Claude Code or Codex in business: data protection, security and cost compared

The short answer: in business, three questions decide the outcome rather than model league tables: which data leaves the company, what the agent may do without asking, and what operation costs per seat. For Claude Code, the vendor documentation states that commercial plans involve no training on code and prompts, 30 days of retention and Zero Data Retention on request[1]. For Codex, the administration documentation we read contains no statement on training or default retention[7]. On top of that, Claude can now be reached through several Microsoft channels, each with its own legal basis and, in the EU, partly different defaults[3][4][5]. In our assessment, both can be managed in a mid-sized company once accounts, data classes, data flow and permissions are settled up front.

Disclosure: Avolang uses Claude and OpenAI’s models side by side and advises on Microsoft 365 and on using AI in business, so we have a commercial interest in the topic. For Claude Code, this article draws on Anthropic’s documentation and our own use; for Codex, on OpenAI’s documentation. In the sourced sections we deliberately do not assess model performance; our day-to-day experience with both vendors is set apart in the section “Experience from practice” and is subjective and not measured. Our own assessments are marked as such, as are unconfirmed reports. All information is as of 9 November 2026. It does not replace legal advice.

Starting point: coding assistants are agents, not chat windows

Anthropic’s Claude Code and OpenAI’s Codex are coding assistants with agent functions. They read source code, run commands in the terminal, change files and, on request, start tests or load content from the web. Claude Code runs locally on the computer but sends all inputs and outputs to the model; the connection is encrypted with TLS 1.2 or higher[1]. That brings not just questions but code, configuration files and everything visible in the terminal into a vendor’s sphere of responsibility.

Management therefore faces three questions: Who may use which tool with which account? Which data may enter an agent’s workspace? And which actions may the agent trigger itself? Both vendors expressly leave the review of proposed changes to the users[2][6]. The framework for such rules is in the guide to the AI policy and in the article on AI governance in business; the liability questions of unapproved AI use are covered in our white paper.

This article compares data protection, security and cost on the basis of vendor documentation. Which tool delivers better results on programming tasks, we do not measure: it changes with every model version and can only be decided in your own company, on your own test tasks. Our day-to-day experience with both vendors is set apart, and marked as such, in the section “Experience from practice”.

Data protection with Claude Code: account, retention and data flow

What happens to the data depends first on the account type. On personal plans (Free, Pro, Max, Ultra), users can allow their data to be used to improve future models, expressly including when using Claude Code; if allowed, retention is five years, otherwise 30 days. On commercial plans (Team, Enterprise, API, third-party platforms and Claude Gov), Anthropic says it does not train on code or prompts from Claude Code unless the customer has opted in, for example through the Development Partner Program[1]. The practical consequence: if a developer works on company code with a personal Pro or Max account, the commitments of the enterprise contracts do not apply (Avolang assessment).

On commercial plans, standard retention is 30 days. Zero Data Retention (ZDR) is available for qualifying Claude Code accounts on Claude for Enterprise but is not part of the standard plan; the account team enables it per organisation after checking eligibility[1]. In addition, Claude Code stores session transcripts locally in plain text under ~/.claude/projects/, for 30 days by default (setting cleanupPeriodDays)[1]. If a session contains credentials, they are therefore probably also in the local transcript (Avolang assessment).

There are further data flows worth knowing:

• Metrics on latency, reliability and usage never include code, prompts or file paths according to the documentation and can be switched off with DISABLE_TELEMETRY=1[1].
• Error reports are active only when signed in with a personal Pro, Max or Ultra subscription from version 2.1.198 and are off for contracts with Zero Data Retention or HIPAA[1].
• The /feedback command (likewise /bug and /share) sends a copy of the conversation history including code to Anthropic; such transcripts are retained for five years. DISABLE_FEEDBACK_COMMAND=1 blocks the command[1].
• CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC switches off non-essential connections. It does not cover the WebFetch tool’s safety check, which sends the hostname (not the URL) to api.anthropic.com[1].

Anyone running Claude Code through Amazon Bedrock, Google Cloud, Microsoft Foundry or Claude Platform on AWS has metrics, error reports and feedback reports switched off by default; the session-quality surveys and the WebFetch check run regardless. Encryption at rest depends on the chosen provider, and with Foundry on the hosting model[1]. The documentation is the vendor’s statement; whether a specific configuration meets GDPR requirements is for data-protection counsel to clarify case by case. On data processing agreements, transfers to third countries and access under US law, we refer to our article on ChatGPT, Claude and a local AI agent.

