Legal and compliance
Legal agreements, compliance certifications, and security information for Claude Code.
Legal agreements
License
Your use of Claude Code is subject to:
- Commercial Terms - for Team, Enterprise, and Claude API users
- Consumer Terms of Service - for Free, Pro, and Max users
Commercial agreements
Whether you're using the Claude API directly (1P) or accessing it through AWS Bedrock or Google Vertex (3P), your existing commercial agreement will apply to Claude Code usage, unless we've mutually agreed otherwise.
Compliance
Healthcare compliance (BAA)
If a customer has a Business Associate Agreement (BAA) with us, and wants to use Claude Code, the BAA will automatically extend to cover Claude Code if the customer has executed a BAA and has Zero Data Retention (ZDR) activated. The BAA will be applicable to that customer's API traffic flowing through Claude Code. ZDR is enabled on a per-organization basis, so each organization must have ZDR enabled separately to be covered under the BAA.
Usage policy
Acceptable use
Claude Code usage is subject to the Anthropic Usage Policy. Advertised usage limits for Pro and Max plans assume ordinary, individual usage of Claude Code and the Agent SDK.
Authentication and credential use
Claude Code authenticates with Anthropic's servers using OAuth tokens or API keys. These authentication methods serve different purposes:
- OAuth authentication (used with Free, Pro, and Max plans) is intended exclusively for Claude Code and Claude.ai. Using OAuth tokens obtained through Claude Free, Pro, or Max accounts in any other product, tool, or service — including the Agent SDK — is not permitted and constitutes a violation of the Consumer Terms of Service.
- Developers building products or services that interact with Claude's capabilities, including those using the Agent SDK, should use API key authentication through Claude Console or a supported cloud provider. Anthropic does not permit third-party developers to offer Claude.ai login or to route requests through Free, Pro, or Max plan credentials on behalf of their users.
Anthropic reserves the right to take measures to enforce these restrictions and may do so without prior notice.
For questions about permitted authentication methods for your use case, please contact sales.
Security and trust
Trust and safety
You can find more information in the Anthropic Trust Center and Transparency Hub.
Security vulnerability reporting
Anthropic manages our security program through HackerOne. Use this form to report vulnerabilities.
© Anthropic PBC. All rights reserved. Use is subject to applicable Anthropic Terms of Service.