"Is it safe to send this to Claude?" Sooner or later every security review lands on that question. The honest answer depends on what this is, what path it takes, and what you do on your side. Below is the real data flow when you call Claude through a gateway like codexkey, what Anthropic's commercial data policy actually says in 2026, and the patterns teams use to keep PII, secrets and regulated data under control.
Where your data actually goes
When your application calls Claude through codexkey, the request passes four points:
- Your client (server, edge function, mobile app) builds the request body.
- The codexkey gateway receives it over TLS, authenticates the API key, records usage metadata and forwards the request. Provider account and channel policy applies; the dashboard key API does not expose per-key budget or rate-limit settings.
- Anthropic processes the request on its inference infrastructure and returns the response.
- The gateway streams the response back and records token usage for billing, and your client receives the output.
Two things to note. First, the request body (your prompt and any attachments) passes through the gateway in plaintext, inside the TLS tunnel. Second, both the gateway and Anthropic write logs. What ends up in those logs is the heart of the compliance question.
Anthropic's commercial data policy
For paid API traffic, Anthropic's published commercial terms for 2026 contain three points that matter for compliance:
- No training on API data. Inputs and outputs from commercial API calls are not used to train Anthropic's models. This is contractual, not a setting you toggle.
- 30-day default retention. Requests and responses may be retained for up to 30 days for abuse monitoring and operational debugging, then deleted.
- Zero data retention (ZDR) available. Eligible enterprise customers can request ZDR, which removes the 30-day window. Eligibility and configuration are negotiated through Anthropic's enterprise sales.
ZDR matters when you handle heavily regulated data: HIPAA-like records, financial PII at scale, legal privilege. For most product teams the default 30-day commercial retention is acceptable, as long as you do not pipe unredacted secrets into prompts.
Gateway logging: minimize what you log
codexkey logs request and response metadata for billing accuracy: model used, input and output tokens, latency, status code and the API key fingerprint. Full prompt bodies are not kept beyond what short-term debugging needs, but treat the gateway as a system that briefly sees your data.
What that means in practice:
- Do not put credentials, raw OAuth tokens or live session cookies into prompt bodies. If your agent needs them, fetch them server-side and use them in tool calls without echoing them into the model context.
- Redact customer data before the request leaves your service. The gateway is a transport layer, not your DLP boundary.
- Your own application logs are usually the bigger leak. Many teams log the full prompt for debugging and then forget those logs exist for years. Audit your own log retention before worrying about anyone else's.
PII redaction in two layers
The pattern that holds up in production is layered: a cheap deterministic pass first, then an LLM pass where the first one is not enough.
Layer 1: regex pre-pass. Before the prompt leaves your service, run the input through regex for the obvious things:
const REDACTORS: [RegExp, string][] = [
[/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[EMAIL]"],
[/\b(?:\d[ -]*?){13,19}\b/g, "[CARD]"], // PAN-shaped digits
[/\b\d{3}-\d{2}-\d{4}\b/g, "[SSN]"], // US SSN
[/\b\+?\d{1,3}[\s-]?\(?\d{2,4}\)?[\s-]?\d{3,4}[\s-]?\d{3,4}\b/g, "[PHONE]"],
];
function scrub(input: string): string {
return REDACTORS.reduce((acc, [re, tag]) => acc.replace(re, tag), input);
}
This catches 80% of accidental PII for almost zero cost.
Layer 2: LLM redaction with gpt-5.6-luna. For free-text fields where users paste arbitrary content (support tickets, contract clauses, medical notes), call gpt-5.6-luna as a cheap pre-pass.
We carry Haiku too: the catalog has claude-haiku-5.5 and claude-haiku-4.5, with prices on the models page. They run in the Premium channel and are not available in the Cheap Haiku channel.