Data protection with Codex: what the documentation says and what it does not

Codex is OpenAI’s coding assistant and is included in the ChatGPT plans Free, Go, Plus, Pro, Business, Edu and Enterprise; usage is shared with ChatGPT Work and limited by quotas and credits[8]. The administration documentation for ChatGPT Enterprise covers data-protection questions only in part: the page we read contains no statement on training or default retention[7]. It does name:

• Enterprise Key Management for supported stored content in eligible workspaces
• data residency only for eligible content and supported workloads
• role-based access control (RBAC) through workspace roles
• managed configuration through a requirements.toml file that delivers requirements to local clients through a cloud, device or system channel
• a Compliance API for audit and investigations[7]

Two points matter for planning. First, according to the page, local computer access with Work Cloud has no strict Zero Data Retention; anyone who requires ZDR should not enable the feature. Second, Codex Cloud is off by default for Enterprise workspaces, and cloud environments inherit neither the local device policy nor local network access; they respect the repository permissions of the connected source system[7].

On data outflow, the security page gives no complete statement. It says: OpenTelemetry export is off by default, prompt text is redacted unless explicitly allowed, and telemetry should go only to collectors the company controls. However, the network policies for commands do not cover the client’s requests to the model and for sign-in, nor the traffic from web search, apps and MCP servers[6].

One gap remains: OpenAI’s privacy page for businesses could not be retrieved on 9 November 2026 (HTTP 403). We therefore do not restate claims on training and retention at OpenAI that we have not read ourselves. Before deciding, read OpenAI’s current contract documents and privacy notices; for placing the Business and Enterprise plans, see our article on ChatGPT and Claude in business.

Claude comes to Microsoft: seven routes with different legal bases

The report that Claude is now coming to Microsoft describes, according to our research, not a single date in November 2026 but the provisional end of a development that began in September 2025. For companies, what matters is that there are now several routes to using Claude through Microsoft, and that each has a different legal basis. The main milestones:

• September 2025: Microsoft first adds Claude Sonnet 4 and Opus 4.1 to Researcher and Copilot Studio[18].
• December 2025 and January 2026: According to a consultancy, an admin-centre switch for Anthropic appears; on 7 January 2026, Anthropic models are on by default in many Copilot features for business customers, except in the EU, EFTA and the UK[19].
• 4 and 26 February 2026: Claude and Codex become available as coding agents in GitHub Agent HQ, first as a public preview and then also for Copilot Business and Pro[16][17].
• 25 March and 3 April 2026: For newly created tenants in the EU, EFTA and the UK, Claude in Word, Excel and PowerPoint is on by default; on 3 April a separate admin switch arrives for it[4][3].
• 1 May 2026: The “Anthropic as independent processor” setting is switched off. Without activation as a Microsoft subprocessor, there is no longer access to Anthropic models[4].
• June 2026: Claude in Microsoft Foundry becomes generally available[15].
• 24 July 2026: Claude Opus 5 appears in the model selector of Copilot in Word, Excel, PowerPoint, in chat, in Cowork and in Copilot Studio[14].
• 17 August 2026: Five more features become available for Azure-hosted Claude deployments in Foundry[15].
• 4 November 2026: Microsoft updates the documentation on Claude as a subprocessor and on Copilot in the Microsoft 365 apps[3][4].

The contract model behind this: Anthropic is engaged as a subprocessor of Microsoft. Unless models are labelled “Anthropic models with Data Retention”, the Microsoft Product Terms and the Microsoft Data Protection Addendum (DPA) apply; use also falls under Microsoft’s Enterprise Data Protection. Microsoft’s Customer Copyright Commitment extends to Claude models in covered products[3].

