U.S. K-12 Terms of Service

Terms of service

Welcome to Anthropic! Before accessing our Services, please read these U.S. K-12 Terms of Service.

These U.S. K-12 Terms of Service (“Terms”) are an agreement between Anthropic and you or the educational organization, school, school district, or other similar educational entity (“School”) that you represent or that employs you as a teacher (“Customer”). “Anthropic” means Anthropic, PBC. They govern Customer’s use of Anthropic API keys and any other Anthropic offerings that references these Terms, as well as all related Anthropic tools, documentation and services (the “Services”). These Terms are effective on the earlier of the date that Customer first electronically consents to a version of these Terms and the date that Customer first accesses the Services (“Effective Date”).

Please note: You may not enter into these Terms on behalf of a School unless you have the legal authority to bind the School or have received all authorization necessary from the School to accept these Terms and to use these Services. If you are a teacher and your School has a separate written agreement with Anthropic, our agreement with your School will govern our relationship with you. Services under these Terms are not for consumer use. Our consumer offerings (e.g., Claude.ai) are governed by our Consumer Terms of Service instead.

A. Services

A.1. Overview.

Subject to these Terms, Anthropic gives Customer permission to use the Services or if Customer is a School, make available to its own employees (“Users”). Use of the Services under these Terms is permitted only by Customers for educational purposes, and Anthropic retains the right to terminate your access to the Services at any time at its sole discretion if we believe there is misuse.

A.2. Third Party Features.

Customer may elect (in its sole discretion) to use features, services or other content made available by third parties to Customer through the Services (“Third Party Features”). Customer acknowledges and agrees that Third Party Features are not Services and, accordingly, Anthropic is not responsible for them.

A.3. Feedback.

If Customer provides (in its sole discretion) Anthropic with feedback regarding the Services, Anthropic may use that feedback at its own risk and without obligation to Customer.

B. Customer Content

As between the parties and to the extent permitted by applicable law, Anthropic agrees that Customer (a) retains all rights to its Inputs, and (b) owns its Outputs. Anthropic disclaims any rights it receives to the Customer Content under these Terms. Subject to Customer’s compliance with these Terms, Anthropic hereby assigns to Customer its right, title and interest (if any) in and to Outputs. Anthropic may not train models on Customer Content from Services. “Inputs” means submissions to the Services by Customer or its Users and “Outputs” means responses generated by the Services to Inputs (Inputs and Outputs together are “Customer Content”).

C. Data Privacy and Processing of Customer Data

C.1. Data Processing Addendum.

Data submitted through the Services will be processed in accordance with the Anthropic U.S. K-12 Data Processing Addendum (“DPA”), which is incorporated into these Terms by reference.

C.2. Family Educational Rights and Privacy Act.

Where Customer is subject to the Family Educational Rights and Privacy Act (“FERPA”), Customer acknowledges Anthropic provisions the Services with a legitimate educational interest in Student Data (as defined in the DPA), and that Anthropic will act as a School Official. Customer represents and warrants that it has authority under applicable laws, including FERPA, to designate Anthropic as a School Official and will not use the Services to process Student Data absent such authority. Where subject to FERPA, Customer acknowledges that Student Data is under the School’s control.

D. Trust and Safety; Restrictions

D.1. Compliance.

Each party will comply with all laws applicable to the provision (for Anthropic) and use (for Customer) of the Services, including any applicable data privacy laws.

D.2. Policies and Service Terms.

Customer and its Users may only use the Services in compliance with these Terms, including (a) the Usage Policy (“Usage Policy”, which was previously referred to as the Acceptable Use Policy), (b) our policy on the countries and regions Anthropic currently supports (“Supported Regions Policy”) and (c) our Service Specific Terms, each of which is incorporated by reference into these Terms. Customer must cooperate with reasonable requests for information from Anthropic to support compliance with its Usage Policy, including to verify Customer’s identity and use of the Services.

D.3. Limitations of Outputs; Notice to Users.

It is Customer’s responsibility to evaluate whether Outputs are appropriate for Customer’s use case, including where human review is appropriate, before using or sharing Outputs. Customer acknowledges, and must notify its Users, that factual assertions in Outputs should not be relied upon without independently checking their accuracy, as they may be false, incomplete, misleading or not reflective of recent events or information. Customer further acknowledges that Outputs may contain content inconsistent with Anthropic’s views.

D.4. Use Restrictions.

Customer may not and must not attempt to (a) access the Services to build a competing product or service, including to train competing AI models or resell the Services except as expressly approved by Anthropic; (b) reverse engineer or duplicate the Services; or (c) support any third party’s attempt at any of the conduct restricted in this sentence.

D.5. Service Account.

Customer is responsible for all activity under its account. Customer will promptly notify Anthropic if Customer believes the account it uses to access the Services has been compromised, or is subject to a denial of service or similar malicious attack that may negatively impact the Services.

E. Confidentiality

E.1. Confidential Information.

The parties may share information that is identified as confidential, proprietary, or similar, or that a party would reasonably understand to be confidential or proprietary ("Confidential Information"). Customer Content is Customer’s Confidential Information.

E.2. Obligations of Parties.

The receiving party ("Recipient") may only use Confidential Information of the disclosing party ("Discloser") to exercise its rights and perform its obligations under these Terms. Recipient may only share Discloser’s Confidential Information to Recipient’s employees, agents, and advisors that have a need to know such Confidential Information and who are bound to obligations of confidentiality at least as protective as those provided in these Terms ("Representatives"). Recipient will protect Discloser’s Confidential Information from unauthorized use, access, or disclosure in the same manner as Recipient protects its own Confidential Information, and with no less than reasonable care. Recipient is responsible for all acts and omissions of its Representatives.

