Using Claude Team Safely: A Configuration Checklist for Your Firm
Discover essential safety configurations for your firm to optimize the use of Claude Team effectively and securely.
Table of Contents
Using Claude Team Safely: A Configuration Checklist for Your Firm
Last Updated on 12th October | Published by Parnav Dagar
1. Purpose and how to use this article
Many tax and accounting firms now use Claude, the AI assistant from Anthropic, for drafting, research and summarizing. Claude is a useful tool, but the way your firm's workspace is set up decides how safely your staff can use it alongside client data. This article gives you a checklist for reviewing that setup on the Claude Team plan.
It is written for the person at your firm who manages the Claude workspace, and for the partner or owner who signs off on how staff may use AI tools. It answers three questions:
- Is our Claude workspace set up so staff can use it safely? See Sections 3 to 7.
- What should our written AI policy cover? See Section 8.
- What can the Team plan not do, and what should we do about it? See Section 9.
Section 2 explains how to work through the checklist. Section 10 covers keeping the review current, and Section 11 tells you how to reach us.
This is a settings review, not legal advice
This checklist helps you review your Claude settings and your internal policy. It does not tell you whether your firm meets the FTC Safeguards Rule, IRS Publication 4557 or any other requirement, and completing it does not certify compliance.
Any question about client consent, engagement letters or IRC Section 7216 (the rules on how tax return preparers use and disclose return information) belongs with your firm's legal counsel.
2. Before you start
To change most of the settings in this article you need the Owner or Primary Owner role in your Claude workspace. If you are not sure who holds those roles, Section 4 explains how to check.
Work through Sections 3 to 8 from top to bottom. Mark each item as one of the following:
- Pass: the setting or policy is in place.
- Fail: it is missing or set up incorrectly. Note what needs to change and who will do it.
- Not applicable: the item does not apply to your firm, for example a connector you do not use.
Some items are marked Enterprise only. These features are not available on the Team plan, so you cannot fix them by changing a setting. For each one, either record it as an accepted risk in your firm's written information security program (WISP) or plan an upgrade to the Enterprise plan. Section 9 lists them in one place.
3. Plan and account basics
| Check | What to confirm |
|---|---|
| Your firm is on the Team plan | Confirm your firm uses a Claude Team workspace, not a collection of individual Free, Pro or Max accounts paid for by staff. Anthropic states that, by default, it does not use inputs or outputs from its commercial products, which include the Team plan, to train its models. Individual consumer accounts work differently and are controlled by each person's own settings, so your firm has no oversight of them. |
| Billing owner is a firm address | The workspace billing owner should be a firm-controlled email address, not a partner's personal account. If that person leaves, your firm should not lose control of the workspace. |
| Recorded in your vendor register | Record the plan, the number of seats and the renewal date in your firm's list of service providers. |
| Plan size still fits | The Team plan supports up to 150 seats. If your firm needs more seats, or needs audit logs or its own data retention period, the Enterprise plan is the right tier. Decide this now rather than after something goes wrong. |
4. Sign-in and access
Controlling who can sign in, and how, is one of the safeguards the FTC Safeguards Rule expects you to have in place. These items keep access to the workspace limited to current staff using your firm's own sign-in.
| Check | What to confirm |
|---|---|
| Domain verified | Your firm's email domain is verified in Claude's organization settings. Once it is verified, turn on Restrict organization creation. This stops staff from creating separate Claude organizations or personal accounts with your firm's email domain. |
| Single sign-on (SSO) set up | SSO is connected to the identity provider your firm already uses, such as Microsoft Entra ID, Google, Okta, OneLogin, JumpCloud or Duo. Staff then sign in to Claude with their normal work account. |
| SSO required | Turn on Require SSO for Claude. If staff can still choose to sign in with an email link, the control is only partly in place. |
| Multi-factor authentication at your identity provider | Claude follows the sign-in rules of your identity provider. Make sure multi-factor authentication is required there, because that is what protects the Claude sign-in. |
| How new users are added | On the Team plan you can add users by invitation only, or use Just-in-Time provisioning, which adds a user the first time they sign in through SSO. Choose one on purpose. Automatic directory sync (SCIM) is Enterprise only. |
| Roles reviewed | Check who holds the Primary Owner, Owner and Admin roles. These roles control the workspace settings, so they belong with a partner or your firm's IT lead, not whoever happened to set up the account first. Everyone else should have the User role. |
Why personal accounts matter
If a staff member uses a personal Claude account for firm work, your firm cannot see that account, cannot remove it when they leave and cannot control its privacy settings. Restricting organization creation on your domain and writing a clear rule into your AI policy (Section 8) closes this gap.
