DISCLAIMER: This document is a framework for self-managed AI orchestration projects. It is NOT legal advice and should NOT be treated as such. Every team is responsible for verifying compliance with the laws and regulations applicable to their jurisdiction and industry. This project is NOT affiliated with Anthropic.

Personal use only. This framework is provided as-is for personal and educational use. There is no warranty, no support guarantee, and no liability. You are responsible for reviewing all agent output before using it in any context.

Not affiliated with Anthropic. VibeCorp PromptCEO is a community project. It is not created, endorsed, sponsored, or supported by Anthropic PBC. For official Claude products: anthropic.com. For official Claude Code docs: code.claude.com/docs.

1. Data Classification — What Goes Where
2. API Data Flows
3. Anthropic Data Policy Summary
4. Token Usage and Cost Awareness
5. PII Handling Rules
6. Secrets Management
7. Tier 3 Gates — When Human Approval is Required
8. Agent Permissions
9. Compliance Considerations by Jurisdiction

Rule: Agents can only access external systems through MCP tools you have explicitly configured. No MCP tool configured = no external access for that system.

Your machine (Claude Code session)
  │
  ├── [PROMPT] ──────────────────────────► Anthropic API
  │                                            │
  │   ◄─────────────────── [RESPONSE] ─────────┘
  │
  ├── [MCP tool call] ──────────────────► Slack / Jira / Notion / GitHub
  │   ◄─────────── [MCP tool response] ──┘
  │
  └── [File read/write] ───────────────► Local filesystem only

When Claude Code sends a prompt to the Anthropic API, it typically includes:

• The contents of CLAUDE.md (your system prompt / project context)
• The current conversation messages
• File contents you have explicitly opened or referenced in the session
• Any tool results returned by MCP tools

This means: Anything in CLAUDE.md, open files, or agent outputs that you reference in the session will be sent to Anthropic's API as part of the context window.

• Files that have not been opened in the current session
• Your .env file (unless you explicitly open it in a session — never do this)
• Your .mcp.json file (unless you explicitly open it in a session — never do this)
• Content from external APIs that you did not reference in the session

Claude Pro / Max subscribers: As of Anthropic's published policy, conversations are NOT used to train Claude models when you opt out. Claude.ai (the web interface) and the API provide opt-out mechanisms. Always verify the current policy at: https://www.anthropic.com/privacy

Key points to verify for your use case:

• API usage (via Claude Code) is covered by the API terms of service, which are distinct from the consumer Claude.ai terms
• Enterprise plans (Claude for Work / Teams) have additional data isolation guarantees
• If you are processing personal data of EU or UK residents, review Anthropic's data processing agreements

Practical recommendations:

1. Do not paste real customer PII into any session prompt
2. Do not paste production database contents into sessions
3. Do not paste real API keys, tokens, or credentials into chat
4. If your project handles sensitive data, work with synthetic / anonymised data during development

Prices shown are approximate as of early 2025. Always verify current pricing on Anthropic's website before estimating costs.

• CLAUDE.md is loaded at the start of every session. If it is 5,000 words (~7,500 tokens), that is 7,500 input tokens per session before you type a single message
• Long conversation histories accumulate quickly. A 20-turn conversation with file reads can easily exceed 50,000 tokens
• Sub-agent spawns each start a fresh context window — this is cost-efficient but means the sub-agent does not carry conversation history

1. Use Haiku for routing and summarisation — tasks that do not require deep reasoning
2. Use Sonnet as the default for most specialist agents
3. Reserve Opus for CEO-level strategic thinking, investor narrative, and architecture decisions
4. Keep CLAUDE.md concise — every token in your system prompt is charged on every API call
5. Set spend limits in your Anthropic console to prevent runaway costs
6. Monitor usage via the Anthropic console usage dashboard monthly

Personally Identifiable Information includes, but is not limited to: full names, email addresses, phone numbers, physical addresses, national ID numbers, passport numbers, payment card details, IP addresses, device identifiers, and any data that can directly or indirectly identify a natural person.

When an agent needs to reference a user for testing or demonstration purposes, use this format:

user_id: USR-00123
email: user@example.com (masked)
name: [REDACTED]

Agents should request and process only the minimum data necessary to complete the task. Do not load full database exports into sessions. Do not reference live production data in agent prompts.