E.3. Exclusions.

Confidential Information excludes information that: (a) becomes publicly available through no fault of Recipient; (b) is obtained by Recipient from a third party without a breach of the third party’s obligations of confidentiality; or (c) is independently developed by Recipient without use of Confidential Information. Recipient may disclose Discloser’s Confidential Information to the extent it is required by law, or court or administrative order, and will, except where expressly prohibited, notify Discloser of the required disclosure promptly and fully cooperate with Discloser’s efforts to prevent or narrow the scope of disclosure.

E.4. Destruction Request.

Recipient will destroy Discloser’s Confidential Information promptly upon request, except where retained to comply with law or copies in Recipient’s automated back-up systems, which will remain subject to these obligations of confidentiality while maintained.

F. Intellectual Property

Except as expressly stated in these Terms, these Terms do not grant either party any rights to the other’s content or intellectual property, by implication or otherwise.

G. Publicity

Anthropic may use Customer’s name and logo to publicly identify Customer as a customer of the Services; provided that Customer may opt-out via this request form. Customer will consider in good faith any request by Anthropic to (1) provide a quote from a Customer executive regarding Customer’s motivation for using the Services that Anthropic may use publicly and (2) participate in a public co-marketing activity.

H. Fees

H.1. Payment of Fees.

Customer is responsible for fees incurred by its account, at the rates specified on the Model Pricing Page, unless otherwise agreed by the parties. Anthropic may require prepayment for the Services in the form of credits or offer other types of credits, all of which are subject to Anthropic’s Supplemental Credits Terms. Anthropic may update the published rates, to be effective the earlier of 30 days after the updates are posted by Anthropic or Customer otherwise receives Notice.

H.2. Taxes.

Fees do not include any taxes, duties, or assessments that may be owed by Customer for use of the Services ("Taxes"), unless otherwise specified in the applicable invoice. Customer is responsible for remitting any necessary withholding Taxes to the relevant authority on a timely basis and providing Anthropic with evidence of the same upon request. Where law provides for the reduction or elimination of withholding taxes, including via tax treaty, the parties will collaborate in good faith to do so. For clarity, Customer must pay Anthropic the amount ("Gross-up Payment") that will ensure that Anthropic receives the same total amount that it would have received if no such withholding or reduction by Customer had been required (taking into account any and all applicable Taxes (including any Taxes imposed on the Gross-up Payment)).

H.3. Billing.

Failure to pay Anthropic all amounts owed when due may result in suspension or termination of Customer’s access to the Services. Anthropic reserves any other rights of collection it may have.

I. Termination and Suspension

I.1. Term.

These Terms start on the Effective Date and continue until terminated (the “Term”).

I.2. Termination.

I.2.a. Each party may terminate these Terms at any time for convenience with Notice, except Anthropic must provide 30 days prior Notice.

I.2.b. Either party may terminate these Terms for the other party’s material breach by providing 30 days prior Notice detailing the nature of the breach unless cured within that time.

I.2.c. Anthropic may terminate these Terms immediately with Notice if Anthropic reasonably believes or determines that Anthropic’s provision of the Services to Customer is prohibited by applicable law.

I.3. Suspension.

I.3.a. Anthropic may suspend Customer’s access to any portion or all of the Services if: (a) Anthropic reasonably believes or determines that (i) there is a risk to or attack on any of the Services; (ii) Customer or any User is using the Services in violation of Sections D.1 (Compliance), D.2 (Policies and Service Terms) or D.4 (Use Restrictions); or (iii) Anthropic’s provision of the Services to Customer is prohibited by applicable law or would result in a material increase in the cost of providing the Services; or (b) any vendor suspends or terminates Anthropic’s use of any third-party services or products required to enable Customer to access the Services (each, a “Service Suspension”).

I.3.b. Anthropic will use reasonable efforts to provide written notice of any Service Suspension to Customer, and resume providing access to the Services, as soon as reasonably possible after the event giving rise to the Service Suspension is cured, where curable. Anthropic will have no liability for any damage, liabilities, losses (including any loss of data or profits), or any other consequences that Customer may incur because of a Service Suspension.

I.4. Effect of Termination.

Upon termination, Customer may no longer access the Services. The following provisions will survive termination or expiration of these Terms: (a) Sections E (Confidentiality), G (Publicity), H (Fees), I (Termination and Suspension), J (Disputes), K (Indemnification), L.2 (Disclaimer of Warranties), L.3 (Limits on Liability), and M (Miscellaneous); (b) any provision or condition that must survive to fulfill its essential purpose.

J. Disputes

J.1. Disputes.

In the event of a dispute, claim or controversy relating to these Terms (“Dispute”), the parties will first attempt in good faith to informally resolve the matter. The party raising the Dispute must notify the other party (“Dispute Notice”). The other party will respond to the Dispute Notice in a timely manner. If the parties have not resolved the dispute within 45 days of delivery of the Dispute Notice, either party may seek to resolve the dispute through arbitration as stated in Section J.2 (Arbitration).

J.2. Arbitration.

