What separates an NDA-safe Claude prompt from a confidentiality breach?
Three properties separate engagement-grade prompts from breaches. **Identifier hygiene at the keyboard:** client name, client people, exact revenue and headcount figures, deal codenames, and any data covered by a specific NDA clause are scrubbed unless the engagement letter and the MSA explicitly clear the AI vendor as a permitted subprocessor. **Scope discipline:** the prompt asks Claude to structure, draft, or critique — not to commit the firm to a recommendation or to invent data the consultant has not verified. **Consultant read-back:** the engagement lead reviews every output before it reaches a client, an interview subject, or a vendor.
Per Anthropic's Trust Center, Claude for Work tiers do not train on your prompts and Anthropic will sign a DPA and CCPA addendum. That removes the training-on-content concern, but it does not override your client contract. Many Fortune 500 MSAs require explicit consent before any client confidential information is processed by a third-party AI subprocessor; some name specific vendors. Read the engagement letter before pasting. When in doubt: anonymize the client to 'Client A,' replace exact figures with rounded ranges or indices, and keep names of client employees out of prompts entirely. Per the Consulting.com 2025 independent-consultant benchmark, the boutiques getting sued in 2026 over AI use are losing on contract terms, not model behavior.