For the EU, the defaults are what matter. In the EU, EFTA and the UK, the global setting “AI providers operating as Microsoft subprocessors” is set to “No users”; administrators with the AI Administrator or Global Administrator role must actively agree. Anyone who agreed earlier under Anthropic’s own terms must agree again. At the same time, Claude models in Copilot, Researcher, Copilot Studio, Power Platform and the Microsoft 365 apps are currently excluded from the EU Data Boundary[3]. For Word, Excel and PowerPoint there is a second switch: for tenants in the EU, EFTA and the UK created after 25 March 2026 it is on by default, and processing takes place outside the EU Data Boundary; for older tenants, Microsoft points to the Message Center. If the global setting is “All users” or “Specific users and groups”, the app switch is no longer available[4].

Advanced models such as Claude Fable 5 and Mythos 5 have a special status. They are off by default in all scenarios as “Anthropic models with Data Retention” and must be enabled separately. Anthropic then acts as an independent processor under its own Commercial Terms and its own DPA, and the data are not covered by the Microsoft customer agreement. Anthropic retains most inputs and outputs for up to 30 days, up to two years where policy violations are suspected and classifier scores for up to seven years; it does not train without explicit permission[3]. Some Fable models, by contrast, are available to eligible organisations as subprocessing without retention[3].

Foundry is a different route with a different legal basis. There, according to the documentation, Anthropic acts as an independent processor for Microsoft, and customers are subject to Anthropic’s data-use terms. With “Hosted on Azure” deployments, prompts and responses stay in Azure; only usage metadata and content flagged by Anthropic’s safety systems go to Anthropic. With “Hosted on Anthropic”, requests run through Anthropic infrastructure[5]. The page names Global Standard and US Data Zone Standard as deployment types; no EU zone is listed there[5].

Exhibit 1: Routes for using Claude through Microsoft (as of 9 November 2026)

What follows for a mid-sized company? Anyone using Microsoft 365 Copilot should, in our assessment, check and document two settings: the global switch for subprocessors and the switch for Word, Excel and PowerPoint. Both lead to processing outside the EU Data Boundary. The record of processing activities and, where applicable, the data protection impact assessment must then be adjusted; a consultancy recommends this as well[19]. Anyone who switches Anthropic off loses features that depend on Claude, according to the same source for example model choice in Researcher and Claude-based agents in Copilot Studio[19]. How we bring Microsoft 365 and AI together is described on the service page on Microsoft 365 integration.

And OpenAI? Its models have run on Azure for longer

Anyone who read that Claude or OpenAI is now coming to Azure is right in both cases: both vendors are available there, just at different times. Azure OpenAI Service has been generally available since 17 January 2023[22]; Claude arrived in Microsoft Foundry only in June 2026[15]. Today there are models from both vendors at Microsoft, but with different legal bases and deployment options.

For models in Foundry, Microsoft describes several deployment types. With “Global”, processing can take place in any Azure region. With “Data Zone”, the service processes prompts and responses only within the selected zone (US, EU or Asia Pacific); the EU zone follows the Azure EU Data Boundary. With “Standard” and “Regional Provisioned”, processing stays in the Azure geography the customer chose. Data at rest stays in the selected geography. Not every model supports every type; availability by model and region should be checked before a decision[20].

Codex can also be connected to Azure: Microsoft describes how to run the Codex CLI and the VS Code extension against an Azure OpenAI deployment in Foundry and names, among others, GPT-6 Sol and GPT-5.3 Codex as deployable models. According to the page, the agent can be run entirely on Azure infrastructure without leaving your own compliance boundary. Sign-in uses an API key in an environment variable; according to the page, Entra ID support is currently not available for Codex[21]. Whether processing stays in the EU depends, as we read it, on the deployment type chosen, because the Codex page does not specify one[20][21].

One difference between the two vendors stands out in Foundry (Avolang assessment, based on the pages we read): for OpenAI models there is a “Data Zone” deployment type with processing inside the EU Data Boundary, provided the model supports it[20]. For Claude in Foundry, Anthropic’s page names only Global Standard and US Data Zone Standard[5]. Anyone who makes EU processing a condition should therefore check it per model and vendor rather than infer it from the name of the platform.

Security: permissions, sandbox and four reports from recent weeks

Claude Code works with permission modes. As the starting mode for interactive terminal and VS Code sessions, the documentation names auto mode: a separate classifier model checks the actions and blocks what it considers unsafe. In manual mode, Claude Code starts with read-only rights and asks before file changes, tests and commands. “Accept Edits” mode approves file changes and a fixed set of file-system commands in the working directory. Commands that load content from the web, such as curl and wget, are not automatically approved by default[2].