Any Dispute will be determined in English by final, binding arbitration according to the region-specific processes below. Judgment on any award issued through the arbitration process in this Section J.2 (Arbitration) may be entered in any court having jurisdiction. EACH PARTY AGREES THEY ARE WAIVING THE RIGHT TO A TRIAL BY JURY, AND THE RIGHT TO JOIN AND PARTICIPATE IN A CLASS ACTION, TO THE FULLEST EXTENT PERMITTED UNDER THE LAW IN CONNECTION WITH THESE TERMS.

J.2.a. Disputes will be determined by a sole arbitrator in San Francisco, CA pursuant to the Comprehensive Arbitration Rules and Procedures of Judicial Arbitration and Mediation Services, Inc.

J.3. Equitable Relief.

This Section J (Disputes) does not limit either party from seeking equitable relief.

K. Indemnification

K.1. Claims Against Customer.

Anthropic will defend Customer and its personnel, successors, and assigns from and against any Customer Claim (as defined below) and indemnify them for any judgment that a court of competent jurisdiction grants a third party on such Customer Claim or that an arbitrator awards a third party under any Anthropic-approved settlement of such Customer Claim. "Customer Claim" means a third-party claim, suit, or proceeding alleging that Customer’s paid use of the Services (which includes data Anthropic has used to train a model that is part of the Services) in accordance with these Terms or Outputs generated through such authorized use violates any third-party intellectual property right.

K.2. Claims Against Anthropic.

Customer will defend Anthropic and its personnel, successors, and assigns from and against any Anthropic Claim (as defined below) and indemnify them for any judgment that a court of competent jurisdiction grants a third party on such Anthropic Claim or that an arbitrator awards a third party under any Customer-approved settlement of such Anthropic Claim. “Anthropic Claim” means any third-party claim, suit, or proceeding related to Customer’s or its Users’ (a) Inputs or other data provided by Customer, or (b) use of the Services in violation of the Usage Policy, the Service Specific Terms, or Section D.4 (Use Restrictions). Anthropic Claims and Customer Claims are each a “Claim”, as applicable.

K.3. Exclusions.

Neither party’s defense or indemnification obligations will apply to the extent the underlying allegation arises from the indemnified party’s fraud, willful misconduct, violations of law, or breach of the Agreement. Additionally, Anthropic’s defense and indemnification obligations will not apply to the extent the Customer Claim arises from: (a) modifications made by Customer to the Services or Outputs; (b) the combination of the Services or Outputs with technology or content not provided by Anthropic; (c) Inputs or other data provided by Customer; (d) use of the Services or Outputs in a manner that Customer knows or reasonably should know violates or infringes the rights of others; (e) the practice of a patented invention contained in an Output; or (f) an alleged violation of trademark based on use of an Output in trade or commerce.

K.4. Process.

The indemnified party must promptly notify the indemnifying party of the relevant Claim, and will reasonably cooperate in the defense. The indemnifying party will retain the right to control the defense of any such Claim, including the selection of counsel, the strategy and course of any litigation or appeals, and any negotiations or settlement or compromise, except that the indemnified party will have the right, not to be exercised unreasonably, to reject any settlement or compromise that requires that it admit wrongdoing or liability or subjects it to an ongoing affirmative obligation. The indemnifying party’s obligations will be excused if either of the following materially prejudices the defense: (a) failure of the indemnified party to provide prompt notice of the Claim; or (b) failure to reasonably cooperate in the defense.

K.5. Sole Remedy.

To the extent covered under this Section K (Indemnification), indemnification is each party’s sole and exclusive remedy under these Terms for any third-party claims.

L. Warranties and Limits on Liability

L.1. Warranties.

Each party represents and warrants that (a) it is authorized to enter into these Terms; and (b) entering into and performing these Terms will not violate any of its corporate rules, if applicable. Customer further represents and warrants that it has all rights and permissions required to submit Inputs to the Services.

L.2. Disclaimer of Warranties.

EXCEPT TO THE EXTENT EXPRESSLY PROVIDED FOR IN THESE TERMS, TO THE MAXIMUM EXTENT PERMITTED UNDER LAW (A) THE SERVICES AND OUTPUTS ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND; AND (B) ANTHROPIC MAKES NO WARRANTIES, EXPRESS OR IMPLIED, RELATING TO THIRD-PARTY PRODUCTS OR SERVICES, INCLUDING THIRD-PARTY INTERFACES. ANTHROPIC EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE, AS WELL AS ANY IMPLIED WARRANTY ARISING FROM STATUTE, COURSE OF DEALING OR PERFORMANCE, OR TRADE USE. ANTHROPIC DOES NOT WARRANT, AND DISCLAIMS THAT, THE SERVICES OR OUTPUTS ARE ACCURATE, COMPLETE OR ERROR-FREE OR THAT THEIR USE WILL BE UNINTERRUPTED. REFERENCES TO A THIRD PARTY IN THE OUTPUTS MAY NOT MEAN THEY ENDORSE OR ARE OTHERWISE WORKING WITH ANTHROPIC.

L.3. Limits on Liability.

L.3.a. Except as stated in Section L.3.b, the liability of each party, and its affiliates and licensors, for any damages arising out of or related to these Terms (i) excludes damages that are consequential, incidental, special, indirect, or exemplary damages, including lost profits, business, contracts, revenue, goodwill, production, anticipated savings, or data, and costs of procurement of substitute goods or services and (ii) is limited to the greater of $100 or Fees paid by Customer for the Services in the previous 12 months.

L.3.b. The limitations of liability in this Section L.3 (Limits on Liability) do not apply to either party’s obligations under Section K (Indemnification).

