Complaint responses and AI confidentiality: what a reply to a client gives away in ChatGPT or Claude.

A complaint response is written under the internal dispute resolution rules in ASIC RG 271, with a deadline, and with the knowledge that AFCA may read it next. It has to be accurate, fair and complete, which is the brief advisers give ChatGPT or Claude. It also carries the whole story: the allegation, the advice, the file notes that support the practice’s position, and what the practice is prepared to offer. This page marks every item in a complaint response that the Code of Ethics and the Privacy Act protect, and shows how the same response is drafted on Ermos inside the practice.

The complaint response

Sent within the timeframe RG 271 requires after a client complains, and provided to AFCA if the complaint is escalated.

Harbourview Wealth Partners

Mr Tom Harrington¹
By email

Re: Your complaint of 3 November 2026

Dear Tom,

Thank you for your email. I have reviewed the file with our compliance manager and set out our response below.

Your complaint. You say that we should have advised you to sell the Tesla shares before the recent fall, that the loss of approximately $13,000 is the result of our advice, and that I discussed your financial affairs with Lucy without your knowledge.²

The share holding. Our Statement of Advice of 24 October 2025 recommended selling the holding. Our review file note of 21 October 2026 and the Record of Advice of 23 October 2026 record that you and Lucy decided to retain it against our advice, and that you confirmed you understood our view. Copies are enclosed. On that basis we do not accept that the loss resulted from our advice.³

Discussions with Lucy. You and Lucy are joint clients, and our engagement authorises us to discuss your joint affairs with either of you. Our records show that Lucy asked for a referral to an estate lawyer and asked that you not be copied on that referral. We provided the referral to Lucy only. We did not discuss your employment or any other matter with her beyond what was discussed in joint meetings.⁴

What we are prepared to do. We do not consider that compensation is warranted. In recognition of the distress involved, and without admission, we are prepared to waive the ongoing advice fee for the December quarter ($1,100). We also propose a meeting with you alone, if you would prefer, to discuss how we manage joint and individual instructions going forward.⁵

If you are not satisfied with this response you may refer your complaint to the Australian Financial Complaints Authority at afca.org.au or on 1800 931 678. Our compliance manager, Rohan Mistry, reviewed this response with me and can be contacted through our office.⁶

Nadia Reyes⁷
Senior Adviser⁷

An invented letter. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

The complainant

A named client, and the fact of a complaint. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Transmitted to the provider, generally offshore on personal plans
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The allegation

What the client says went wrong, including an allegation about the adviser’s conduct. Personal to the client and to the adviser, and a dispute that may reach AFCA. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	An allegation against a named adviser transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The advice history and the file notes relied on

The practice’s defence, with the documents it rests on. The records Standard 8 exists to keep, deployed in a dispute, and now on a third party’s servers before AFCA has seen them.

Frontier Models (ChatGPT, Claude)	Your defence and its evidence transmitted before AFCA sees them; on consumer tiers they can train future models
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The joint-client question and the private referral

How the practice handled one spouse’s private request, explained to the other. A confidence, necessarily disclosed, which should go only to the complainant. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	A spouse’s confidence transmitted in the course of explaining it
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The offer

What the practice will concede and what it will not. The negotiating position in a dispute, written down.

Frontier Models (ChatGPT, Claude)	The negotiating position transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The escalation path and a named compliance manager

AFCA details and a named person at the licensee. Operational, and identifying. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Transmitted and kept on the provider’s terms
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The adviser

The subject of one of the allegations, named.

Frontier Models (ChatGPT, Claude)	Transmitted, and the leak is traceable to you
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

What happens in Frontier Models (ChatGPT, Claude)

The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
On consumer tiers, prompts can be retained and used to train future models.
The provider’s staff and systems can reach the content under the provider’s own policies.
Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

	Frontier Models (ChatGPT, Claude)	Ermos Edge	Ermos Dominion
Where the document is processed	Provider servers, generally offshore on personal plans	Your instance in an Australian data centre; answers generated in Australia	The unit in your office
Who can read it	Provider staff and systems, under policy	Your staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothing	Your staff only
Is it kept	On the provider’s terms	Kept on your instance; the provider is barred from retaining it	Stays on the unit
Can it train a model	On consumer tiers, yes	No, by contract	Only your own unit learns from it, on your hardware

Part of AI data leakage in financial advice practices. See how this works in practice: Client correspondence on Ermos.

Common questions

Do ChatGPT and Claude use the information in a complaint response?

Yes, the response is sent to the AI company's servers and processed there. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. It sets out the allegation against a named adviser, the file notes relied on and the offer.

Is it safe to paste a complaint response into ChatGPT or Claude?

No, because a complaint response holds a client's private affairs and the practice's whole defence in one letter. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. It names the complainant and the adviser, explains how one spouse's private referral was handled, and states what the practice will offer. Editing out the names leaves a dispute that anyone who knows the matter could recognise.

Does a ChatGPT Business or Claude Team plan make it safe to use for a complaint response?

Only partly. A business plan changes the default on training, yet the response still goes to the same company. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. For a complaint response, the AI company would receive the allegation, the file notes relied on and the offer before the complainant or AFCA has seen the final letter. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.

How can an advice practice use AI for a complaint response without sending it to ChatGPT or Claude?

Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The response is drafted from the Statement of Advice, the Record of Advice, the file notes and the engagement terms. The adviser and the compliance manager check its chronology against those documents before signing.

AFCA will see the letter anyway. Why does the draft matter?

AFCA is the body the law provides for, bound by its own rules in how it handles the file. A frontier model provider is a company with servers, for the major ones outside Australia, retaining the draft on its own terms. The complainant, his wife and the adviser are all identified in it, and so is the practice's defence.

Does RG 271 say anything about how the response is prepared?

RG 271 sets the standards and timeframes for internal dispute resolution and requires responses to be fair and to address the complaint. It says nothing about drafting tools. What it does require is a record of the complaint and the response, which is the practice's to keep and control.

How is a complaint response drafted on Ermos?

From the SOA, the ROA, the file notes and the engagement terms on your own unit, with a chronology the adviser and the compliance manager check against the documents it cites. Nothing in the file leaves the practice to produce it.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo

Keep reading

AI data leakage in financial advice practices AI for financial advisers The Privacy Act, the APPs and AI All professions