Step-by-step guide Claude Code for Non-Developers: internal tool from a spreadsheet →
Claude Code is safe enough for everyday business use if you set its limits before the first session, and risky if you don't. It isn't a chat window. It is an AI that reads, changes and deletes files and runs commands on your own computer, with your user account's rights, and what it reads is sent to Anthropic's servers to be processed. Four things decide how safe that is: the folder you give it, the permission mode you pick, one privacy setting and whether you can undo. Everything below comes from Anthropic's documentation as it reads on 10 November 2026, plus what we saw in our own test build the day before.
What it can read and change
Claude Code works in the folder where you start it. Inside that folder it can read files without asking. According to Anthropic's security page, in Manual mode it asks before its file tools read or write anything outside the folder and its subfolders.
That boundary is a question on your screen, not a wall. The same page says a command you approve can still write anywhere your user account can. So the first safety measure is also the simplest: give Claude Code an empty folder of its own, and never start it in your Documents folder, your desktop or your whole user folder.
There is a stronger barrier, called the sandbox, which has the operating system restrict what Claude's commands can reach. The sandbox documentation says it is off by default, runs on macOS, Linux and Windows' Linux subsystem but not on plain Windows, and covers commands only, not Claude's own file tools. It is useful, but a beginner shouldn't count on it. Count on the folder and the mode.
The permission modes, in plain words
The mode decides what Claude may do without asking you. In the desktop app it sits in a selector under the prompt box. This is how Anthropic's permission modes page describes the five you will meet (it lists a sixth, for unattended scripts, that you can ignore):
| Mode | What Claude does without asking | Use it for |
|---|---|---|
| Manual | Reads only. It asks before every edit and every command | First sessions and anything sensitive |
| Plan | Reads and explores, then proposes a plan without editing your files | Thinking before a big step |
| Accept edits | Edits files and runs common file commands inside the folder: create, move, copy, delete. Asks before other commands | Building, once you have save points |
| Auto | Works without routine prompts while a second AI model reviews actions and blocks those it judges unsafe | Not a first project |
| Bypass permissions | Everything, with no prompts | Never on your own computer |
Three details matter more than the table.
- Accept edits includes deleting. The security page lists the file commands it approves automatically inside the folder, and removing files is one of them. That is fine in a folder that holds only a copy. It is not fine in a folder that holds your only version of anything.
- The starting mode may not be the careful one. Since version 2.1.283, sessions in the terminal and in VS Code start in Auto. For the desktop app, the documentation tells you to check the selector before your first message, because a new session can pick up a default from your settings. Anthropic says Auto reduces prompts but does not guarantee safety, and that Bypass is only for isolated containers and virtual machines.
- Allowing a command for good really is for good. When Claude asks to run a command, you see the exact command and can allow it once or from then on. For commands, the permissions page says the second choice applies permanently for that project and command. If you don't understand a command, ask Claude what it does and what it will change before you answer.
Anthropic is plain about where the responsibility sits: "You're responsible for reviewing proposed code and commands for safety before approval." In our build we used Manual to check the computer, Plan for the build plan and Accept edits for the building. The computer check asked to run four short commands and took ten seconds.
What leaves your computer
Claude Code runs locally, but the model doesn't. Anthropic's data usage page says it sends your prompts and the model's outputs over the network, encrypted in transit. Whatever Claude opens to do its work becomes part of that conversation. In plain terms: a file Claude reads is a file that is sent.
The same page lists what else travels, and what stays:
- Usage metrics and error reports. Anthropic says metrics never include your code, prompts or file paths, and that error reports are stripped of known secrets, paths and email addresses before they leave. Both can be switched off.
- Feedback you choose to send. The feedback and bug commands send a copy of the conversation, including code, and Anthropic keeps it for five years. Nothing goes unless you send it.
- A transcript on your own disk. Sessions are stored as plain text in a
.claudefolder in your user folder. Terminal sessions are cleaned up after 30 days by default; sessions from the desktop app are exempt from that limit by default. - Claude's own notes. Claude Code keeps short notes about a project so it remembers next time. In our build it saved the owner's thirteen answers about the business there, outside the project folder. That is a built-in feature, and one more reason to keep personal details out of the conversation.
The desktop app also offers a Cloud environment, where the session runs on machines Anthropic manages. If you want the work to happen on your own computer, check that the environment selector says Local.
How long Anthropic keeps it, and whether it trains on it
| Your plan | Used to train models? | Kept for |
|---|---|---|
| Free, Pro, Max or Ultra, setting on | Yes | 5 years |
| Free, Pro, Max or Ultra, setting off | No | 30 days |
| Team, Enterprise or API | No, unless the organisation chooses to share data | 30 days as standard |
Those are the figures on the data usage page today. The setting is in your privacy settings on claude.ai, where Anthropic's privacy centre calls it Model Improvement. Look at it before any business file goes near Claude, and switch it off unless you have decided otherwise.
