Cash flow forecasts and AI data leakage: what a covenant discussion gives away in ChatGPT or Claude.

A cash flow forecast is built when a client is under pressure, which is when the notes column fills with the firm’s real thinking: whether a bank covenant will be met, which lender to call first, whether the directors should take advice about insolvent trading. Staff paste the sheet into ChatGPT or Claude to tidy the layout or test the assumptions. This page marks every item in a realistic forecast that APES 110 and the TPB Code bear on, including the notes column, shows which labels are harmless to share, and shows how the same review runs on Ermos inside the practice.

The cash flow forecast

Built for a client with a lender application or a payment plan in progress, updated after each client meeting, and reviewed by a partner before it is sent to anyone outside the firm.

Cash flow forecast
Northgate Partners · 29 October 2026 · GST inclusive

fx=B2+B3+SUM(B4:B10)
ABCDEFG
1Oct 26Nov 26Dec 26Jan 27Feb 27Notes
213,00016,060(32,782)(38,472)(48,362)Cash $31,000 less Macquarie overdraft drawn $18,000
3Receipts from customers148,000139,000121,00096,000135,000
4Supplier payments(82,000)(77,500)(64,000)(52,000)(76,000)
5Wages and super(41,500)(38,200)(38,200)(29,400)(38,200)
6Rent(9,800)(9,800)(9,800)(9,800)(9,800)
7Westpac equipment finance(2,640)(2,640)(2,640)(2,640)(2,640)
8Other operating costs(9,000)(9,000)(9,000)(9,000)(9,000)
9BAS and PAYG0(44,702)00(40,500)
10ATO payment plan0(6,000)(3,050)(3,050)(3,050)
1116,060(32,782)(38,472)(48,362)(92,552)
12Macquarie headroom (limit $50,000)50,00017,21811,5281,638(42,552)
ForecastAssumptionsCovenants

An invented forecast. The covenant terms and every figure are invented. Hover or tap any highlighted cell for the analysis; the full list is below.

What leaves the firm

  1. 1
    The client and the purpose

    Names the business behind every row. A workbook also carries author and last-saved-by fields, and any hidden tabs or columns, whenever it is shared as a file. APES 110 confidentiality guide.

  2. 2
    A customer and its payment terms

    Which customer pays slowly and how slowly. Confidential financial information acquired in the professional relationship under APES 110 R114.2. APES 110 confidentiality guide.

  3. 3
    A named employee’s arrangement

    Unpaid leave agreed with an office manager, tied to her name. Personal information about an employee who is not the firm’s client. Privacy Act guide.

  4. 4
    The facility terms and the guarantees

    A financial covenant from a lender’s facility letter, its test date, and that the directors guarantee the facility personally. Contract terms between the client and its lender, and the owners’ own exposure. APES 110 confidentiality guide.

  5. 5
    The expected covenant breach and the plan

    The firm’s estimate that the covenant will be missed and its recommendation to ask for a written waiver. A breach of a financial covenant can be an event of default under the facility terms, depending on the agreement. Advice the client has not yet acted on, and one the firm has to stand behind. TPB Code guide.

  6. 6
    Which lender to speak to first

    The sequencing of conversations with two lenders, and that one facility is repayable on demand. Strategy that would damage the client if either lender saw it. APES 110 confidentiality guide.

  7. 7
    The BAS and the payment plan collision

    What the client owes the ATO and that it cannot meet it alongside a plan instalment. A suggestion to ask the ATO for more time, before the client has agreed to ask. TPB Code guide.

  8. 8
    The shortfall and the directors’ duties

    A forecast breach of the overdraft limit and the firm’s note that the directors should take legal advice on insolvent trading. The insolvent trading provisions of the Corporations Act put the duty on the directors personally, so this is the most sensitive note in the file. Checking AI output guide.

  9. 9
    A third party’s dividend

    That a customer in administration may pay a dividend, and that the forecast leaves it out. A company that is nobody’s client, mentioned only because of the client’s loss. APES 110 confidentiality guide.

  10. 10
    Row labels like Opening cash and Closing cash

    Generic cash flow headings that appear in any forecast, with no client data in the words.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in accounting firms. See how this works in practice: Tax and advisory work on Ermos.

Common questions

Do ChatGPT and Claude use the information in a cash flow forecast?
Yes, anything pasted or uploaded reaches the AI company's servers and is processed there to produce a reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. In this forecast that covers the Westpac covenant of 1.25 times, the firm's estimate of 1.08 times, the directors' personal guarantees and the note that Daniel should take legal advice on insolvent trading.
Can we use ChatGPT or Claude for a cash flow forecast if we remove the client's name?
Removing the name would not make this forecast safe to share. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A Westpac covenant tested on 31 December, a Macquarie overdraft limit of $50,000, a customer on 60-day terms and an employee on unpaid leave describe one business. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Can I upload a cash flow forecast to ChatGPT or Claude instead of pasting it?
Uploading sends the whole file, which is more than the grid you meant to share. A workbook can carry other sheets, hidden columns, comments, tracked changes and file properties. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. This forecast has Assumptions and Covenants tabs behind the Forecast sheet. The covenant terms and assumptions behind the figures could go along with the notes column about which lender to call first.
How can an accounting practice use AI for a cash flow forecast without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos drafts the forecast from the client file and the practice's own cash flow template. A partner checks every figure and assumption and signs it before it goes to the client or the lender.
What is a financial covenant in a facility?
It is a condition in a loan agreement that the borrower must keep meeting, for example a minimum ratio of cash flow to repayments, tested on set dates. What happens on a breach depends on the facility agreement, and it can include the lender being entitled to declare a default or to agree a waiver. The terms belong to the client and its lender, and an accountant holds them in confidence.
Can an accountant discuss a covenant breach with the client's bank?
Only with the client's permission. For a registered tax agent or BAS agent, TPB Code item 6 bars disclosing information about a client's affairs to a third party without that permission unless there is a legal duty to do so, and APES 110 R114.2 is to the same effect for members of the professional bodies. Where the firm intends to use an AI tool on the forecast, TPB(GS) 55/2026 recommends the client is told where the data will go and whether AI tools may be used.
Why do the notes matter more than the numbers?
The numbers show a position. The notes record what the firm thinks about it, such as which lender to call first and whether the directors need legal advice, and that is advice the client is paying for. Pasted into a frontier model, the notes leave the practice before the client has heard them, and the firm cannot recall them.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in accounting firms AI for accountants APES 110 and AI All professions