Engagement letters and AI confidentiality: what a new-client letter gives away in ChatGPT or Claude.

The engagement letter is the first document a new client receives, and the one most often rebuilt from a previous client’s version. That habit is the AI data leakage risk: paste last year’s letter into ChatGPT or Claude to adapt it, and the previous client’s entire structure goes with it. This page marks every item in a standard engagement letter that an accounting firm is obliged to keep confidential, and shows how the same letter is drafted on Ermos from the firm’s own template without leaving the practice.

The engagement letter

Issued at the start of a new engagement or when the scope changes, and signed by the client before work begins.

Northgate Partners
Chartered Accountants



Dear Lena,

Re: Terms of engagement

Thank you for choosing Northgate Partners. This letter sets out the services we will provide and the terms on which we provide them.

The entities. We are engaged by .

The services. .

What we need from you. .

Fees. Our standard terms, including our privacy policy and the limitation of liability under the Professional Standards scheme, are attached.

Our obligations. We are bound by APES 110 and by the Tax Practitioners Board Code of Professional Conduct.

Please sign and return a copy to confirm your acceptance.

Kind regards,

An invented letter. The ABN is the ATO’s published example value. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the firm

  1. 1
    The client and her home address

    A named individual at a residential address. Personal information under the Privacy Act, and the key to everything else in the letter. Privacy Act guide.

  2. 2
    The group structure

    Three entities, a trust and a trading name in one sentence. A map of how a family holds its wealth, which takes an adviser months to assemble and a fraudster minutes to use. APES 110 confidentiality guide.

  3. 3
    The family

    Two directors, an 81-year-old appointor and their relationships. Three individuals’ personal information, two of whom are not the firm’s correspondent. Privacy Act guide.

  4. 4
    The services, including the planned sale

    The scope reveals the client’s intentions: a property sale is being planned before anyone outside the family knows. Confidential information acquired in the professional relationship under APES 110 R114.2. APES 110 confidentiality guide.

  5. 5
    Systems, documents and the previous accountant

    Which accounting system the client runs, which documents exist, and that the client has changed firms. The last fact alone is sensitive to two practices. TPB Code guide.

  6. 6
    Fees and rates

    The firm’s own pricing, now on a third party’s servers alongside the client it was quoted to.

  7. 7
    The confidentiality promise

    The letter promises that client information will not go to third parties without permission. Pasting the letter into a frontier model is the first test of that promise, and it fails it. TPB Code guide.

  8. 8
    The practitioner

    The partner’s name ties the engagement to a registered agent with statutory obligations, and makes the leak traceable to the practice. TPB Code guide.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in accounting firms. See how this works in practice: Engagement letters on Ermos.

Common questions

Do ChatGPT and Claude use the information in an engagement letter?
It depends on the plan behind the account. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The letter is also sent to the AI company to be processed. This letter maps the group structure, names three relatives and reveals a planned property sale.
Is it safe to paste an engagement letter into ChatGPT or Claude if we take the client's name out?
No, because the letter's structure still points to one family without the client's name. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A family trust, a dental company with a trading name, two sibling directors and an 81-year-old appointor describe one household. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Can ChatGPT or Claude remember the details in an engagement letter later?
They can. Both products also have memory features that can carry details from one conversation into later ones, and on a personal account each user decides whether they are switched on (ChatGPT, Claude). Staff usually adapt an engagement letter from an earlier client's version. The entities, the directors and the trust's appointor could follow the user into a later chat about a different client. Those details belong to the first client and were never meant to travel further.
How can an accounting practice use AI for an engagement letter without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos builds the draft from the new client's file and the practice's own engagement letter template. A partner checks the scope and terms before signing it.
Can we use AI to draft engagement letters at all?
Yes, and it is one of the better uses: the letter is template-driven and the variable parts are structured. The question is where the drafting happens. On a unit in your office, or on your own Edge instance, the previous client's letter never leaves the practice when it is used as the base for the next one.
Should the engagement letter mention AI?
Yes, and the TPB now says so. TPB(GS) 55/2026 recommends telling the client to whom and where disclosure will be made, where data will be stored and whether AI tools may be used, and lists a signed engagement letter as a way of obtaining the permission Code item 6 requires. APES 110 contemplates the same authorisation (114.3 A3). The sentence is a one-liner when processing happens inside the practice.
What about the previous accountant's details?
A change of accountant is sensitive to both firms. It is also a courtesy matter under the professional bodies' ethical letter practice. It belongs in the engagement file, and nowhere a third party can read it.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in accounting firms AI for accountants APES 110 and AI All professions