AI data leakage in conveyancing: what leaves when matter files go into ChatGPT or Claude.

A conveyancing file holds a buyer’s identity documents, loan limit, bank details and the date the money moves, and often the reason they are moving. In NSW the records for each transaction go in their own file and are kept for at least seven years, and keeping client information confidential is among the rules of conduct in Schedule 2 of the Conveyancers Licensing Regulation. Since 1 July 2026 conveyancers who assist with selling, buying or transferring real estate also have AML/CTF obligations, and the Privacy Act applies to the personal information handled for them even in a small practice. This series takes ten documents a practice produces, marks every item it has to protect, and shows where each goes when it is pasted into ChatGPT or Claude.

The documents, one at a time

Report or memoThe contract review report

Names, price, finance limits, strata findings, the vendor’s circumstances and the advice. The first thing a buyer pays for.

See what leaves → FormThe verification of identity form

Names, dates of birth, passport and licence numbers, addresses, the check performed and where the money comes from.

See what leaves → SpreadsheetThe settlement adjustments spreadsheet

Every dollar that moves at settlement, the lender, the payout figure and the vendor’s account, in one grid.

See what leaves → EmailThe payment instructions email

The amount, the date, the trust account and the sentence that is meant to protect the client from a fake.

See what leaves → SpreadsheetThe trust account reconciliation spreadsheet

Several clients’ names, matters and balances, the trust bank account and the notes that explain why money is still held.

See what leaves → RecordThe title search summary

The owner, the lender, a death notation, the last sale price and the practice’s own note about the vendor.

See what leaves → TranscriptThe client intake call transcript

Everything the client said in confidence: finance, a family gift, a pregnancy, employment and the fee quoted.

See what leaves → LetterThe mortgage discharge letter

The lender, the payout figure, the vendor’s bank account and a request to send the proceeds somewhere else.

See what leaves → Text or chat messageThe buyer and seller chat messages

An alarm code, a bereavement, a pregnancy and a late request to send the proceeds to someone else’s account.

See what leaves → LetterThe complaint response

The client’s grievance, the staff member who erred, the refund and what the practice is changing.

See what leaves →

How the leakage happens

The mechanism is the same for every document. The whole text is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia. On consumer tiers it can be retained and used to train future models. The provider’s staff and systems can reach it under the provider’s own policies. Once sent, the practice no longer controls it. Our on-premise vs cloud comparison sets out the four ways to run AI and where each one puts your documents.

The obligations in play

Each marked item on these pages links to the guide that covers its obligation:

The same documents on Ermos

Ermos Dominion drafts and searches on a unit in your office, so the documents never leave it. Ermos Edge keeps your documents on your own instance in an Australian data centre and sends only permitted excerpts, per question, to a named Australian provider. Every page in this series ends with both, item by item.

Common questions

Can conveyancers use ChatGPT or Claude with client information?
The practice's own duties still apply the moment client information goes into either tool. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. NSW Government guidance lists keeping client information confidential among the rules of conduct in Schedule 2 of the Conveyancers Licensing Regulation. Records for each transaction must also sit in a separate file the licensee keeps for at least seven years. From 1 July 2026 AML/CTF obligations apply to conveyancers who assist in a sale, purchase or transfer of real estate, and the OAIC says the Privacy Act covers personal information handled for them even in a small business.
Do ChatGPT and Claude train on what staff paste in?
It depends on the account each person is using. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. For a conveyancing practice the question matters because a single paste can carry a buyer's identity documents, loan limit, bank details and the date the money moves.
Do business plans such as ChatGPT Business or Claude Team solve the problem for conveyancers?
Only in part. A business plan changes the default on training, but it does not change who receives the content. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. For a conveyancing practice, the contract, the settlement sheet or the payment email would still reach the AI company in full. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.
What is the safest way for a conveyancing practice to use AI with client documents?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. For a conveyancer, staying in control means the matter file stays where the practice can see it, and a licensed conveyancer checks every draft before it goes to the client.
What is AI data leakage in a conveyancing practice?
Client and transaction information leaving the practice's control through an AI tool. When a contract, settlement sheet or email is pasted into ChatGPT or Claude it is transmitted to the provider's servers, can be retained on the provider's terms, and can be used to train future models on consumer tiers. For a conveyancer the leaked detail is who is buying what, for how much, with which bank, and when the money moves.
Which conveyancing documents carry the most risk?
The ones that carry money and identity together: the payment instruction email, the settlement adjustments sheet, the verification of identity form and the trust ledger. Together they show the amount, the account, the date and the person. The contract review report and the intake call carry the personal circumstances. The pages in this series take each in turn.
Do the 2026 AML/CTF changes affect a conveyancing practice?
From 1 July 2026 conveyancers who assist in planning or executing a transaction to sell, buy or transfer real estate are newly regulated, and AUSTRAC says they must have an AML/CTF program in place before they do. The OAIC says the Privacy Act applies to personal information handled for those obligations even in a small business, so a practice under the $3 million turnover threshold should check its position.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
Resources The Privacy Act, the APPs and AI All professions