and see, with test values, the page as the model receives it, the approval and the record. Book a demo