L.3.c. THE LIMITATIONS OF LIABILITY IN THIS SECTION L.3 (LIMITS ON LIABILITY) APPLY: (I) TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW; (II) TO LIABILITY IN TORT, INCLUDING FOR NEGLIGENCE; (III) REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT, STRICT PRODUCT LIABILITY, OR OTHERWISE; (IV) EVEN IF THE BREACHING PARTY IS ADVISED IN ADVANCE OF THE POSSIBILITY OF THE DAMAGES IN QUESTION AND EVEN IF SUCH DAMAGES WERE FORESEEABLE; AND (E) EVEN IF THE INJURED PARTY'S REMEDIES FAIL OF THEIR ESSENTIAL PURPOSE.

L.3.d. The parties agree that they have entered into these Terms in reliance on the terms of this Section L.3 (Limits on Liability) and those terms form an essential basis of the bargain between the parties.

M. Miscellaneous

M.1. Notices.

All notices, demands, waivers, and other communications under these Terms (each, a "Notice") must be in writing. Except for notices related to demands to arbitrate or where equitable relief is sought, any Notices provided under these Terms may be delivered electronically to the address provided to Anthropic if to Customer; and to notices@anthropic.com if to Anthropic. Notice is effective only: (a) upon receipt by the receiving party, and (b) if the party giving the Notice has complied with all requirements of this Section M.1 (Notices).

M.2. Electronic Communications.

Customer agrees to receive electronic communications from Anthropic based on Customer’s use of the Services and related to these Terms. Except where prohibited by applicable law, electronic communications may be sent via email, through the Services or Customer’s management dashboard, or posted on Anthropic’s website. Anthropic may also provide electronic communications via text or SMS about Customer’s use of the Services or as Customer otherwise requests from Anthropic. If Customer wishes to stop receiving such messages, Customer may request it from Anthropic or respond to any such texts with “STOP”.

M.3. Amendment and Modification.

Anthropic may update these Terms at any time, to be effective 30 days after the updates are posted by Anthropic or Customer otherwise receives Notice, except that updates made in response to changes to law or regulation take effect immediately upon posting or Notice. Changes will not apply retroactively. No other amendment to or modification of these Terms is effective unless it is in writing and signed by both parties. Failure to exercise or delay in exercising any rights or remedies arising from these Terms does not and will not be construed as a waiver; and no single or partial exercise of any right or remedy will preclude future exercise of such right or remedy.

M.4. Assignment and Delegation.

Neither party may assign its rights or delegate its obligations under these Terms without the other party’s prior written consent, except that Anthropic may assign its rights and delegate its obligations to an affiliate or as part of a sale of all or substantially all its business. Any purported assignment or delegation is null and void except as permitted above. No permitted assignment or delegation will relieve the contracting party or assignees of their obligations under these Terms. These Terms will bind and inure to the benefit of the parties and their respective permitted successors and assigns.

M.5. Severability.

If a term or other provision of these Terms is invalid, illegal, or unenforceable in any jurisdiction (including, without limitation, as a result of the Customer being a public institution), such invalidity, illegality, or unenforceability will neither affect any other term or provision of these Terms nor invalidate or render unenforceable such term or provision in any other jurisdiction, and such term or provision shall instead be construed in a manner most consistent with applicable governing law. Upon such determination that any term or other provision is invalid, illegal, or unenforceable, the parties will negotiate in good faith to modify these Terms to reflect the parties’ original intent as closely as possible, consistent with applicable law.

M.6. Interpretation.

These Terms will be construed mutually, with neither party considered the drafter. Document and section titles are provided for convenience and will not be interpreted. The phrases “for example” or “including” or “or” are not limiting.

M.7. Governing Law; Venue.

M.7.a. These Terms are governed by and construed in accordance with the Governing Laws, without giving effect to any choice of law provision. “Governing Laws” means the laws of the State of California.

M.7.b. Any suits, actions, or proceedings related to these Terms that are not required to be resolved via arbitration pursuant to Section J (Disputes) will be instituted exclusively in the Venue, and each party irrevocably submits to their exclusive jurisdiction. “Venue” means federal or state courts located in California.

M.8. Export and Sanctions.

Customer may not export or provide access to the Services to persons or entities or into countries or for uses where it is prohibited under U.S. or other applicable international law. Without limiting the foregoing sentence, this restriction applies (a) to countries where export from the US or into such country would be prohibited or illegal without first obtaining the appropriate license, and (b) to persons, entities, or countries covered by U.S. sanctions.

M.9. Integration.

These Terms (including the Usage Policy, Supported Regions Policy, Service Specific Terms, DPA, Model Pricing Page and other documents or terms that are incorporated by reference by these Terms) constitute the parties’ entire understanding as to the Services’ provision and use. These Terms supersede all other understandings or agreements between the parties regarding the Services.

M.10. Force Majeure.

Neither party will be liable for failure or delay in performance to the extent caused by circumstances beyond its reasonable control.

U.S. K-12 Public Sector Addendum to the Anthropic U.S. K-12 Terms of Service

This U.S. K-12 Public Sector Addendum to the Anthropic U.S. K-12 Terms of Service (the "U.S. K-12 PubSec Addendum") is incorporated into and forms part of the Anthropic U.S. K-12 Terms of Service between Anthropic, PBC ("Anthropic") and Customer (the "Terms"). Capitalized terms used but not defined in this U.S. K-12 PubSec Addendum have the meanings given to them in the Terms or in the Anthropic U.S. K-12 Data Processing Agreement ("DPA"), as applicable.