Add these lines to your .gitignore before your first commit:

# Secrets — NEVER commit these
.mcp.json
.env
.env.*
!.env.example
*.pem
*.key
*.p12
*.pfx
*.secret
*.credentials

# Claude Code local files
.claude/

Create a .env.example file that lists all required variables with placeholder values but NO real secrets. This serves as documentation for new team members:

# .env.example — copy to .env and fill in real values
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/WEBHOOK/URL
JIRA_API_TOKEN=your_jira_api_token_here
NOTION_API_KEY=your_notion_integration_token_here
TELEGRAM_BOT_TOKEN=your_telegram_bot_token_here

If you accidentally commit a secret to git:

1. Revoke the secret immediately at the source (Slack, Atlassian, Notion, etc.)
2. Generate a new secret
3. Remove the committed secret using git filter-branch or BFG Repo Cleaner
4. Force-push (after team coordination)
5. Update your .gitignore to prevent recurrence

Tier 3 actions are full stops. The orchestrator announces the action, waits, and will NOT proceed until the Founder types the explicit approval phrase.

1. Agent hits a gate condition and immediately stops
2. Orchestrator posts to [SLACK_ALERTS_CHANNEL] with the gate details
3. Orchestrator outputs the gate in the Claude Code chat
4. Founder reviews and types the approval phrase
5. Orchestrator logs the approval (who approved, timestamp, action) in docs/DECISIONS.md
6. Orchestrator proceeds

• Schema changes are irreversible in production without migrations
• Auth changes can lock users out or expose accounts
• Public content is legally binding once published
• Committed secrets cannot be truly erased from git history
• External API costs are charged immediately

• Read files in the project directory
• Write files in the project directory
• Run build checks, TypeScript checks, and linting
• Post to Slack channels (if Slack MCP is configured)
• Read Jira tickets (if Jira MCP is configured)
• Write to Notion databases (if Notion MCP is configured)
• Spawn sub-agents via Claude Code's agent system

• Access any external system without an MCP tool explicitly configured for that system
• Read files outside the project directory (sandboxed by Claude Code)
• Directly query production databases (no direct DB connection — only through MCP or code)
• Commit to git without Founder approval (Tier 3 gate)
• Push to remote without Founder approval (Tier 3 gate)
• Execute arbitrary shell commands that are not pre-approved in the session
• Access the operating system outside the Claude Code sandbox

Each Claude Code sub-agent session:

• Operates within its own context window
• Does not have access to the parent orchestrator's session history unless explicitly passed via a handoff envelope
• Cannot communicate with other sub-agents directly — all coordination goes through the orchestrator
• Cannot persist state between sessions except through files written to the project directory

IMPORTANT: The guidance below is generic and informational only. It is NOT legal advice. You MUST consult a qualified legal professional before processing personal data or operating in regulated industries.

If your product processes personal data of EU/EEA residents:

• You likely need a Data Processing Agreement (DPA) with Anthropic if prompts contain personal data
• You must have a lawful basis for processing personal data
• Users have rights: access, rectification, erasure, portability
• Do not store EU personal data in systems without adequate protections

Substantially similar to EU GDPR. Apply the same principles. Monitor ICO guidance post-Brexit for divergences.

If you have California residents as users and meet the thresholds:

• Privacy policy disclosures required
• Right to know, delete, and opt-out of sale
• Do not "sell" or "share" personal data without appropriate mechanisms

If operating in the UAE:

• Federal Decree-Law No. 45 of 2021 on Personal Data Protection applies
• Sector-specific rules apply (ADGM, DIFC financial services regulations, health data)
• Data localisation requirements may apply in certain contexts

1. Conduct a Data Protection Impact Assessment (DPIA) before launching
2. Maintain a record of data processing activities
3. Implement data minimisation from day one — only collect what you need
4. Define and document data retention periods
5. Have a breach response plan ready
6. Review the terms of service of every API you connect to (Slack, Atlassian, Notion, Anthropic, etc.) for their data handling commitments

This is an open-source framework distributed under the MIT license. It is provided as-is with no warranty of any kind.

What this means:

• You may use, modify, and distribute this framework freely
• There is no guaranteed support, SLA, or maintenance commitment
• The authors and contributors are not liable for any damages arising from use
• You are solely responsible for evaluating and verifying all agent output
• This framework does not constitute legal, financial, security, or compliance advice

What data goes where — honest summary:

Bottom line: Your code stays local. Your conversations go through Anthropic. Your integrations go where you point them. Nothing happens without your configuration.

Before going to production with PromptCEO, verify:

• .mcp.json and .env are in .gitignore and have never been committed
• CLAUDE.md contains no real customer PII
• All Tier 3 gates are active and understood by the founding team
• Anthropic API spend limits are set in the console
• A .env.example file exists with placeholder values
• All external API keys have been scoped to minimum required permissions
• You have reviewed Anthropic's current privacy policy for your subscription tier
• You have identified which data protection laws apply to your product
• Agent memory files are excluded from your public repo or reviewed before committing

PromptCEO is an open-source framework. This document provides a starting point for security thinking, not a complete compliance programme. Adapt it to your specific context, jurisdiction, and risk tolerance.