Two more periods are worth knowing. Anthropic's privacy centre article on how long it stores data, dated 1 July 2026, says a conversation you delete disappears from your history at once and from its back-end storage within 30 days. It also says that a session flagged by its safety systems for breaking the usage policy can be kept for up to two years, with the classification scores kept for up to seven.
Five things to set before your first session
- Check the training setting. One switch, and it decides between 30 days and five years.
- Make an empty folder and put a safe copy in it. Copy the spreadsheet or files you need, then delete names, addresses, email addresses, phone numbers and notes about people from the copy. Keep the original somewhere else. A copy without personal details means there is nothing personal to send.
- Choose Local and a careful mode. Manual or Plan to start, Accept edits to build, and look at the selector at the start of every session.
- Write house rules. Claude Code reads a file called
CLAUDE.mdat the start of every session. Ours said: stay in this folder, treat the spreadsheet as read-only, ask before installing anything or sending data to another website. Rules steer Claude. The permission mode is what actually stops an action, so you need both. - Make save points. Claude Code can rewind its own file edits, but the checkpointing page says a file that only a command changed isn't tracked, that snapshots are cleaned up after about 30 days, and that rewinding is no replacement for version control. So ask Claude to record the whole folder with Git, a free version-history tool, after every step that works. Our build ended with 25 save points.
One thing we didn't ask for is worth passing on. When Claude set up the save points in our build, it left the spreadsheet out of them on its own initiative, because a quote workbook may hold customer names, and asked whether that was right. It was.
What can still go wrong
- An agent with too much freedom. In July 2025, an AI coding agent from another company reportedly erased a customer's live database during a code freeze (AI Incident Database, incident 1152). In October 2025, a Claude Code user reported that a single delete command removed the files in their home folder (GitHub issue 10077). That second case is one user's report, and the issue was closed without a confirmed cause, but the lesson is the same in both: no live data within reach, and a way back.
- Instructions hidden in content. A web page or a file can contain text written to steer an AI assistant. Anthropic lists its safeguards against this on the security page and adds that no system is completely immune. A calculator project needs nothing from the web, so don't have Claude browse or read files from strangers inside the folder that holds your business data.
- Clicking yes without reading. Every safeguard above ends in a prompt on your screen. If you approve everything, you have chosen Bypass by habit.
So, is it safe?
With a dedicated folder, a copy with personal details removed, a careful mode, the training setting off and save points, the worst realistic outcome is that you throw away a folder and start again. Without them, Claude Code has the same reach on your computer as you do. Safe use is a matter of set-up, and the set-up takes under an hour.
Our guide, Claude Code for Non-Developers, spreadsheet-tool edition, walks through that set-up screen by screen, with the exact prompts for the computer check and the house rules, before it builds anything. For what is realistic to build once you're set up, see what non-developers can build with Claude Code, and before anyone else gets a link, run the checklist for sharing an AI-built tool.
Tools like this are safe when someone has decided, in advance, what they may touch. Neurova AI builds AI systems to healthcare standards from Eindhoven, with privacy and security designed in from the first sprint. If you'd like that thinking applied to your own team's tools, tell us what you need.
Frequently asked questions
Does Claude Code send my files to Anthropic? It sends what becomes part of the conversation. Claude Code runs on your computer, but the model runs on Anthropic's servers, so your prompts, the model's replies and the contents of files Claude opens to do the work travel there, encrypted in transit. That is why its folder should hold nothing but what the project needs.
Does Anthropic train its models on what I do in Claude Code? On Free, Pro, Max and Ultra plans, only if the model improvement setting in your privacy settings is on. With it on, Anthropic keeps the data for five years; with it off, for 30 days. On Team, Enterprise and API accounts, code and prompts are not used for training unless the organisation chooses to share them. Checked in Anthropic's documentation on 10 November 2026.
Can Claude Code delete my files? Yes, if you let it. In Accept edits mode it can create, move and delete files inside its project folder without asking, and any command you approve runs with your own user rights. Give it a dedicated folder with a copy of your data, and make a save point after every step that works.
Which permission mode should a beginner use? Start in Manual, where Claude asks before every edit and command, or in Plan, where it only proposes. Move to Accept edits for building once you have save points. Leave Bypass permissions alone: Anthropic says it is for isolated containers and virtual machines only. Check the mode selector before the first message of every session.
Can I use Claude Code with customer or patient data? Avoid it. Remove names, addresses, contact details and notes about people from the copy Claude works on, so nothing personal is sent. If the work cannot be done without personal data, that is a legal question about your plan, your contract and your privacy duties, so take advice before you start.