AI data leakage in accounting firms: what leaves when client documents go into ChatGPT or Claude.

AI confidentiality in an accounting firm comes down to one question: what leaves the practice when a staff member pastes a document into ChatGPT or Claude? The answer is usually more than anyone intended. This series takes eighteen documents an accounting firm produces every week, from the engagement letter to the payroll query, marks every item the firm is obliged to protect, and shows where each one goes. Each page ends with the same document on Ermos, where it stays inside the practice.

The documents, one at a time

LetterThe year-end client letter

Identity, figures, bank details, a tax file number and the firm’s own advice, in one routine letter.

See what leaves → AgreementThe engagement letter

Entity structure, directors and trustees, the services engaged and the terms, in the first letter every client gets.

See what leaves → EmailThe email to the ATO

A tax file number, a debt, a hardship story and an ATO reference, in one email that is drafted under pressure.

See what leaves → NotesThe workpaper review note

Journal narrations, a related-party loan, reconciliation items and the reviewer’s own doubts, which the client has never seen.

See what leaves → EmailThe payroll query email

Employee names, tax file numbers, pay rates and super funds. The people leaked are the client’s staff, who never agreed to anything.

See what leaves → Statement or scheduleThe SMSF member statement

Members, dates of birth, balances, pension phase and the fund’s assets. A family’s retirement on one page.

See what leaves → Report or memoThe capital gains advice

Sale price, cost base, the small business concessions, the beneficiaries and the firm’s recommendation. The family’s affairs and the firm’s best work together.

See what leaves → FormThe client onboarding form

Licence number, date of birth, address, TFN and bank account. Identity theft material, on one form.

See what leaves → EmailThe client query email

Missing documents, queried figures, questioned deductions and a client’s circumstances, in the most routine email the firm sends.

See what leaves → LetterThe accountant’s letter to a lender

Income, entities, existing debts and the firm’s own representation, addressed to a bank in the firm’s name.

See what leaves → SpreadsheetThe BAS workings spreadsheet

Customers, suppliers, wages, the ATO balance and the reviewer’s comments, in the workbook opened every quarter.

See what leaves → SpreadsheetThe year-end trial balance

Related-party loans, rent, contractor fees, bank facilities and the reviewer’s notes, on a grid that looks like arithmetic.

See what leaves → SpreadsheetThe cash flow forecast

Customers, wages, lenders, personal guarantees and the firm’s advice on a covenant breach, in the notes column.

See what leaves → RecordThe trust distribution minute

The trustee, every beneficiary, every amount, an elderly beneficiary’s account and the reasons for the split.

See what leaves → NotesThe bookkeeper handover note

Where the logins live, a payroll dispute, a director’s private spending and a family confidence, in a note written in a hurry.

See what leaves → Report or memoThe business sale due diligence report

Normalised earnings, customer concentration, staff entitlements, an ATO arrangement and the price the buyers will pay.

See what leaves → EmailThe FBT query email

A named employee, his weekend habits, a director’s new car and a client’s cash worries, around a generic question.

See what leaves → TranscriptThe client meeting transcript

Consent to record, a director’s health, a covenant breach, a family loan and the firm’s advice, in the client’s own words.

See what leaves →

How the leakage happens

The mechanism is the same for every document. The whole text is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia. On consumer tiers it can be retained and used to train future models. The provider’s staff and systems can reach it under the provider’s own policies. Once sent, the firm no longer controls it. Our on-premise vs cloud comparison sets out the four ways to run AI and where each one puts your documents.

The obligations in play

Each marked item on these pages links to the guide that covers its obligation:

The same documents on Ermos

Ermos Dominion drafts and searches on a unit in your office, so the documents never leave it. Ermos Edge keeps your documents on your own instance in an Australian data centre and sends only permitted excerpts, per question, to a named Australian provider. Every page in this series ends with both, item by item.

Common questions

Can accountants use ChatGPT or Claude with client information?
Not without the client's permission, and the practice's confidentiality duties still apply. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. APES 110 prohibits disclosing confidential client information without a legal or professional duty or the client's authority. The TPB Code requires the client's permission before information about their affairs goes to a third party. The TFN Rule limits who may access tax file number information, and the Privacy Act covers personal information about anyone in the file.
Do ChatGPT and Claude train on what staff paste in?
It depends on the account each person is using. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. For an accounting practice the question matters because what staff paste is a client's tax file number, income and advice.
Do business plans such as ChatGPT Business or Claude Team solve the problem for accountants?
Only in part. A business plan gives the practice different terms and settings to review, and the content still reaches the AI company. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. For an accounting practice, the question of the client's permission to share their affairs with that AI company stays open. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.
What is the safest way for an accounting practice to use AI with client documents?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. For accountants, control means the practice decides who can see tax file numbers and bank details, and a qualified person checks every draft.
What is AI data leakage?
Information leaving an organisation's control through an AI tool. When a document is pasted into ChatGPT or Claude it is transmitted to the provider's servers, can be retained on the provider's terms, can be used to train future models on consumer tiers, and can be reached by the provider's staff and systems. For an accounting firm the leaked information is usually a client's.
Which accounting documents carry the most risk?
Anything with a tax file number, bank details, identity documents or the firm's own advice: correspondence with the ATO, payroll queries, onboarding forms, SMSF statements and tax advice. The pages in this series take each one in turn.
Does this apply to Microsoft Copilot as well?
It applies to any tool that processes documents outside the practice. Where Copilot's processing happens, and what Microsoft's terms say, is covered in our Copilot comparison.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI for accountants APES 110 and AI All professions