> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/saas/ai/claude.md). # Claude Connect the Claude connector to screen prompts for sensitive data in real time and to scan chat history and files through Anthropic's Compliance API. Both capabilities configure from the same enrollment and can be used together or independently. | Capability | What it does | Jump to | | -------------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | Real-Time Prompt Screening | Screens every prompt before it reaches the model; blocks or allows based on your data elements | [Real-Time Prompt Screening](#real-time-prompt-screening-inference-hooks) | | Compliance API Scanning | Reads back chat history, attached files, and AI-generated files for DLP classification | [Scanning Chat History and Files](#scanning-chat-history-and-files-compliance-api) | *** ## Real-Time Prompt Screening (Inference Hooks) Connect Teleskope to Claude's inference hook pipeline to screen prompts for sensitive data before they reach the model. When a prompt contains a blocked data element, the hook returns a deny verdict and the user sees a configurable message — keeping sensitive data out of the model. *** ### Prerequisites The following prerequisites apply to real-time prompt screening via the inference hook. For Compliance API scanning prerequisites, see [Scanning Chat History and Files](#scanning-chat-history-and-files-compliance-api). Before enabling the integration, make sure you have: * **Claude Enterprise plan** — inference hooks are available only on Claude Enterprise. Confirm your Anthropic organization has the feature enabled. * **claude.ai Owner or Admin role** — the person configuring claude.ai needs the Owner, Primary owner or Admin role. Members with the User role cannot open the Inference hooks settings. * **Teleskope admin access** — configuration must be performed by a Teleskope workspace admin. * **Data elements configured** — select at least one blocking data element in the Block rule tab to deny prompts. With none selected, Teleskope only observes. *** ### How It Works When a user submits a prompt in Claude, the inference hook fires synchronously before the prompt reaches the model: 1. Claude sends the prompt to the Teleskope webhook endpoint. 2. Teleskope classifies the prompt against your configured blocking data elements. 3. If a blocked element is detected, Teleskope returns a Deny verdict and the user sees the configured deny message. Otherwise, the prompt is allowed through. 4. The verdict is returned to Claude within the configured timeout window (default 5,000 ms, configurable between 1 and 10,000 ms in both Teleskope and claude.ai). Attachments included in the prompt are also scanned. Image attachments are not supported at this time. *** ### Enrollment Steps The following steps set up real-time prompt screening. To enable Compliance API scanning of chat history, complete [Step 7](#id-7.-add-a-compliance-access-key-optional) and see [Scanning Chat History and Files](#scanning-chat-history-and-files-compliance-api). #### 1. Enroll in Teleskope In the Teleskope dashboard, go to **Settings** → **Connectors** → **Claude**. Enter your Anthropic **Organization name** and click **Enroll**. Copy the **Webhook URL** shown after enrollment. #### 2. Allow Inference Hooks in claude.ai Open the Inference hooks settings at [claude.ai/admin-settings/inference-hooks](https://claude.ai/admin-settings/inference-hooks). The page may not be linked from **Organization settings**, so use the direct link. If prompted, turn on **Allow for your organization**. #### 3. Add the Endpoint and Signing Secret 1. In claude.ai, click **Configure**, paste the Webhook URL from step 1 and click **Next**. 2. claude.ai shows the signing secret once. Copy it before closing the dialog. 3. In Teleskope, open the **Claude** connector, click **Add signing secret** and paste the `whsec_…` secret. 4. Back in claude.ai, click **Test connection**. It should report an allow verdict. Save the secret in Teleskope before turning on **Enforce verdicts**. Until then, every request fails signature verification with a 401 and falls back to your failure handling mode. #### 4. Configure Failure Handling and Timeout In claude.ai, set **Failure handling → Mode**: * **Shadow mode** — Teleskope receives and records prompts, but nothing is blocked. Recommended while you validate the integration. * **Block the request** or **Allow the request** — verdicts are enforced. This choice also decides what happens when Teleskope cannot return a verdict in time; see [Behavior on Timeout or Error](#behavior-on-timeout-or-error). Set the timeout in claude.ai and ensure the **Prompt verdict timeout (ms)** in Teleskope matches (default 5,000 ms). #### 5. Select Blocking Data Elements In Teleskope, open the **Block rule** tab. Choose the data elements that should trigger a deny verdict — any element in your catalog can be selected (for example: SSN, credit card number, bank account, driver's license, insurance ID). Optionally set a custom deny message using `{elements}` as a placeholder for the detected element names (max 500 characters). An empty list enables observe-only mode. #### 6. Turn On Enforce Verdicts In claude.ai, turn on **Enforce verdicts**. While it is off, claude.ai does not send any prompts to Teleskope. The change takes about a minute to apply. In **Shadow mode**, prompts are recorded but none are blocked. When you are ready to block, set **Mode** to **Block the request** or **Allow the request**. Prompts containing blocked elements are then denied. #### 7. Add a Compliance Access Key (Optional) To scan historical claude.ai chats, create an API key in claude.ai under **Organization settings** → **API** → **Keys** with the `read:compliance_user_data` scope. In Teleskope, open the **Claude** connector and click **Add compliance access key**. Real-time prompt screening does not need this key. *** ### Behavior on Timeout or Error If Teleskope does not return a verdict before the