One detail matters for IT: the limit to the working directory is a prompt, not a block at operating-system level. An approved Bash command can write anywhere the user account can write. For a real boundary, the documentation names the sandbox for Bash commands with file-system and network isolation (/sandbox) or running in a dev container; central requirements can be enforced through “managed settings”[2].

Codex runs with network access switched off by default. Locally, the workspace-write mode typically limits writes to the current workspace; for folders under version control the default is “Auto” (write in the workspace, approval on request), for folders without version control “read-only”. As approval policies, the page names on-request, never and a granular variant, plus a review agent (auto_review); the untrusted policy is no longer supported. For Codex Cloud (Legacy), the page states that the agent phase runs offline by default and that the cloud environment’s secrets are available only during setup; according to the page, current Codex Cloud handles credentials differently and points to its environment documentation[6].

Both documents address prompt injection, that is, passages of text that slip foreign instructions to an agent, and advise reviewing proposed changes[2][6]. Codex also recommends working on a feature branch, reviewing changes like a pull request and treating web results as untrusted[6].

Four reports from recent weeks show where things go wrong in practice. They differ in reliability, so we rank them accordingly:

• Fake extension (vendor report). On 30 October 2026, Microsoft describes a tampered copy of the “Claude Code” extension (versions 2.1.312 and 2.1.313) in Cursor’s marketplace. It wrote an attacker’s SSH key into the authorized_keys file, set up a reverse SSH tunnel and established persistence. According to Cursor, the package was online for about eleven hours on 29 October 2026. Microsoft confirms it was not published through the Visual Studio Marketplace or npm; Anthropic states that its systems were not compromised and that the package did not come from it. The report does not state the number of victims[10].
• Credentials in published packages (security research). Check Point examined about 46,500 monitored npm packages and found the local configuration file .claude/settings.local.json in 428 of them; 33 files from 30 packages contained credentials, including npm tokens, GitHub access tokens and Telegram bot tokens. The mechanism: anyone who approves a command permanently stores it, with embedded credentials, in this file. The recommendation is to add .claude to .npmignore and the file to .gitignore, check the package contents with a dry run before publishing and treat published credentials as compromised[11].
• Email address in the User-Agent (unconfirmed report). On 5 November 2026, a user reports in the project repository that Claude Code sent their email address in the User-Agent header during web searches, after which they received dozens of scam emails daily. The report shows no captured request; the connection rests on the reporter’s account. A contributor names a default-on protection module that should block this from version 2.1.317; a commenter reports it did not block a Bash curl call in version 2.1.319 (tested against a closed local port, nothing left the machine). The page contains no official confirmation[13]. We do not treat this as proof of data outflow but as a reason to measure the data traffic yourself (Avolang assessment).
• Access by role (press report with anonymous sources). According to Bloomberg, cited by The State of AI on 2 November 2026, most traders and bankers at Goldman Sachs may no longer use Claude Code and GitHub; about 12,000 engineers keep access. The trigger was said to be a review of productivity and risk questions. The information comes from unnamed people, and the bank’s spokesperson does not confirm the specific restriction in the article[12]. The case shows that access can be managed by role; further reasons are not substantiated.

The two reliable cases concern supply chain and configuration hygiene, not the quality of the models (Avolang assessment). Both can be managed with the rules below.

Side by side: eight criteria at a glance

Exhibit 2 compares the two tools. Source references appear in the cells; statements without a reference reflect Avolang’s assessment.

Exhibit 2: Claude Code and Codex in business (as of 9 November 2026)

Codex was compared solely on the basis of OpenAI’s documentation, Claude Code on the basis of Anthropic’s documentation and our own use. OpenAI’s privacy page could not be retrieved on 9 November 2026. Model performance is not part of this sourced comparison; our practical experience is set apart in the section “Experience from practice”.

Claude Code and Codex pricing: list prices and an example for ten developers

Cost has several components: the seat price, usage beyond the included quota, setup, training and the effort for policy and code review. Exhibit 3 shows the vendors’ public list prices in US dollars.

Exhibit 3: List prices per user and month in US dollars (as of 9 November 2026)

The price pages do not state VAT; the amounts are taken as listed. Personal plans (for example Plus, Pro, Max) are not listed because company accounts are intended for company code (Avolang assessment).