This U.S. K-12 PubSec Addendum applies only where Customer is a local educational agency, public school, public school district, public charter school (or the public or nonprofit entity that holds its charter), state educational agency, regional or intermediate educational service agency or other public educational school serving students in grades K-12 that is created under applicable state or local laws (each, a "Public K-12 Entity"). If Customer is not a Public K-12 Entity, this U.S. K-12 PubSec Addendum does not apply and the Terms apply without modification.

In the event of a conflict between this U.S. K-12 PubSec Addendum and the Terms, this U.S. K-12 PubSec Addendum controls with respect to the subject matter addressed herein. In the event of a conflict between this U.S. K-12 PubSec Addendum and the DPA with respect to the processing of Student Data, the DPA controls.

1. Confidentiality
   1. Public Disclosure Laws. Notwithstanding Section E (Confidentiality) of the Terms, Anthropic acknowledges that Customer may be required to disclose Confidential Information under applicable public disclosure laws. Customer may disclose Confidential Information, including the Terms, this U.S. K-12 PubSec Addendum, the DPA, any ordering documents, attachments, and pricing information, to third parties to the extent required by applicable law; provided that Customer will provide (a) Anthropic prior written notice of the compelled disclosure (to the extent legally permitted); and (b) reasonable assistance, at Anthropic's cost, if Anthropic elects to contest the disclosure or seek a protective order or other limitation on the disclosure.
2. Termination and Suspension
   1. Termination for Convenience. Notwithstanding Section I.2 (Termination) of the Terms, provided Customer has a statutory right to do so, Customer may terminate the Terms or any related ordering documents without cause with 30 days Notice; provided, however, that upon any such termination, (i) any prepaid fees for purchased Services under any ordering document will not be refunded; and (ii) Customer will pay Anthropic any unpaid fees for purchased Services under any ordering document which is terminated. Anthropic may not terminate related ordering documents for convenience.
3. Disputes
   1. Arbitration. Section J.2 (Arbitration) will not apply if prohibited by SLED law. “SLED Law” means the laws of the State in which Customer was created, or in the state where Customer’s primary headquarters or main office is geographically located.
4. Indemnification
   1. Claims Against Anthropic. To the extent SLED Law prohibits Customer from indemnifying or defending Anthropic, Section K.2 (Claims Against Anthropic) of the Terms will not apply.
   2. Control of Defense. To the extent required by SLED Law, the applicable Attorney General’s Office will have the sole right to represent Customer in litigation and other formal proceedings.
5. Accessibility
   1. Anthropic makes available its Voluntary Product Accessibility Template ("VPAT") on trust.anthropic.com. Anthropic is committed to building accessible Services and aims to achieve conformance with the Web Content Accessibility Guidelines (WCAG) 2.2, Level AA.
6. Amendment and Modification
   1. Notwithstanding Section M.3 (Amendment and Modification) of the Terms, Anthropic may unilaterally update the Terms, including the (i) Usage Policy, (ii) Supported Regions Policy and (iii) Service Specific Terms if they are not material. A material change is (1) terms that change Customer’s rights or obligations, (2) terms that increase pricing, or (3) terms that decrease the overall security or functionality of the Services. Material changes will not apply to the then-current order term. At renewal or a new purchase, the material changes will be deemed accepted by the Customer. Material changes during the then-current order term require mutual written agreement. Changes to the extent required to comply with changes to applicable law or regulations are not material changes and will take effect immediately upon posting or Notice.
7. Governing Law; Venue
   1. Governing Law. The Terms will be governed by and construed in accordance with SLED Law.
   2. Venue. Section M.7.b of the Terms is deleted in its entirety.

Data Processing Agreement

This U.S. K-12 Data Processing Agreement (this “DPA”) is incorporated into and forms part of the Anthropic U.S K-12 Terms of Service or other agreement between Customer and Anthropic that references this DPA and governs Customer’s use of the Services (the “Agreement”), and applies to Anthropic’s processing of Customer Data (defined below). Capitalized terms used but not otherwise defined in this DPA will have the meaning set forth in the Agreement. Anthropic may amend this DPA from time to time on reasonable notice to Customer to the extent such changes are required due to changes in Applicable Data Protection Laws. If there is any conflict between the terms of this DPA and the Agreement, the conflicting terms in this DPA will govern.

A. Definitions

A.1. “Applicable Data Protection Laws” means all applicable privacy or data protection laws and regulations relating to the processing of personal information, as may be amended from time to time.

A.2. “Customer Personal Data” means personal information submitted through the Services by or for Customer or its users, students, or students’ parents/guardians.

A.3. “Customer Data” means all data or other information submitted through the Services by or for Customer.

A.4. “Individual Request” means a request from an individual, including students or students’ parents/guardians, to exercise their personal information-related rights under Applicable Data Protection Laws, such as rights to access, correct, or delete personal information.

A.5. “School Official” means a contractor to whom Customer may disclose personal information pursuant to the Family Educational Rights and Privacy Act (“FERPA”).

A.6. “Security Breach” means a breach of Anthropic’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data.

A.7. “Student Data” means data, whether gathered by Provider or provided by the Customer or its users, students, or students’ parents/guardians, that is descriptive of the student including, but not limited to, information in the student’s educational records, discipline records, test results, grades, evaluations, and student identification numbers. Student Data may include “education records” subject to FERPA. Student Data does not include De-Identified Data.

