# AI accounts and hosting: what really changes between the plans > Personal account, enterprise account, processing in Europe, qualified cloud, local model: what each option guarantees, what it lacks, and why the same tool, such as Claude Code or ChatGPT, can fall under several of them. - Source : https://industryhub.site/en/articles/ia-comptes-hebergement-comprendre-offres - Published : 2026-10-31 - Author : IndustryHub - Language : English - Keywords : protection-des-donnees, ia-entreprise, secnumcloud, modele-local, claude-code, chatgpt ## The essentials — the product does not tell you where the data goes Claude Code on a Max account and Claude Code connected to Amazon Bedrock in Europe are the same software. For your data, they are two different situations. Three questions make the difference: 1. **Which contract?** Consumer terms, or an enterprise contract. 2. **Where does the data go?** The place of processing, and the law that applies to the supplier. 3. **Who can trace it?** A log the company can use, or nothing. | Option | Contract | Training on your data | Location | Log | Level covered | |---|---|---|---|---|---| | **Free or personal account** | Consumer | Depends on the user's setting | Not controlled | None for the company | Public | | **Enterprise account under contract** | Enterprise | No, by default | Not guaranteed in Europe | Depends on the plan | Internal | | **Enterprise, Europe, logging** | Enterprise | No, by default | Chosen EU region | Enabled | Confidential | | **Qualified European cloud** | Enterprise | Check the contract | In Europe | Check the contract | Critical | | **Model on your premises** | No third party | Not applicable | Your premises | Your own | Critical | The last column comes from the grid of the tool [Which data can you give to an AI?](/en/tools/safety/data-ai-risk). It is an IndustryHub calibration, not a standard. --- ## Free or personal account **Plans:** ChatGPT Free, Plus or Pro; Claude and Claude Code on Free, Pro, Max or Ultra. **Paying does not change the category.** A Max subscription is expensive, but it remains an individual account under consumer terms. **Training.** At OpenAI, conversations are used for training unless the user opts out. At Anthropic, it is an account setting. If accepted, data is retained for 5 years. If refused, 30 days. **What is missing.** Turning off training settles one point only. The company still has no enterprise contract, no account administration and no log. The setting depends on each employee. **Reserve for:** public data. --- ## Enterprise account under contract **Plans:** ChatGPT Business or Enterprise; Claude and Claude Code on Team, Enterprise or API. **What protects you.** OpenAI and Anthropic do not train their models on this data by default. At Anthropic, the data processing addendum is automatically part of the commercial terms. Standard retention there is 30 days. At OpenAI, on ChatGPT Enterprise, administrators set the duration, and a deleted conversation is removed within 30 days unless the law requires otherwise. **What is missing.** - **Location.** Anthropic states that by default it may route traffic to the US, Europe, Asia and Australia, with storage in the US, unless otherwise agreed. - **Logging, depending on the plan.** On Claude, audit logs are reserved for Enterprise: 180 days exportable, without conversation content. Team does not have them. - **Voluntary sharing.** Feedback sent to the supplier can fall outside this frame. In Claude Code, `/feedback` sends the conversation, which is retained for 5 years. **Reserve for:** internal data. --- ## Enterprise account, processing in Europe, access logging Three cumulative conditions: an enterprise contract, processing in Europe, logging enabled. If one is missing, the option falls back to the previous level. | Access | What the supplier says | To check | |---|---|---| | **Claude Code through Amazon Bedrock** | Model providers have access neither to prompts nor to completions | `eu-*` region, `eu.` prefix, invocation logging enabled | | **Claude Code through Google Cloud** | `eu` location available | Do not stay on `global`, which guarantees no location | | **ChatGPT Enterprise or API, data residency in Europe** | Content stored in the chosen region, for eligible customers | Place of computation, as well as place of storage; ChatGPT Business is not mentioned | | **Microsoft 365 Copilot** | EU traffic stays within its EU boundary | Anthropic models are currently excluded | | **Mistral Vibe Enterprise** | Hosted in the EU by default, training opted out from the start | Features involving a transfer, to be turned off at organisation level | **Three settings are easily lost on Bedrock.** With no region set, Claude Code defaults to `us-east-1`. The `eu.` prefix is a preference, not a guarantee. And invocation logging is disabled by default: it has to be enabled. In addition, some recent models, such as Claude Fable 5, require AWS to be able to retain exchanges for up to 30 days and review them: check this condition for the chosen model. **A copilot sees what the user sees.** Microsoft 365 Copilot surfaces any content the person is entitled to view. An over-broad share becomes reachable through a simple question. **Limit.