5. When staff leave
| Check | What to confirm |
|---|---|
| Removal is on your exit checklist | Your firm's exit checklist includes removing the departing person from the Claude workspace on their last day. |
| Removal is done in Claude, not only at your identity provider | If you use Just-in-Time provisioning, disabling someone at your identity provider stops them signing in, but they stay in Claude's member list until you remove them. Remove them in Claude as well so their seat and workspace access are closed. |
| Member list matches your staff list | Compare the current Claude member list with your list of active staff. Anyone who has left but still holds a seat is a finding to fix straight away. |
6. Data handling and privacy settings
| Check | What to confirm |
|---|---|
| Training position documented | Keep a copy of Anthropic's Commercial Terms and its statement on model training with your WISP. This is evidence that your firm checked how the vendor handles your data before using it. |
| Feedback setting reviewed | When a user clicks thumbs up or thumbs down on a response, Anthropic stores the whole related conversation for up to five years. An Owner can turn this off for the whole firm with the Rate chats setting under Organization settings, Data and Privacy. Decide whether your staff should be able to send feedback, given what they may have typed. |
| Retention limits understood | Setting your own deletion period for chats and projects is Enterprise only. On the Team plan your firm cannot choose how long Claude keeps conversations. If your WISP promises a specific retention period for AI tools, either change the WISP wording or plan the Enterprise upgrade. |
| Who can export data is recorded | Owners can export the organization's data. Record in your WISP who holds that authority and when it may be used. |
| Vendor file kept | Anthropic publishes its security documentation, including its SOC 2 report, through its Trust Center. Keep a copy in your vendor records. IRS Publication 4557 and the FTC Safeguards Rule both expect you to oversee the service providers that handle client information. |
7. Connectors and Claude Code
Connectors let Claude search and read your firm's other tools. On the Team plan these include Google Drive, Gmail, Google Calendar, Microsoft 365, Slack and GitHub. This is where most real risk sits, because a connector can reach anything the connected user's account can reach.
Connectors follow your existing permissions
If a shared drive or mailbox holding client returns is open to more people than it should be, a connector makes that data easier to find and summarize for every one of them. Claude does not create the exposure, but it can make an existing one much more visible.
Before you turn on a connector, have whoever manages your Microsoft 365 or Google Workspace confirm that sharing and folder permissions are set the way your firm intends.
| Check | What to confirm |
|---|---|
| Connectors listed | Make a list of which connectors are turned on. An Owner can turn off any connector for the whole firm. |
| Only needed connectors are on | Turn on only the connectors your firm has a real use for. Leave connectors to mailboxes or drives that hold client returns off until the permissions behind them have been checked. |
| Custom connectors controlled | Decide who may add custom connectors or integrations. If Claude's settings cannot limit this for your firm, put the rule in your AI policy and check for new additions each time you repeat this review. |
| Claude Code reviewed | Claude Code is a coding tool included with the Team plan. If your staff do not write code, keep it switched off. If you do use it, set spending limits at both the firm level and the individual user level. |
8. Your firm's AI usage policy
Settings alone cannot make AI use safe. Your firm also needs written rules that staff know and follow.
| Check | What to confirm |
|---|---|
| Written AI policy in place | Your firm has a written policy for AI tools, included in your WISP. At a minimum it should cover what client data may go into Claude, what Claude may be used for, and what is not allowed. |
| Client data rules are clear | A sensible starting point is no unredacted Social Security numbers, EINs, bank account numbers or full client returns in prompts or uploads. Approved uses might include drafting, research and summarizing public guidance. Prohibited uses might include pasting full client organizers, uploading raw return files and using a personal Claude account for firm work. |
| Client consent reviewed with counsel | If client return information will be used with any third-party tool, ask your counsel to confirm that your engagement letters and consent forms cover it. This checklist does not make that decision. |
| Staff trained | Hold a short, recorded session that walks staff through the policy. IRS Publication 4557 expects security awareness training, and AI tools should now be part of it. |
9. What the Team plan cannot do
These limits apply to every firm on the Team plan. Knowing them up front lets you write an accurate WISP and decide whether the Enterprise plan is worth it for your firm.
| Limitation | What it means for your firm | What you can do |
|---|---|---|
| No custom data retention | You cannot set your own period after which chats and projects are deleted. | Change your WISP wording to match, or upgrade to Enterprise. |
| No audit logs | There is no record of each user's activity to review during an investigation. | Use your identity provider's sign-in records and Claude's usage information, or upgrade to Enterprise if you need an audit trail. |
| No automatic directory sync (SCIM) | Users removed from your identity provider are not removed from Claude automatically. | Make removal in Claude part of your exit checklist (Section 5). |
| Connectors follow existing permissions | Loose sharing in your Microsoft 365 or Google Workspace becomes loose AI access. | Have permissions checked before turning on connectors (Section 7). |
10. Keeping this review current
The FTC Safeguards Rule expects you to review your safeguards regularly, not only once. Add this checklist to your firm's annual compliance calendar.
Also repeat it whenever any of the following happens:
- Your firm changes Claude plans.
- Someone adds a new connector or custom integration.
- A person holding the Owner or Admin role leaves or changes jobs.
Anthropic changes Claude's features and plans often. Before each review, check Anthropic's Claude Help Center for the current Team plan features rather than relying on this article alone.
11. Getting help
If you have questions about this article, contact our Managed IT team:
- Email: itsupport@verito.com
- Phone: 844-629-9899
For questions about your Claude subscription or billing, contact Anthropic through the Claude Help Center. For questions about client consent or IRC Section 7216, speak to your firm's legal counsel.
Statements about Claude plan features reflect Anthropic's published documentation as of October 2026. This article is general guidance and is not legal advice. It does not certify that your firm meets the FTC Safeguards Rule, IRS Publication 4557 or any other requirement.
Table of Contents