A.8. “Subprocessor” means an entity engaged by Anthropic to process Customer Personal Data.

A.9. “De-Identified Data” means data that cannot reasonably be linked, directly or indirectly, to a particular person. Anthropic shall not attempt to re-identify De-Identified Data.

A.10. The terms “personal information”, “processing”, “controller”, and “processor” as used in this DPA have the meanings given by Applicable Data Protection Laws.

A.11. The terms “controller” and “processor” include “business”, and “service provider”, respectively, as required by Applicable Data Protection Laws.

B. Processing of Customer Data

B.1. With respect to Customer Personal Data, Customer is the controller and Anthropic is Customer’s processor. Each party will comply with its respective obligations under Applicable Data Protection Laws in connection with the Services and the Customer Personal Data. For the avoidance of doubt, Anthropic does not collect Customer Personal Data or Student Data directly from students under the Agreement.

B.2. Where Customer is subject to FERPA, with Student Data that contains personal information that is disclosed by Customer, Customer acknowledges Anthropic has a legitimate educational interest in such data in connection with the Services provided under the Agreement, and that Anthropic shall act as a School Official.

B.3. Unless required by applicable law to which Anthropic is subject, Anthropic will only process Customer Personal Data to provide or maintain the Services, and in compliance with Customer’s documented instructions (including as set out in the Agreement and this DPA), and where subject to FERPA, Customer acknowledges that Anthropic’s processing of Student Data that contains personal information is under Customer’s direct control. Where requested by the Customer, Anthropic will delete, or provide Customer with the tools to delete, Customer Personal Data or Student Data associated with the Customer’s account within a reasonable time period, and provide required notices to Customer, as permitted or required by applicable law.

B.4. Without limiting the foregoing, Anthropic will not:

B.4.a. “sell” or “share” Customer Personal Data or Student Data, as defined by Applicable Data Protection Laws;

B.4.b. retain, use, or disclose Customer Personal Data or Student Data outside of the direct business relationship and for any purpose other than for the business purposes specified in Schedule 1 or as otherwise permitted by Applicable Data Protection Laws; for the avoidance of doubt, and notwithstanding any other provision of the Agreement, Anthropic shall not use such data for targeted advertising, marketing, or to create a profile about a student except as directed by Customer and consistent with the specified business purposes; and

B.4.c. except as otherwise permitted by Applicable Data Protection Laws, combine Customer Personal Data with personal information that Anthropic receives from or on behalf of another person or persons, or collects from its own interaction with the data subject;

B.5. As required under Applicable Data Protection Laws, Anthropic will promptly inform Customer if it makes a determination that it can no longer comply with its processing obligations under this DPA, in which case Customer may take reasonable and appropriate steps in accordance with the Agreement to stop or remediate any unauthorized processing of Customer Personal Data.

B.6. Anthropic will promptly inform Customer if, in its opinion, an instruction from Customer relating to the processing of Customer Personal Data violates Applicable Data Protection Laws.

B.7. Anthropic will ensure that each person it authorizes to process Customer Personal Data or Student Data is subject to an appropriate duty of confidentiality.

C. Subprocessors

C.1. Anthropic will: (a) enter into a contractual agreement with each Subprocessor it engages imposing data protection obligations that are substantially as protective as Anthropic’s obligations under this DPA to the extent applicable to the nature of the services provided by Subprocessor; and (b) remain liable to Customer for each Subprocessors’ acts and omissions related to this DPA to the extent Anthropic is liable for its own, consistent with the limitation of liability provided in the Agreement.

C.2. Anthropic will provide Customer reasonable notice of a new Subprocessor Anthropic intends to engage prior to giving the Subprocessor access to Customer Personal Data. Customer may, on the basis of reasonable data privacy or data security concerns, object to Anthropic’s use of such Subprocessor by providing Anthropic with written notice of the objection within fifteen (15) days of the date of such notice, or Customer is deemed to consent to the new Subprocessor. In the event Customer objects to Anthropic’s use of a new Subprocessor, Customer and Anthropic will work together in good faith to find a mutually acceptable resolution to address any objection raised by Customer.

D. Individual Requests

D.1. Anthropic will forward to Customer promptly any Individual Request received by Anthropic relating to the Customer Personal Data or Student Data and may advise the requestor to submit their request directly to Customer.

D.2. Anthropic will, taking into account the nature of the processing, provide Customer with reasonable and timely assistance as necessary for Customer to respond to Individual Requests, including as required under Applicable Data Protection Laws. Anthropic will generally respond within forty-five (45) days of a Customer’s request, and will take reasonable steps to comply where Customer provides Anthropic with prior written notice of a different time period required under Applicable Data Protection Laws.

E. Security

E.1. Anthropic will comply with the data security obligations of Applicable Data Protection Laws, and will implement and maintain reasonable and appropriate technical and organizational data protection and security measures designed to ensure a level of security for the Customer Data (including the Customer Personal Data and Student Data) appropriate to the risk of the relevant processing, as summarized in Schedule 2. Anthropic may update these measures from time to time, provided that such updates do not materially reduce the overall security of the Services, and provide relevant notices as required under Applicable Data Protection Laws.

E.2. The parties agree that the measures set out in Schedule 2 provide an appropriate level of security for the Customer Data (including the Customer Personal Data), accounting for the risks presented by the processing outlined in the Agreement and this DPA.

