Anthropic moved enterprise misuse-detection data into the customer's own cloud account, not theirs anymore

Anthropic announced Enterprise Frontier Safeguards on September 1. Until now, enterprise Claude usage data used for misuse detection could sit on Anthropic's own servers for up to 30 days, specifically so staff could review flagged activity by hand. Under the new system that data instead writes into the customer's own AWS, Azure, or GCP storage, under the customer's own keys and audit logs, and Anthropic staff no longer get standing access to read it by default. The detection itself hasn't changed. Automated misuse monitoring still runs continuously on the usage data, looking for patterns consistent with abuse. What moved is only the storage location and the default human-review boundary. Here's what I can't work out from the announcement. Automated misuse detection like this usually benefits from some shared signal across customers, that's a lot of how you catch a genuinely novel attack pattern rather than just known signatures. If each customer's activity data now lives in isolated storage they control, does the detection model still train or get updated against some pooled signal elsewhere, or is Anthropic now running something closer to a static or per-customer model against data it can't see? Has anyone found more detail on how the actual detection pipeline is architected under this setup?