** Hosting in Europe settles the location, not the law. A US supplier remains subject to the *CLOUD Act*, even for data stored abroad. That is why this option stops at the Confidential level. --- ## Qualified European cloud **In France, the reference is SecNumCloud,** the ANSSI qualification. Its framework requires protection against non-European laws. That is what sets it apart from simple hosting in Europe. **The qualification covers a service, not a brand.** An AI platform hosted by a qualified provider is not itself qualified. Check that the AI service itself appears in the [ANSSI catalogue](https://cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/services-de-securite-evalue/decouvrir-les-solutions-certifiees-qualifiees/), updated at least once a month. **In Germany, the BSI's C5 is of a different kind.** There is no C5 certificate, only an audit attestation covering specific services and regions. Read the report: a C5 attestation does not read like a SecNumCloud qualification. **What is missing.** A narrower model catalogue and a higher cost. Dual-use items remain a separate case: export control, then a local model. --- ## Model on your premises **Principle.** An open-weight model runs on your servers. No AI supplier receives the data. **Claude Code can be connected to it.** Ollama exposes a compatible interface: point `ANTHROPIC_BASE_URL` to `http://localhost:11434`. Ollama recommends a context window of 64,000 tokens or more. The software remains Claude Code, the model is no longer Claude. **"Local" has to be checked.** - Ollama also offers models in its own cloud: choose a local model. - Claude Code keeps a few outgoing connections. The WebFetch safety check sends the hostname to `api.anthropic.com`, unless `skipWebFetchPreflight` turns it off. `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` turns off non-essential traffic. **What is missing.** A compute server to size, in-house skills, and often models that lag on the hardest tasks. Licences vary from one model to another, even at the same publisher: read the licence of the chosen model before commercial use. **What remains your responsibility.** Access rights, backups, logs. An internal leak remains possible. --- ## One tool, several answers For an electrical schematic of a routine installation, classified Confidential: | Claude Code with… | Option | Answer | |---|---|---| | Pro or Max account | Personal account | No | | Team, Enterprise or API account | Enterprise under contract | No: location not guaranteed | | Amazon Bedrock or Google Cloud, EU region, logging enabled | Enterprise, Europe, logging | Yes | | Ollama and a local model | Model on your premises | Yes, subject to the settings above | These "no" answers come from our deliberately cautious grid. A company may judge an Enterprise account sufficient for its routine schematics: that is a decision to take and write down, not to leave to each employee. --- ## Check what you are really using - [ ] The account is in the company's name, not an employee's - [ ] The contract and its data processing addendum are signed or accepted, and archived - [ ] Training is turned off for the organisation, and voluntary sharing is controlled - [ ] The place of processing is written in the contract, not just the place of storage - [ ] In Claude Code, `/status` shows the expected provider and region - [ ] Logging is enabled, and someone knows how to read it - [ ] File access rights are reviewed before connecting an assistant --- ## Limits These plans change often: this text reflects the supplier pages consulted on 31 October 2026. The signed contract prevails. Prices are not covered, as they move too quickly. This article is not legal advice. --- ## Further reading - Tool [Which data can you give to an AI?](/en/tools/safety/data-ai-risk) — this document, this AI: yes or no - Article [Which data can go into an AI?](/en/articles/risque-donnees-ia-arbre-decision) — the classification method - Article [Digitalising the company in the age of AI](/en/articles/digitalisation-entreprise-ia-donnees-competitivite) — contracts, applicable law, supplier independence **Sources.** [Claude Code, data usage](https://code.claude.com/docs/en/data-usage), [Claude Code on Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock), [Claude Code on Google Cloud](https://code.claude.com/docs/en/google-vertex-ai), [Anthropic, data location](https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers), [Anthropic, DPA](https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa), [Claude, audit logs](https://support.claude.com/en/articles/9970975-access-audit-logs), [OpenAI, enterprise privacy](https://openai.com/enterprise-privacy/), [OpenAI, training](https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/), [OpenAI, data residency](https://openai.com/index/expanding-data-residency-access-to-business-customers-worldwide/), [Amazon Bedrock, data protection](https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html), [Amazon Bedrock, invocation logging](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html), [Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy), [Mistral, data storage](https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data), [Ollama and Claude Code](https://docs.ollama.com/integrations/claude-code), [ANSSI, SecNumCloud](https://cyber.gouv.fr/enjeux-technologiques/cloud/faq-qualification-secnumcloud/), [BSI, C5 FAQ](https://www.bsi.bund.de/dok/C5-FAQ-en).