Claude Code Trust: Swiss AI Supplier Controls 2026

Reuters reported on 3 July that Alibaba had reportedly instructed staff to stop using Claude Code, citing alleged hidden code and geolocation risk. The report warrants attention as a supplier-assurance trigger. It does not establish that Claude Code contains a malicious backdoor. No public policy, reproducible forensic evidence, code hash or independent technical report substantiates that allegation. For Swiss organisations, the useful response is neither dismissal nor repetition of a claim as fact. It is an evidence-led review of what the tool sends, stores and permits, followed by controls proportionate to the code and data a developer can expose.

Separate an allegation from the observable product

Security governance is weakened when a reported concern is promoted directly into a technical conclusion. A supplier review should retain the provenance of each assertion: the Reuters report is a report of a claimed internal instruction, while a package signature, a network capture in a controlled environment, a supplier attestation and an independent assessment are different classes of evidence. The absence of public forensic material does not prove a product is risk-free. It does mean that a finding should be recorded as unverified, rather than stated as a confirmed backdoor or as confirmed hidden location collection.

What can be assessed is the vendor's published operating model. Anthropic lists Switzerland among its supported countries, while China is not listed, and describes ownership and region enforcement in its supported-country information at https://www.anthropic.com/supported-countries. Its privacy policy says that it collects IP address and IP-derived location information: https://www.anthropic.com/legal/privacy. These disclosures are not evidence of covert behaviour; they are inputs to a clear data-flow assessment. They also show why regional eligibility and access controls are not the same question as the location of every processing operation.

Map the developer workflow, not just the model API

Claude Code documentation states that prompts and model interactions travel over TLS. Under the standard commercial model, retention is 30 days; qualifying Enterprise customers may use zero data retention. The product documentation also describes local plaintext transcripts under ~/.claude/projects/, retained by default for 30 days. Commercial Team, Enterprise and API content is not used for training unless the customer opts in, but feedback sharing can send content. These details are documented in Anthropic's data-usage and security material: https://code.claude.com/docs/en/data-usage and https://code.claude.com/docs/en/security.

The operational implication is that a procurement questionnaire asking only whether prompts are encrypted is inadequate. A terminal agent can see source code, shell output, environment variables, repository documentation and generated files. Local transcript retention affects endpoint protection and offboarding. Cloud retention affects vendor assurance and contractual terms. A feedback gesture can create a separate disclosure path. A configuration review must establish which plan is used, which organisation settings apply, which directories are allowed, who can alter policy and how those controls are monitored on managed devices.

Regional controls do not eliminate transfer analysis

For Swiss enterprises with EU operations, data protection and procurement teams should identify the roles, processing locations, subprocessors, transfer mechanisms and data categories before allowing code assistants into sensitive repositories. The EDPB's guidance on international transfers is a useful framing reference at https://www.edpb.europa.eu/sme-data-protection-guide/international-data-transfers_en. It does not answer the supplier-specific question, but it helps prevent "TLS" or "supported region" from being treated as a complete transfer assessment.

AI governance belongs in this review too. The European Commission's AI Act framework is available at https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. A code assistant will not automatically create a single, uniform compliance classification across all uses. Yet teams should document purpose, human review, access boundaries and downstream use, particularly where generated code reaches regulated customer services or security controls. The useful control is a repeatable intake process, not a blanket statement that a supplier is trusted or prohibited.

Control prompt injection at the developer boundary

Directory permissions, sandboxing and prompt controls can reduce what an agent may read or execute. They cannot make prompt injection disappear. A hostile issue, copied log, repository file or third-party dependency can contain instructions designed to influence an agent. Treat untrusted content as data, restrict write and command execution permissions, require review for changes, and avoid exposing secrets merely because a task appears routine. This is particularly important in repositories that contain deployment definitions, customer configuration or incident material.

• Classify Claude Code use cases before enablement. Separate public-code experimentation from managed work on confidential, regulated or production repositories.
• Verify the purchased plan and retention setting. Record whether standard 30-day retention or qualifying Enterprise zero data retention applies, and retain supplier evidence.
• Manage local transcripts as sensitive endpoint data. Protect, retain and remove ~/.claude/projects/ content through device management and offboarding controls.
• Constrain directory, prompt and sandbox permissions. Use the narrowest practical repository scope, block routine secret access and require confirmation before consequential commands.
• Disable or govern feedback sharing. Make the content-disclosure path explicit so developers do not submit proprietary material unintentionally.
• Test network and package behaviour in a controlled environment. Capture the documented flows, validate signatures and log deviations without presenting a test result as proof beyond its scope.
• Maintain a prompt-injection playbook. Train developers to recognise hostile instructions in issues, code and documentation, and require human review of generated changes.

Supplier confidence should improve as evidence improves. If a future policy, independent report or reproducible artefact changes the facts, the risk assessment should change with it. Until then, Swiss teams can gain the productivity benefits of coding agents without accepting vague assurance: make data paths visible, keep authority bounded and preserve the evidence that supports each approval decision.