F. Compliance and Audits

F.1. Anthropic is audited annually against known, established industry standards performed by external auditors. Upon Customer’s written request, and subject to the confidentiality obligations set forth in the Agreement, Anthropic will provide Customer with such audit reports or certificates applicable to the Services (e.g., SOC 2 report), to the extent available, or such other information reasonably necessary to demonstrate compliance with this DPA. Anthropic’s current certifications are available for Customer’s review at trust.anthropic.com.

F.2. Upon Customer’s written request, Anthropic will permit Customer, at Customer’s expense, to audit Anthropic’s applicable controls and compliance with this DPA (an “Audit”), provided such Audit is (a) conducted by Customer or a third-party auditor designated by Customer that has executed an appropriate confidentiality agreement with Anthropic, (b) Customer and Anthropic mutually agree on reasonable details of the Audit, including the start date, scope and duration of, and security and confidentiality controls applicable to such audit, and (c) a similar Audit has not already been conducted less than twelve (12) months prior, unless there are indications of non-compliance and/or it is required by a supervisory authority or other regulatory authority responsible for the enforcement of Applicable Data Protection Laws.

F.3. Customer will pay any reasonably incurred costs and expenses incurred by Anthropic in the event Customer performs an Audit that is not (a) required by Applicable Data Protection Laws or (b) in response to a Security Breach.

F.4. Customer may use the results of an Audit only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of the DPA.

G. Security Breaches

G.1. Anthropic will notify Customer in writing without undue delay, but in any event within 48 hours, after becoming aware of any Security Breach, and will assist Customer in complying with Customer’s obligations under Applicable Data Protection Laws by reasonably cooperating with Customer’s investigation of the Security Breach. Anthropic’s notification of, or response to, a Security Breach will not be construed as an acknowledgement by Anthropic of any fault or liability with respect to the Security Breach. In the event of a Security Breach impacting Student Data, Customer shall be responsible for notifying relevant individuals in accordance with Applicable Data Protection Laws, and Anthropic shall take reasonable steps to assist Customer in such notifications as requested.

G.2. Upon becoming aware of a Security Breach, Anthropic will (a) investigate the Security Breach, and (b) provide timely information relating to the nature of the Security Breach, such as, where reasonably possible, the categories and approximate number of data subjects concerned and the categories and approximate number of Customer Personal Data records concerned, the likely consequences of the Security Breach, and the measures taken or proposed to be taken by Anthropic to address the Security Breach, including, where appropriate, measures to mitigate its possible adverse effects.

H. Deletion and Return

H.1. Within thirty (30) days of the date of termination or expiration of the Agreement, Anthropic will:

H.1.a. if requested to do so by Customer within that period, return a copy of all Customer Data in its control or possession or provide a self-service functionality allowing Customer to do the same; and

H.1.b. delete all copies of Customer Data (including Customer Personal Data) processed by Anthropic or any Subprocessors, except to the extent (i) Applicable Data Protection Laws or other applicable legal or regulatory requirements requires storage of the Customer Data, (ii) retention of the Customer Data by Anthropic is necessary to resolve a dispute between the parties, or (iii) retention of the Customer Data is necessary to combat harmful use of the Services.

Schedule 1 – Details of Processing

A. Description of Processing

A.1. Categories of personal information: Determined by the Customer (in accordance with the Agreement). These categories may include: information contained in a student’s educational record; first and last name; email address; grades, evaluations, and test results; discipline records; special education data; student identifiers; and documents or text submitted by the Customer containing information that personally identifies a student.

A.2. Duration and Frequency of the processing: The processing is performed on a continuous basis for the duration of the Agreement and is determined by Customer’s configuration of the Services.

A.3. Nature and Purpose of the processing: Performing the Services on behalf of Customer which involves processing (including collection, storage, organization and structuring) of personal information as part of a natural language-based, machine-learning tool, as further described in the Agreement and as may be further agreed upon by Customer and Anthropic; verifying or maintaining the quality, security, and integrity of the Services; debugging to identify and repair errors that impair existing intended functionality.

A.4. Storage Limitation: The duration is the term of the Agreement.

A.5. Subprocessors (where applicable): May be used by Anthropic to assist in the provision of the Services.

Schedule 2 – Technical and Organizational Measures

Anthropic has implemented and will maintain technical and organizational measures designed in accordance with industry standard practices to protect the security, confidentiality, and integrity of the Customer Data, as set out below. Anthropic may review and update these measures from time to time, provided that any such update will not materially diminish the overall security of the Customer Data during the term of the Agreement. Additional information about Anthropic’s information security program can be found at https://trust.anthropic.com.

A. Security Program and Policies

A.1. Anthropic maintains organizational management and dedicated staff responsible for the development, implementation, and maintenance of Anthropic’s information security program, and a qualified security team of a size sufficient to ensure compliance with this DPA.

A.2. Anthropic’s operational procedures and controls define physical, technical, and administrative safeguards that provide for the configuration, monitoring and maintenance of technology and information systems that process Customer Data according to prescribed internal and adopted industry standards.

A.3. Anthropic’s change management procedures and tracking mechanisms are designed to test, approve, and monitor all changes to Anthropic’s technology and information assets that process Customer Data.

A.4. Anthropic’s business resiliency and continuity plan and procedures are tested annually and designed to maintain service availability and enable recovery from emergency situations or disasters.

A.5. Anthropic’s network security controls provide for appropriate network traffic filtering, segmentation of networks, and other event correlation procedures designed to protect systems from intrusion and limit the scope of any potential security compromise.

