Remove Sensitive Data Before Sending to Claude

Scrub PII Before Sending Prompts to Claude

Every prompt you send to Claude leaves your network. Internal credentials, customer emails, production IP addresses: all of it arrives on Anthropic's servers, where their data retention and model training policies govern what happens next.

Enterprise agreements and zero-data-retention options exist, but most developers and small teams using Claude.ai or the standard API operate without a negotiated policy. Scrubbing sensitive values before the prompt reaches Claude's servers eliminates the transmission risk regardless of which tier you use.

How Claude uses submitted data

By default, Anthropic may use API and Claude.ai conversations to improve its models unless you opt out through a business agreement.¹ Consequently, a prompt containing your production database URL or an employee's Social Security Number could become training material for a future model. Even with zero-data-retention set, the transmission itself creates a window of exposure that smart pre-processing eliminates entirely. Scrubbing sensitive values before the request fires means the risk window never opens.

The transmission event is the critical moment. Your prompt leaves your network, reaches Anthropic's infrastructure, and gets processed by their models. Every value in that prompt exists on their servers during processing, regardless of how briefly. For organizations subject to GDPR, CCPA, or internal data governance policies, that transmission window is the exposure point.² Scrubbing before the prompt travels across the network ensures that only tokens reach Anthropic's infrastructure, so the processing windows contains no identifiable data and the retention policy question becomes irrelevant.

What Claude needs versus what you send

Claude understands context, not raw values. When you write "debug why 10.0.1.42 returns a 503," you could write "debug why [IP_1] returns a 503" and receive exactly the same quality of analysis. Building on this, token substitution preserves the semantic structure of every prompt, including the relationship between entities, the shape of the problem, and the relevant code path, while removing the identifiable values that create compliance exposure. Claude never needed the real IP.

This principle applies universally across AI models: the structural content of a prompt drives the quality of the response, not the specific values. An AI that sees "[API_1] is used to authenticate requests to [DOMAIN_1]" can still identify that hardcoded credentials in source code are a security risk and suggest using environment variables instead. The real API key and domain name add no analytical value. Removing them before the prompt reaches Claude preserves your infrastructure confidentiality without reducing the quality of the assistance you receive.

Restoring real values in Claude responses

After Claude responds with [IP_1] in its output, paste the response into the Restore tab and upload your downloaded variables file. The scrubber replaces every placeholder with the original value in under a second. Your team gets a response that reads naturally and contains your real server addresses, without ever having exposed them to an external server. Consequently, the two-way workflow lets Claude function as a fully capable debugging partner while your data governance policy remains intact.

The restore workflow is especially useful for teams that interact with Claude across multiple turns in a single conversation. Each turn from Claude may reference tokenized values from your original prompt. Rather than downloading the variables file after every message, download it once after your initial scrub and keep it available for restoring any response in the conversation. When the conversation is complete, the variables file serves as a record of what was tokenized, which is useful for audit trails in organizations that document data sharing with AI providers.

Anthropic data retention tiers: consumer, API, and enterprise

Anthropic offers three access tiers with distinct data handling characteristics. Claude.ai consumer accounts operate under Anthropic's standard privacy policy, which permits using conversations to improve models unless you opt out under Account Settings → Privacy → Improve Claude for everyone. Standard API accounts without a negotiated data agreement operate under API terms that also permit training use by default. Claude Enterprise plans include a zero-data-retention (ZDR) option that prevents Anthropic from storing conversation content after the response is delivered.³

Understanding which tier applies to your organization changes how you think about residual risk after scrubbing. Under ZDR, the transmission window is the only exposure: your prompt reaches Anthropic's infrastructure, the response is generated, and nothing persists. Even with ZDR active, the transmission event occurs on every request. Scrubbing ensures that what transmits contains no identifiable values, making the retention question irrelevant for the fields you have removed.

Verifying ZDR status for Claude Enterprise accounts

ZDR must be explicitly configured at the organization level in the Anthropic Console.³ Individual developers using a personal API key do not have ZDR access regardless of their billing tier. If you are uncertain which tier applies to your API key, check the organization settings in Anthropic Console under Security → Data retention. When uncertain, treat the account as non-ZDR and scrub all sensitive values before every request.

Multi-turn conversations and context accumulation risk

Claude.ai maintains conversation history within each session. Every turn you add to a conversation appends to the context window transmitted to Anthropic's servers on subsequent turns. Consequently, a sensitive value included in turn 3 of a conversation is included in the full context sent on turns 4, 5, and every turn that follows. Scrubbing each turn before you send it prevents sensitive data from accumulating in the conversation thread.

The risk compounds in long debugging sessions where each turn builds on prior responses. A developer who includes a real database connection string in turn 1 exposes that value in every subsequent request in the session, even if later turns contain no new sensitive data. Starting a fresh conversation for each topic, or scrubbing at the first mention of any sensitive value, prevents this compounding effect entirely.

Saved conversation history and post-session cleanup

Claude.ai saves conversation history in your account. Any sensitive value sent without scrubbing in a past conversation persists in that history until you delete the specific conversation. For teams with strict data governance requirements, establish a policy of deleting Claude.ai conversations that involved internal data after the session closes. The more reliable long-term approach is to make scrubbing the habit, not conversation cleanup, so the history contains only tokens rather than real values and no post-session cleanup is needed.

System prompts and operator-level data exposure in the Claude API

Organizations using the Claude API directly build system prompts that establish context, persona, and instructions for every user interaction. System prompts frequently include internal tool descriptions, internal API endpoint URLs, and example data with real infrastructure references embedded. These system prompts are part of every API request and transmit to Anthropic's servers on each call.⁴

Apply the scrubber to system prompt content before it enters production. A system prompt that references your internal CRM API endpoint as context sends that endpoint to Anthropic on every single API call your application makes. Tokenizing internal references in the system prompt and maintaining a separate mapping for operator context removes this exposure from every user interaction automatically, rather than requiring prompt-level scrubbing at runtime.

Credential management for multi-tenant Claude API applications

Multi-tenant applications that include organization-specific context in system prompts create a more complex exposure pattern. Each tenant's system prompt may include their specific API endpoints, internal domain names, or example data. Scrubbing each tenant's system prompt template at deployment time, rather than at runtime, gives you a stable and auditable baseline: the variables file for each tenant's prompt documents what was replaced, creating a record suitable for security review. Store per-tenant variables files in your secrets management system alongside the original credentials they map to.

Treating each tenant's template as a scrubbed artifact means the deployed system prompt carries no live credentials into Anthropic's infrastructure. CapyToolkit runs this step in your browser, so the scrubbing happens before any request leaves the machine and the variables file stays under your own access controls rather than in a shared build environment.

When to use this

Use this before pasting any prompt into Claude that contains production credentials, customer data, internal hostnames, or content covered by your team's data handling or AI usage policy.

Examples

Our service at auth.internal.company.com returns 401 when the JWT eyJhbGciOiJSUzI1NiJ9.eyJ1c2VyX2lkIjoiMTIzIn0.sig is passed.

Our service at [DOMAIN_1] returns 401 when the JWT [JWT_1] is passed.

Explain why this query is slow: SELECT * FROM users WHERE email = '[email protected]' — db is at postgres://admin:[email protected]/main

Explain why this query is slow: SELECT * FROM users WHERE email = '[EMAIL_1]' — db is at [DBURL_1]