Client emails and AI data leakage: what a year-end query list gives away in ChatGPT or Claude.

Most of an accounting firm’s writing is email, and most of that email is routine: a list of what is missing, what needs confirming and what looks wrong. Routine is exactly why it gets pasted into ChatGPT or Claude to be made polite and clear. This page marks every item in an ordinary year-end query email that AI confidentiality rules protect, which turns out to be most of it, and shows how the same email is drafted on Ermos from the file without leaving the practice.

The client query email

Sent during year-end once the preparer has worked through the file and needs the client to fill gaps and confirm items.

To:
From:
Subject: FY2026 queries, Harbourline Joinery

Hi Daniel,

We are close to finishing the company return. A few things to tidy up:

  1. Missing documents.
  2. Deposit on 3 March.
  3. Credit card.
  4. Super.
  5. Coastline.
  6. Your mum.

Thanks,

An invented email. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the firm

  1. 1
    The client

    Named, with the entity in the subject line. APES 110 confidentiality guide.

  2. 2
    Financing, insurer and bank

    Which lender financed the equipment, for how much, and where the company banks. A map of the client’s financial relationships. APES 110 confidentiality guide.

  3. 3
    An undocumented transaction

    A deposit the client has explained verbally and cannot yet document. The kind of fact that reads badly out of context. APES 110 confidentiality guide.

  4. 4
    Questioned deductions

    Private spending that may have been claimed. The email asks the question carefully; a third party’s servers hold it without the care. TPB Code guide.

  5. 5
    Late super for named employees

    A compliance failure and two employees’ names. The employees are not the firm’s clients and their superannuation is their personal information. Privacy Act guide.

  6. 6
    A written-off receivable and the debtor

    The client’s bad debt and the name of the company that caused it, which is nobody’s client here. APES 110 confidentiality guide.

  7. 7
    A family member and a request for her TFN

    That the client’s mother is in care, and a request that her TFN be sent by email. Her personal information, and a TFN handling question before any TFN has been sent. Tax file numbers guide.

  8. 8
    The staff member

    Ties the email to the firm and to a graduate working under R113.2 supervision. Checking AI output guide.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in accounting firms. See how this works in practice: Client query letters on Ermos.

Common questions

Do ChatGPT and Claude use the information in a client query email?
That depends on the account the user is on. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The email is also sent to the AI company to be processed. This email carries a questioned deduction, a late super payment and an unexplained deposit.
Is it safe to paste a client query email into ChatGPT or Claude if we remove the client's name?
No, because an email without the client's name still describes one business. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A named lender, a $14,900 deposit, two Bali flights and a $96,000 receivable owed by a company in administration identify the client. Two employees are also named in the late super item. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Does deleting the chat remove a client query email from ChatGPT or Claude?
Not completely. Deleting a chat removes it from the user's history, but OpenAI and Anthropic each say they can keep a deleted chat on their systems for up to 30 days, and longer where safety or legal obligations apply (OpenAI, Anthropic). For a query email, the questioned deduction and the late super finding could stay with an AI company after the preparer deletes the chat. The practice could not assure the client that those items had gone.
How can an accounting practice use AI for a client query email without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos drafts the query list from the client file and the practice's own year-end email template. A senior accountant checks every item and signs it off before it reaches the client.
It is just an email. Is this really a confidentiality issue?
Every line of it is information acquired in the course of the professional relationship, which is what APES 110 Subsection 114 covers. Email is where most client information in a firm actually lives, and the routine ones carry as much as the formal letters.
Could staff use AI to improve the tone without pasting the content?
They could ask for general phrasing and rewrite by hand, which few do at deadline. The practical answer is a tool that drafts from the file inside the practice, so the convenient path and the compliant path are the same path.
What about asking for the mother's TFN by email?
Separate issue, same theme. The TFN Rule requires reasonable steps to protect TFN information, and most firms now collect TFNs through a secure portal or form rather than by email. The point for this page is that the request itself, with her circumstances, is already on a third party's servers.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in accounting firms AI for accountants APES 110 and AI All professions