--- title: What CMEK covers on Claude Enterprise url: https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise description: Look up which Claude Enterprise data your key encrypts, what turns off or changes, and what stays under Anthropic's key. --- For Claude Platform, see [What CMEK covers on Claude Platform](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-platform). Beta and research preview features might not be covered by customer-managed encryption keys (CMEK) and can break in CMEK organizations. ## Encrypted with your key * Chat content, including skills and plugins. * Chat attachments and project attachments. * Artifacts, including Claude Design, Claude Slides, and Claude Docs in conversations and the **Artifacts** tab. * Claude Code on the CLI, including message content. * Cowork in Claude Desktop. * Office agents. * Claude in Chrome. * Claude Science, which is in beta. * [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api#customer-managed-encryption-keys) (beta) plugin versions: each version's description, release notes, components, and files. That page lists which requests still work while your key can't be used. * Compliance API [local session transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions) from sessions on users' machines. If your key can't be used, the messages endpoint returns [503 Service Unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable) instead of transcript content. Session metadata is still listed. * Backups and snapshots, which inherit the key. ## Turned off or changed This list is not exhaustive. Review it with your team before you set up CMEK. | Feature | What people see | | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Chat search | Off. Members can't search past chats, because chat titles and content are encrypted with your key. The **Search and reference chats** toggle stays off, so Claude can't either. | | [Project knowledge search](https://support.claude.com/en/articles/11473015-retrieval-augmented-generation-rag-for-projects) (RAG) | Off. Project knowledge loads into each conversation's context instead of being indexed and searched. A project can use substantially less knowledge, and the rest is left out. | | Claude Code on the web | Off. New sessions can't be started, even if an admin turns the product on. | | Claude in Slack | Off. Claude declines requests, even if an admin turns the product on. | | Claude Code Desktop | Off until an admin turns it on. Available for local sessions once turned on under [claude.ai > Organization settings > Claude Code](https://claude.ai/admin-settings/claude-code). | | Artifacts | Changed. Artifacts, including Claude Design, Claude Slides, and Claude Docs in conversations and the **Artifacts** tab, cannot be turned on in organizations that also use ZDR. In organizations with HIPAA readiness, an Owner must first accept the terms for using them. | | Artifact publishing and sharing | Changed. Claude Code cannot [publish artifacts](https://code.claude.com/docs/en/artifacts#availability). However, artifacts made in chat or Cowork can be shared within your organization, but not publicly. | | Standalone Claude Design app | Not supported. See [Encrypted with Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#encrypted-with-anthropics-key). | | Analytics: smart reports and contribution metrics | Off. Certain analytics are disabled, regardless of admin settings: Claude smart reports (beta, under claude.ai/analytics/insights) and Claude Code contribution metrics from GitHub (beta, under claude.ai/analytics/claude-code). | | Analytics: skills and connectors | Changed. Admin analytics for skills and connectors, in the claude.ai analytics dashboard and through the [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), don't include usage in chat, and hide the names of custom skills, plugins, and connectors. | | Organization data exports and audit log exports | Off. Both are under [claude.ai > Organization settings > Data and privacy](https://claude.ai/admin-settings/data-privacy-controls). | | Response ratings (thumbs up and thumbs down) | Off. Members can't rate Claude's responses. | | [Skill and plugin security scanning](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise#skill-content-scanning) | Off. The setting can't be turned on, and skills and plugins are installed without a scan. | | Claude Security and routines | Off. Beta and research preview features, turned off regardless of admin settings. | ## Encrypted with Anthropic's key The features that store this data stay available, but the data isn't encrypted with your key. You can turn off some of these features in **Settings**. | Data | Details | | --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Existing data | Written before [your key takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). | | Standalone Claude Design app | The standalone Claude Design app at claude.ai/design is not supported with CMEK, and its data might not be encrypted under your key. The standalone app is closing. Claude Design in conversations and the **Artifacts** tab is encrypted under your key, as listed under [Encrypted with your key](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#encrypted-with-your-key). | | Personal preferences and Cowork Global instructions | [Personal preferences - Instructions for Claude section](https://claude.ai/new#settings/account) and Cowork Global instructions. These are set at the account level and shared across all of a user's organizations. | | Account data for users in your organization | Includes names, email addresses, and profile pictures. | | Preserved records | Anthropic can preserve specific records [in three narrow cases](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#limited-preservation-outside-your-key). | ## Where CMEK does not apply: Claude Code telemetry When Claude Code connects through an LLM gateway or proxy (a custom `ANTHROPIC_BASE_URL`), CMEK does not apply to Claude Code's operational telemetry. To turn this telemetry off, set the `DISABLE_TELEMETRY` environment variable to `1`, as described under [Telemetry services](https://code.claude.com/docs/en/data-usage#telemetry-services) in the Claude Code documentation.