Example for ten developers (our own calculation from the list prices, excluding additional usage): Claude Team with Standard seats costs $200 a month with annual billing or $250 with monthly billing, with Premium seats $1,000 and $1,250 respectively. ChatGPT Business with Codex costs $200 and $250 respectively. Claude Enterprise is ruled out at ten users because the price page names a minimum of 20 seats[8][9].

The seat price in the entry plan is the same for both. Limits, and what happens when they are used up, are therefore what matter (Avolang assessment). For Codex, a typical task with GPT-5.6 Sol can use 2 to 15 credits according to the price page; the page we read does not state the price per credit[8]. For Claude, whether limits are reached depends on model, conversation length and file size[9]. Not included in the calculation are training, policy, code review and security measures; in practice they are the larger item (Avolang assessment).

Experience from practice: why we use both

Avolang uses Claude and OpenAI’s models side by side. The points below are our day-to-day experience (Avolang assessment, as of 9 November 2026). They are neither measured nor checked against a benchmark, they refer to the model versions named, and they may change with the next version. They do not replace the pilot from the 30-day plan when deciding in your own company.

Exhibit 4: Avolang’s day-to-day experience with Claude and OpenAI (subjective, not measured, as of 9 November 2026)

All statements in Exhibit 4 are Avolang’s assessments from daily work and are not backed by benchmarks or measurements. Source references appear only where they relate to documented limits.

What follows for a company? Using two vendors side by side is feasible but doubles the administrative effort: two contracts, two data-protection reviews, two configurations and two quotas (Avolang assessment). The rules in this article then apply to both tools. Anyone who wants to settle on one vendor is better off going by the main purpose than by a league table: programming and a finely configurable working environment speak, in our experience, for Claude; computer use and image generation for OpenAI. Both may shift with the next model version.

Seven rules for use in business

1. Use company accounts onlyPersonal plans follow different rules on training and retention[1]. Work belongs in accounts the company manages.
2. Set data classes and secretsWhich code and which data may enter the agent? Credentials and customer data do not belong in project folders, test data or configuration files. Local settings files such as .claude/settings.local.json stay out of repositories and packages[11].
3. Define and measure the data flowSwitch off telemetry, feedback commands and non-essential traffic centrally where the policy requires it[1]; with Codex, send telemetry only to your own collectors[6]. Capture the actual network traffic once during the pilot instead of relying on documentation alone (Avolang assessment).
4. Keep rights narrowKeep sandbox and network tight by default, grant approvals by role and enforce requirements centrally through managed settings or requirements.toml[2][7]. Not every role needs every agent.
5. Control sourcesInstall extensions, plugins and MCP servers only from approved publishers and roll out new versions with a delay. This matches the recommendations from the Cursor case[10].
6. Check and document the Microsoft switchesSet both settings in the admin centre, define the user group and adjust the record of processing activities and the data protection impact assessment[3][4][19].
7. Responsibility for the code stays with peopleBoth vendors make clear that review before approval is the users’ responsibility[2][6]. Mandatory review, feature branches and rollback belong in the development policy.

Reaching a decision in 30 days

Anyone who wants to introduce Claude Code, Codex or both should proceed step by step. A pilot on your own tasks gives a more reliable basis for a decision than any league table.

Frequently asked questions about Claude Code, Codex and Claude in Microsoft

Conclusion

For companies, Claude Code and Codex are not an either-or question of model quality but a question of accounts, data flow and permissions. For Claude Code, there are dependable statements on training, retention and telemetry; for Codex, the documentation describes sandbox, approvals and administration well but leaves training and default retention open, and the vendor’s privacy page could not be checked. That Claude can now be reached through Microsoft eases access but creates several legal bases: in the EU, the switch for Copilot is off by default, while the one for Word, Excel and PowerPoint is on for newer tenants, and both sit outside the EU Data Boundary. OpenAI models also run on Azure, there with an EU data zone as a deployment type; we use both vendors ourselves and consider that practical as long as the same rules apply to both. For many mid-sized companies, the route leads, in our assessment, through company accounts, a policy on data classes, a measured pilot and documented Microsoft settings. After 30 days, that gives you a decision based on your own results rather than on a product preference.