Payroll queries and AI data leakage: what an STP email gives away in ChatGPT or Claude.

Payroll correspondence is where AI confidentiality stops being about the client. A single query email about Single Touch Payroll can carry the names, tax file numbers, pay rates and superannuation funds of people who are not the firm’s client and have never dealt with it: the client’s employees. This page marks every item in a routine payroll email that the TFN Rule and the Privacy Act protect, and shows how the same email is drafted on Ermos without any of it leaving the practice.

The payroll query email

Sent to the client’s bookkeeper or office manager when an STP report fails validation or figures need correcting before the quarter closes.

To:
From:
Subject: STP corrections before 28 October

Hi Rachel,

The September STP submission was rejected. Three records need fixing before we re-lodge:

  1. : has a transposed digit in Xero. , which the ATO flags because no TFN declaration is on file.
  2. :
  3. :

Thanks,

An invented email. The TFN is the ATO’s published example value. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the firm

  1. 1
    The client’s staff member

    Named and attached to the client, so everything below is identifiable. Privacy Act guide.

  2. 2
    Three employees by name

    None of them is the firm’s client. Each is an individual whose personal information the firm holds only because it does the client’s payroll. Privacy Act guide.

  3. 3
    An employee’s tax file number

    The TFN Rule permits TFN information to be used or disclosed only for authorised tax, superannuation or personal assistance purposes, with access restricted to people who need it. A payroll fix is such a purpose; a frontier model provider is not such a person. Tax file numbers guide.

  4. 4
    Pay and withholding

    Director’s fees and the absence of withholding. Salary information is among the personal information people most expect to be kept private. Privacy Act guide.

  5. 5
    A pay error and back pay owed

    An underpayment, with the amount. Information the employee may not yet know, and which would matter in any dispute. Privacy Act guide.

  6. 6
    Superannuation fund and member number

    Fund membership details are financial identifiers. Combined with a name and date of commencement they are enough for a fraudulent rollover attempt. Privacy Act guide.

  7. 7
    A termination and a Fair Work claim

    That an employee has been dismissed and has lodged an unfair dismissal application. Highly sensitive to the employee and to the client, and now outside both. APES 110 confidentiality guide.

  8. 8
    Advice on a contractor arrangement

    The firm’s preliminary view that a planned arrangement would misclassify an employee. Advice under the TPB Code, transmitted before it was given. TPB Code guide.

  9. 9
    The staff member who sent it

    Ties the email to the firm and to a junior employee working under R113.2 supervision. Checking AI output guide.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in accounting firms. See how this works in practice: Client correspondence on Ermos.

Common questions

Do ChatGPT and Claude use the information in a payroll query email?
That depends on the plan the user is on. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The email is also sent to the AI company to be processed. This email names three employees and holds a tax file number and a dismissal dispute.
Can we use ChatGPT or Claude for a payroll query email if we remove the employees' names?
No, because the email still describes identifiable people without the employees' names. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A start date, a pay rate, a super fund with its member number and a termination date each point to a particular employee. The tax file number identifies one outright. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Does a ChatGPT Business or Claude Team plan make it safe to use for a payroll query email?
Only partly. A business plan gives the practice different terms and settings to review, and the email still reaches the AI company. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. That email would carry employees' pay rates, super member numbers and a dismissal dispute, and none of those employees agreed to it. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.
How can an accounting practice use AI for a payroll query email without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos drafts the email from the client's payroll records and the practice's own query template. A qualified accountant checks every name and figure and signs it off before it goes out.
The employees are not our clients. Do our obligations cover them?
Yes. The Privacy Act applies to personal information the firm holds, whoever it is about, and the TFN Rule applies to any TFN information the firm holds. APES 110 Subsection 114 covers information acquired in the course of professional and business relationships, which includes payroll data received to do the client's work.
Is an employee's TFN different from a client's?
No. The TFN Rule applies to all individuals' TFN information. Payroll files are where most TFNs in an accounting firm live, which makes payroll correspondence the most common way one ends up in a frontier model.
Does an Ermos unit handle payroll data?
It indexes the files you give it access to on your own network and answers from them, so payroll queries can be drafted from the client's records without the records leaving the practice. Who can see payroll files is set by the permissions you configure.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in accounting firms AI for accountants APES 110 and AI All professions