Onboarding forms and AI security: what identity documents give away in ChatGPT or Claude.

The onboarding form is the document with the least excuse for leaving the office. It exists to verify a client’s identity, so it holds the exact set of facts an identity thief needs: licence number, date of birth, address, tax file number and bank account. AI security in an accounting firm starts here, because the form is also the one most often pasted into ChatGPT or Claude to extract its contents into a system. This page marks every item on a standard form and shows how the same extraction happens on Ermos inside the practice.

The client onboarding form

Completed by every new client, usually with a copy of their driver licence, and kept on file to meet identity verification obligations.

New client details
Northgate Partners · Individual

Full name
Date of birth
Residential address
Driver licence
Tax file number
Bank account for refunds
Mobile and email
Spouse
Dependants
Previous accountant
Notes

An invented form. The TFN is the ATO’s published example value; the licence and card numbers are placeholders. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the firm

  1. 1
    Full legal name

    The first of the identity facts. On its own, harmless; with the rest of the form, a complete identity. Privacy Act guide.

  2. 2
    Date of birth

    The second identity fact, and one that cannot be changed after a breach. Privacy Act guide.

  3. 3
    Address, phone and email

    Where the client lives and how to reach him. With the licence, enough to pass most identity checks. Privacy Act guide.

  4. 4
    Driver licence number and card number

    Government identifiers used for identity verification across banks, telcos and government services. A compromised licence number is reportable and the licence usually has to be replaced. Privacy Act guide.

  5. 5
    A tax file number

    The TFN Rule permits TFN information to be used or disclosed only for authorised tax, superannuation or personal assistance purposes, with access restricted to people who need it. An onboarding form is collected for such a purpose; a frontier model provider is not such a person. Tax file numbers guide.

  6. 6
    Bank account details

    A full BSB and account number, labelled as the refund account. The item that turns identity theft into money.

  7. 7
    The spouse and children

    Two adults’ and two children’s personal information, collected for family tax purposes and now outside the firm. Privacy Act guide.

  8. 8
    Notes

    A fee dispute with another firm, an ATO payment plan and a family member in aged care. Each sensitive on its own, and none needed for the extraction task the form was pasted for. APES 110 confidentiality guide.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in accounting firms. See how this works in practice: New client work on Ermos.

Common questions

Do ChatGPT and Claude use the information in a client onboarding form?
It depends on the plan behind the account. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The form is also sent to the AI company to be processed. This form holds a licence number, a date of birth and a tax file number.
Can we use ChatGPT or Claude for a client onboarding form if we remove the name?
No, because every other field on the form still points to the same person. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. The address, licence and card numbers, tax file number and bank account each identify the client. The notes add an ATO payment plan and a parent in aged care. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Does deleting the chat remove a client onboarding form from ChatGPT or Claude?
Not fully. Deleting a chat removes it from the user's history, but OpenAI and Anthropic each say they can keep a deleted chat on their systems for up to 30 days, and longer where safety or legal obligations apply (OpenAI, Anthropic). Both products also have memory features that can carry details from one conversation into later ones, and on a personal account each user decides whether they are switched on (ChatGPT, Claude). An onboarding form raises the stakes. A date of birth cannot be changed if it is ever exposed, and a compromised licence usually needs replacing.
How can an accounting practice use AI for a client onboarding form without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos drafts the client record from the completed form, using the practice's own client record template. An accountant checks each field against the identity documents and signs the file.
Is an onboarding form a notifiable data breach if it goes into ChatGPT?
Under the Notifiable Data Breaches scheme, a breach is notifiable where unauthorised disclosure of personal information is likely to result in serious harm. A form carrying a licence number, date of birth, TFN and bank account is the kind of disclosure that assessment exists for. Whether a particular paste meets the threshold depends on the tool's terms and the firm's assessment, which is work nobody wants to do after the fact.
We only pasted it to pull the fields into our practice software. Does that matter?
The purpose does not change what was transmitted. Extraction is a good task for AI; the question is where the extraction runs. On an Ermos unit the form is read on your own hardware and the fields go straight into your systems.
What should the AI policy say about onboarding forms?
That identity documents never enter any tool that sends data outside the practice, in those words, at the top of the policy. It is the one rule every staff member can remember at deadline.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in accounting firms AI for accountants APES 110 and AI All professions