timeout, or if the endpoint returns an error, the request follows the **Failure handling** mode set in claude.ai: * **Block the request** — the prompt is denied. Use this if data protection is the priority. * **Allow the request** — the prompt is forwarded to Claude. Use this if availability is the priority. The timeout must match between claude.ai and the **Prompt verdict timeout (ms)** setting in Teleskope. *** ## Scanning Chat History and Files (Compliance API) Teleskope reads back chat history, attached files, and AI-generated files from Anthropic's Compliance API and classifies them for DLP. Scanning runs automatically and continuously — new and updated chats are picked up on each crawl cycle without manual intervention. ### Prerequisites To enable Compliance API scanning, you need: * **Claude Enterprise plan** — the Compliance API is available only on Claude Enterprise. * **claude.ai Primary Owner** — only the Primary Owner can enable the Compliance API in claude.ai. The API key must be created by the Primary Owner or an Owner; Admins do not have access to the page. * **Teleskope admin access** — configuration must be performed by a Teleskope workspace admin. * **Compliance Access Key** — an API key with the `read:compliance_user_data` scope, added in [Step 7](#id-7.-add-a-compliance-access-key-optional). Real-time prompt screening does not require this key. ### How It Works 1. On each crawl cycle, Teleskope calls the Anthropic Compliance API to discover new and updated chats. Only chats changed since the previous run are fetched — the crawl is incremental. 2. Each newly discovered or updated chat is queued for scanning. Teleskope fetches the full message history and any attached files. 3. Messages and files are classified against your configured data elements. 4. Classified prompts appear in Teleskope under **Data Catalog** → **Claude** → **Prompts**. Messages created within the last two minutes of a scan run are deferred to the next cycle to avoid a race with the inference hook, which may still be writing rows for in-flight prompts. ### Setup Add a Compliance Access Key by completing [Step 7](#id-7.-add-a-compliance-access-key-optional). Scanning starts automatically once the key is saved — no further configuration is required. Both capabilities configure from the same Claude connector enrollment. The key is optional: the inference hook works without it, and Compliance API scanning works whether or not the inference hook is active. ### What Gets Scanned * **Chat messages** — prompts and responses in claude.ai conversations. * **User-uploaded files** — files attached to a chat by the user. Supported formats include plain text, code files, Microsoft Office documents, and PDFs. Image files are processed using OCR. * **AI-generated files** — files created by Claude during a conversation, such as generated code or documents. Files that cannot be read — for example, unsupported binary formats or empty files — are skipped without blocking the rest of the chat from being scanned. Projects are not yet surfaced as a distinct resource type in Teleskope. Project attachments are not currently supported. ### What You See in Teleskope Scanned prompts appear under **Data Catalog** → **Claude** → **Prompts**. **Columns:** | Column | Description | | ------------- | ------------------------------------------------------------- | | Prompt | Link to the prompt detail page | | Received | When Teleskope recorded the prompt | | Held | Whether the prompt was blocked by the inference hook | | Source | `Compliance API` (historical scan) or `Hook` (inference hook) | | Sensitivity | Highest classification severity | | Data Elements | Detected data elements | | Data Subject | Identified data subject | | User | The claude.ai user who sent the prompt | | App | The application — claude.ai, Claude Code, Cowork, or other | **Filters:** Held, Source, Sensitivity, Data category and elements, Data subject, User, App. The **prompt detail page** shows: User, App, Model, Received, Held, Attachments (file name and type), Scanned bytes, and a Conversation link to open the chat in claude.ai. **Message preview** is available for prompts scanned through the Compliance API. Click any prompt to read the original message text. When a prompt matches a policy, a finding is created. The finding side panel shows: User, App, Model, Source, Held, Received. ### Limits * **Anthropic rate limit** — Teleskope retries automatically on rate-limit responses. * **File size** — files over the configured size limit are skipped and do not affect the rest of the chat scan. * **Unreadable files** — files that cannot be read as text are skipped and do not affect the rest of the chat scan. * **Settle margin** — messages created within the last two minutes of a scan run are deferred to the next cycle. ### Troubleshooting | Symptom | Likely cause | Action | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ---------------------------------------------------------------------- | | Preview shows "The Claude Compliance API rejected Teleskope's credentials" | Invalid or expired compliance key | Replace the compliance key under **Claude** connector settings | | Preview shows "The Compliance API no longer has this chat or message" | Chat or message deleted in claude.ai | No action needed — deleted content is permanently skipped | | Preview shows "The Claude Compliance API is rate-limiting requests" | API rate limit hit | Wait a moment and open the preview again | | Preview unavailable: "This prompt was recorded by the inference hook. Message preview is only available for prompts Teleskope read back from the Claude Compliance API" | Prompt sourced from the inference hook, not a historical scan | Preview is not yet available for inference hook prompts | | Preview shows "Teleskope has not linked this conversation to a Compliance API chat yet" | Chat sync not yet complete, or compliance key missing | Wait for the next crawl cycle; verify the compliance key is configured |