Setting a team policy for AI memory

Somebody on your team pasted a client contract into an assistant in March to get a plain-English summary of the termination clause. In September, in a different conversation, on a different laptop, the assistant mentions that client by name without being asked. Nothing broke. Nobody leaked anything. The tool did what it was configured to do, and the configuration was a default that no one in your business chose on purpose.

That is the whole of the memory problem. Chat history is a transcript you can search, export and delete. Memory is a summary layer the model writes about you and carries into future sessions, so the question stops being what you sent and becomes what the vendor now holds about your business, for how long, and which of your teammates it surfaces to. This guide is for a two-to-twenty person business with no compliance department, deciding whether to turn memory on and what to write down about it. It is not for anyone running a regulated deployment with counsel already reviewing data processing agreements. In that case they own this decision and you follow them.

Memory is a second copy of your business, written by the model

Claude’s memory rolled out to Team and Enterprise plans on 11 September 2025, and to Pro and Max on 23 October 2025 [1]. Anthropic describes it as “fully optional, with granular user controls”, and you enable it in Settings [1]. If you use projects, Claude keeps a separate memory for each one, so that “your product launch planning stays separate from client work” [1]. Enterprise admins “can choose whether to disable memory for their organization at any time” [1].

ChatGPT’s memory is broader in what it draws from. OpenAI says that when enabled, memory “helps ChatGPT automatically remember useful context from your chats, files, and connected apps” [4]. That includes material you uploaded once and forgot about. Improved memory “is disabled by default” in ChatGPT for Healthcare and ChatGPT Enterprise with Regulated Workspace [4]. Deleting the chat is not enough on its own. To remove something ChatGPT knows about you, OpenAI says you have to delete “every source where it appears, including past chats, archived chats, files, the memory summary, and disconnect any connected apps” [4].

Gemini’s equivalent hangs off Gemini Apps Activity, and Google states the default plainly: “If you’re 18 or over, Keep Activity is on by default” [7]. From there, “by default, your Gemini Apps activity older than 18 months is auto-deleted”, and you can turn auto-delete off or change the period to 3 or 36 months [7]. Google’s own notice is blunter than anything a policy document of yours is likely to say: “Please don’t enter confidential information that you wouldn’t want a reviewer to see or Google to use to improve our services” [6].

The practical consequence is that three people on your team can be using three assistants under three different memory models, and none of them has read any of this. Your policy starts by writing down which of those three paragraphs applies to whom.

Retention is a switch somebody already flipped

The numbers are public and they are not close to each other.

On Claude’s consumer plans, deleted conversations are “removed from your chat history immediately” and deleted from back-end storage within 30 days [3]. If you allow your data to be used for model improvement, Anthropic may “retain your data in a de-identified format for up to 5 years in our model training pipelines” [3]. Content flagged for a usage policy violation is held longer: inputs and outputs for up to 2 years, and trust and safety classification scores for up to 7 years [3].

On Gemini, a subset of chats “are reviewed by human reviewers (including Google’s trained service providers)”, and reviewed chats “are retained for up to three years” [6]. Turning Keep Activity off does not make chats vanish on send either: “Even when Keep Activity is off, your conversations will be saved with your account for up to 72 hours to allow Google to provide the service and process any feedback” [7].

On the business side, OpenAI states plainly that “We do not train our models on your data by default” [5]. Workspace admins “can control how long your data is retained” on Enterprise, Healthcare and Edu, deleted conversations are “removed from our systems within 30 days” unless legally required otherwise, API inputs and outputs are held for up to 30 days, and you can “request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case” [5].

Read those three paragraphs again and notice what actually varies. It is not the model. It is the plan.

The account people use decides more than the settings they choose

The single highest-leverage line in a small team’s AI policy is not about memory settings at all. It is about which account gets used for client work.

Anthropic’s consumer training rules apply to “Claude Free, Pro, Max and when accounts from those plans use Claude Code” [2]. Training there happens when you choose to allow it, when a conversation is flagged for safety review, or when you explicitly opt in to something like the Trusted Tester Program [2]. Commercial products sit outside those rules: Anthropic points customers of “Claude for Work and the Anthropic API” to a separate policy [2]. OpenAI’s business products carry the no-training-by-default commitment, a completed SOC 2 Type 2 audit, AES-256 encryption at rest and TLS 1.2+ in transit, plus a data processing addendum for GDPR and a business associate agreement for HIPAA [5].

So the person who signs into their personal Pro account because the company seat is on a different browser profile has moved that conversation into a different retention regime, a different training regime and a memory profile you have no admin control over. No settings page fixes that. A one-line rule does: client material goes into the company account, or it does not go in.