A.6. Anthropic maintains a robust suite of internal security policies that are communicated and distributed to all personnel, including policies covering:

• Information Security
• Personnel Security
• Asset Management
• Data Management
• Risk Management
• Access Control
• Secure Development
• Operational Security
• Physical Security
• Incident Response
• Business Continuity and Disaster Recovery
• Cryptography

B. Access Controls

B.1. All Anthropic personnel are assigned unique identifiers for interacting with systems managing Customer Data.

B.2. All default system credentials are changed by Anthropic prior to a system’s use in a production capacity.

B.3. Anthropic maintains a least privileged access approach to system access, using RBAC (Role Based Access Control), by restricting Anthropic personnel to only the system access needed to fulfill a specific job function or business needs.

B.4. All access to systems processing Customer Data are protected by Multi Factor Authentication (MFA).

B.5. SSO via Anthropic’s primary IDP is enforced for all systems with access to, or that store or maintain, Customer Data.

B.6. Anthropic utilizes Context Aware Access to prevent unauthorized devices from accessing sensitive information, including Customer Data.

B.7. Anthropic maintains strong password requirements including:

B.7.a. a minimum of 16 characters;

B.7.b. changing of initial passwords; and

B.7.c. the prevention of password re-use.

B.8. Anthropic prohibits the sharing or transmission of passwords through unsecured communication channels.

B.9. Anthropic reviews privileged access to systems managing Customer Data on a regular basis to ensure provisioned access remains appropriate to job functions or business needs.

B.10. All users with privileged access to Customer Data have all access revoked promptly following termination of employment.

C. Personnel Management

C.1. All personnel engaged by Anthropic are properly trained and obligated to comply with the requirements of Anthropic’s security program, including with respect to the confidentiality and security of the Customer Data.

C.2. Anthropic employees, at hire and regularly thereafter, complete relevant training regarding confidentiality and data security, including regarding obligations under applicable laws. Where appropriate, these trainings provide information regarding relevant threats and business requirements, including social-engineering attacks, sensitive data handling, causes of unintentional data exposure, and security incident identification and reporting.

C.3. As a part of pre-employment, all candidates complete a rigorous interview process, undergo background checks, and sign confidentiality agreements.

C.4. Upon termination, Anthropic removes personnel access authorization without undue delay and in accordance with standard industry practices.

D. Audits and Certifications

D.1. Anthropic defines audit and risk assessment procedures for the purposes of: (a) periodic review and assessment of risks to Anthropic’s organization, assets, and data, (b) monitoring and maintaining compliance with Anthropic’s policies and procedures, and (c) reporting the condition of its information security and compliance to internal senior management.

D.2. Anthropic’s information security program is assessed annually by independent third-party auditors and reports from such annual assessments are made available to Anthropic’s customers.

D.3. To request access to any of our reports and certifications, please go to https://trust.anthropic.com.

E. Encryption Standards

Anthropic utilizes industry standard encryption methods for protection of Customer Data, including a minimum of AES-256 for data at rest, and TLS1.2+ for data in transit over public networks.

F. Endpoint Protection

All Anthropic personnel workstations, and cloud endpoints (where applicable), are protected via EDR (endpoint detection and response) systems that include, but are not limited to: (a) anti-virus and anti-malware protections; (b) active real-time system monitoring; and (c) alerting to internal security teams.

G. Vulnerability Management

G.1. Anthropic’s vulnerability assessment, patch management, threat protection technologies, and scheduled monitoring procedures are designed to identify, assess, mitigate, and protect against identified security threats, viruses, and other malicious code. Anthropic utilizes a multi-faceted approach to vulnerability management, including: automated code vulnerability scanning; automated artifact vulnerability scanning; automated code review; manual peer code review; public vulnerability disclosure program; endpoint detection and response; automated log analysis; and manual log analysis.

G.2. Anthropic engages qualified external assessors for the completion of annual penetration testing of systems that process Customer Data to identify vulnerabilities and attack vectors that can be used to exploit those systems, and identified vulnerabilities are addressed as part of Anthropic’s vulnerability management program. Upon request, Anthropic will make available to Customer a summary of its most recent penetration testing report.

G.3. Anthropic applies updates to mitigate vulnerabilities based on risk level and in alignment with industry-accepted timelines.

H. Data Management

All Customer Data stored by Anthropic is logically separated such that no customer is able to access the data of any other customer without authorization. Customer Data associated with a specific customer is easily identifiable. Further, Anthropic maintains reasonable and appropriate network-level segmentation to separate environments processing Customer Data from the internet, from development and testing environments, and from office workspaces.

I. Logging and Monitoring

I.1. Anthropic’s incident management procedures are designed to allow Anthropic to investigate, respond to, mitigate, and notify of events related to Anthropic’s technology and information assets that process Customer Data. These incident response procedures are tested annually.

I.2. Anthropic maintains a centralized SIEM (security information and event management)/SOAR (security orchestration, automation, and response) tool.

I.3. Anthropic logs employee access and actions within Anthropic’s systems, inclusive of those storing or maintaining Customer Data.

I.4. System audit or event logging and related monitoring procedures are proactively configured to detect, prioritize, and escalate, as appropriate, suspicious activities for review.

I.5. Security-related logs are retained for appropriate timeframes to aid in the investigation of security incidents.

J. Third Party Vendors

Anthropic maintains a third-party information security risk management program, which includes the execution of periodic risk assessments to evaluate the security posture of Anthropic’s third-party vendors.