A user pastes their Social Security Number into a Claude chat when asking for tax help. What should a RESPONSIBLE application developer configure?
Select an answer to reveal the explanation.
Short Explanation
You need to catch and redact PII like SSNs before it reaches the API, and you shouldn't log that sensitive data. Don't hand off your privacy duty to Anthropic.
Full Explanation
Responsible application development requires handling PII appropriately: implement PII detection to redact or tokenize sensitive data before sending it to the API, avoid logging raw conversations that may contain sensitive information, implement appropriate retention and deletion policies, and comply with relevant regulations such as GDPR, CCPA, and HIPAA where applicable. The correct configuration is to implement PII detection and redaction before sending user input to the API, and avoid logging sensitive data. Storing the SSN in conversation logs for customer service purposes violates basic data privacy principles. Allowing Claude to store the SSN in its memory for future reference is wrong because Claude has no persistent memory by default and shouldn't be asked to store PII. Saying no special handling is needed because Anthropic stores all user data securely is wrong because, while Anthropic has data handling practices, the operator is still responsible for their application's data handling.