The call looks like this:
const redacted = await anthropic.messages.create({
model: "gpt-5.6-luna",
max_tokens: 2000,
system: "Replace any names, addresses, account numbers, dates of birth, and medical identifiers with [REDACTED-NAME], [REDACTED-ADDRESS], etc. Preserve everything else verbatim. Output only the redacted text.",
messages: [{ role: "user", content: userInput }],
});
At gateway pricing gpt-5.6-luna is cheap enough that putting it in front of Sonnet or Opus as a redaction filter makes economic sense for sensitive workloads. The base URL stays the same:
import Anthropic from "@anthropic-ai/sdk";
const anthropic = new Anthropic({
apiKey: process.env.CODEXKEY_API_KEY,
baseURL: "https://api.codexkey.online/v1",
});
Combine the layers: regex first (deterministic, audit-friendly), then gpt-5.6-luna, but only when the field is free text and high risk. Log the redaction itself so you can prove what was removed.
EU presence and GDPR
If you have European users, the geography of transit and processing matters. codexkey runs EU-resident gateway infrastructure, which means:
- Requests from EU clients hit an EU edge first instead of crossing the Atlantic before any policy is applied.
- Gateway-side logs (billing metadata, rate-limit counters) stay in EU storage.
- Your DPA chain is shorter: one processor agreement with codexkey for the gateway layer, plus Anthropic's terms for inference.
This does not make Anthropic an EU-only processor: inference still runs on Anthropic's infrastructure, which is primarily US-based. EU presence reduces transit hops, simplifies your records of processing activities and gives you a contractual counterparty in your jurisdiction. For most B2B SaaS GDPR postures that is enough. Data that truly cannot leave the EU needs a different architecture: on-prem inference, EU-only models from other vendors, or a hybrid. No commercial Claude deployment solves that today.
Key hygiene: rotation and permissions
Disciplined key handling gives the most for the effort:
- One key per environment. Production, staging, CI, local development and every batch job get separate keys. Never shared.
- Monthly rotation, automated. Generate the new key, deploy it, deactivate the old one after a 24-hour overlap. If rotation hurts, the thing to fix is your secrets management.
- Named keys and expiry. Use a separate codexkey key for each integration, choose Premium or Cheap, and set an expiry when appropriate. Premium fallback is optional for Cheap. Usage statistics show what each key spends.
- Enforce policy in your own service. The dashboard key API does not expose budgets, model allowlists, IP filters, IDE restrictions or per-key RPM/TPM. Do not treat a key as a spending cap or a model restriction.
Audit logging on your side
Gateway logs are for billing and abuse control. They are not your audit trail. On your side, log:
- Which user or service initiated each request (correlation ID, user ID, tenant ID).
- What model and which key was used.
- Token counts and cost (pulled from the response headers codexkey returns).
- Whether redaction was applied and which redactors fired.
- The hash of the input, not the input itself, if your retention policy forbids storing prompt bodies.
That gives you a complete record without storing sensitive content. When a regulator or auditor asks "did user X's data get sent to Claude on date Y", you can answer from your own logs without depending on anyone else's retention.
Threat model: a stolen key
Assume a key will eventually leak: into a git commit, a CI log, a contractor's machine. What matters is what an attacker can do with it before you notice.
A master key with no caps lets them rack up a four-figure bill overnight calling Opus on a loop, or worse, exfiltrate context if the key is used by an agent with tool access.
A codexkey key is not a per-key spend cap, model allowlist or IP filter. Expiry limits its lifetime, but a leaked active key can still be used before it expires. Keep credentials in your secret store, monitor usage, revoke leaked keys, and enforce access policy in your own service.
Bottom line
Cloud LLM security is defense in depth, not a single switch:
- Anthropic's commercial policy (no training, 30-day retention, ZDR available) handles the upstream layer.
- The codexkey gateway with EU presence handles transit and policy enforcement.
- Your redaction pipeline (regex + gpt-5.6-luna) handles what leaves your service.
- Separate named keys, expiry, monitoring and fast revocation reduce credential exposure.
- Your own audit logs handle the regulator question.
Each layer is cheap on its own. Stacked, they get you to a posture that survives a security review without theater. Pair this with the cost discipline from our Claude API pricing guide and you have both the unit economics and the compliance story in one shape.