This also means paying for seats buys you something concrete. It is not just a bigger usage limit. It is the ability to disable memory across the organisation [1], to control retention centrally [5], and to scope improved memory to particular roles, which OpenAI exposes to workspace owners and admins [4].

Three decisions make a memory policy

A memory policy that people follow is three sentences, not a document.

The first decision is who has memory on. Default it off for anyone whose daily work involves client files, personal data, contracts, salary information or unreleased plans. Default it on for the roles where the value is obvious and the material is internal, such as ops, internal writing and code the model already sees every day. On Claude this is a per-organisation switch an admin holds [1]. On ChatGPT, owners and admins can make improved memory “available to the default workspace role or eligible custom roles” [4].

The second decision is what never goes into a memory-on session, stated as categories rather than examples. Named clients. Anything under NDA. Anything with a person’s health, finances or performance in it. This is the part your team will actually remember, because it is a short list of nouns rather than a paragraph about data governance.

The third decision is where the sensitive work happens instead, and it has to be a real place. Claude’s incognito chats “don’t appear in your conversation history or save to memory” [1], and are “not used to improve Claude, even if you have enabled Model Improvement in your Privacy Settings” [2]. ChatGPT’s Temporary Chats “do not use existing memories or create new memories” [4]. Gemini’s equivalent is Keep Activity off, with the 72-hour floor above [7]. Claude’s project-scoped memory is the middle setting: memory on, but walled per client [1].

New features arrive attached to the memory switch

The reason to settle this before you need it is that vendors keep shipping things people want that only work with memory on.

Reflect, announced by Anthropic on 9 July 2026, is the clean example. It lets you “track and visualize how you use Claude, and decide whether that time aligns with your goals”, and it is “currently available in beta for Free, Pro, and Max users who have memory turned on” [8]. The privacy boundaries are drawn carefully. Reflection “doesn’t draw from incognito chats”, the underlying files behind connected tools stay out, and “any conversation connected to a health integration tool is left out of your insights entirely” [8]. Anthropic’s own example is that if you asked Claude to summarise your inbox, “that summary may come up in your reflection, but the source emails would not” [8].

None of that is the trap. The trap is the sequence. A team with memory deliberately off sees a feature it wants, flips memory on for the feature, and inherits the whole memory posture as a side effect. The durable lesson has nothing to do with Reflect specifically: when a desirable feature is gated on a data setting, you are being asked to re-make the data decision, and it deserves the same two minutes the original one got.

Write the trigger into the policy. When a vendor ships something that requires memory, the person who wants it says which of the three decisions above changes, and who reviews it.

Offboarding is where the policy gets tested

Memory is portable in ways that cut both directions. Anthropic lets you bring “your memory details over from a different AI tool”, and lets you “export your memory from Claude for backup or migration” [1]. That is useful when someone changes tools and awkward when someone changes employers.

Deletion has a floor. Deleted conversations leave Claude’s back-end within 30 days [3], OpenAI removes deleted conversations within 30 days unless legally required to keep them [5], and Gemini’s default is an 18-month auto-delete you can shorten to 3 months [7]. None of that is instant, and none of it reaches a model that has already been trained. Anthropic is direct about the limit: a deleted chat “will not be used to train future models”, but your data “will still be included in model training runs that are already in progress, or in models that have been trained” [3].

Practically, offboarding needs three lines: disable the seat, delete or export the memory profile deliberately rather than assuming seat removal did it, and note the retention window so you know the date after which the residue is gone.

What still goes wrong

The settings are legible; the summaries are not. Claude lets you “see exactly what Claude remembers from your conversations, and update the summary at any time” [1], but you cannot see the reasoning that produced it, and a memory can be an accurate inference from material you would never have written down. A model that has watched six months of your work knowing that a particular client is a payment risk is not a leak by any vendor’s definition. It is still a sentence you would rather not have surfaced during a screen share.

The second gap is that a policy governs one surface and the data moves across several. Anthropic excludes connector data such as Google Drive from consumer training, “though data may be included if it’s directly copied into your conversation with Claude” [2], and Reflect leaves the source files behind connected tools out [8]. Both carve-outs are real and both stop at the paste. The moment a teammate copies a row out of the connected spreadsheet into the chat, it is conversation content under whatever regime that account sits in. Most memory problems in a small team are ordinary copy-and-paste, not a failure of any vendor control.

The third is timing. Retention floors mean the fastest available correction after a bad paste is measured in days, not seconds. Deleting the chat is still worth doing immediately, because it removes the conversation from history at once and stops future training use [3], but the honest expectation is 30 days for the back-end copy [3][5], longer if the content was flagged [3]. Nothing you set today shortens the window on something already sent, which is the argument for making the memory decision before it is needed rather than after.