Commission and clawback spreadsheets and AI data leakage: what a broker’s revenue sheet gives away in ChatGPT or Claude.

The commission and clawback spreadsheet is how a brokerage tracks what it is owed: upfront commission by loan, trail by month, the date each clawback period ends and the invoices when a client refinances away. It lists every client with a loan amount and a lender, so it is the brokerage’s book of business and its commercial terms in one file. Brokers upload it to ChatGPT or Claude to reconcile payments and to forecast trail. This page marks every cell in a routine commission and clawback sheet that the National Consumer Credit Protection Act, its Regulations and the Privacy Act bear on, and shows how the same sheet is handled on Ermos inside the brokerage.

The commission and clawback spreadsheet

Maintained monthly from lender and aggregator remuneration statements. Regulation 28VG of the National Consumer Credit Protection Regulations sets the clawback requirements a benefit with a repayment obligation must meet to fall within regulation 28VB(3), so that it is not conflicted remuneration: the repayment obligation lasts no more than two years, requires no more than the benefit and does not make the consumer liable.

fx=SUM(E2:E8)
ABCDEFGH
1ClientLenderLoan ($)SettledUpfrontTrail p.a.Clawback toStatus
214 Aug 2026Settled
3Wang, L & HSouthgate Bank745,0009 Jun 20260.65% = 4,8430.15% = 1,1189 Jun 2028Settled
4Brennan, KTamarind Bank480,00022 Sep 20260.70% = 3,3600.20% = 96022 Sep 2028Settled
5Adeyemi, T & FSouthgate Bank1,020,00030 Jul 20260.65% = 6,6300.15% = 1,53030 Jul 2028Settled
6Castellano, MOrrin Building Society390,0003 Mar 20260.60% = 2,3400.15% = 5853 Mar 2027 (12 mo)Settled
7Southgate Bank520,00011 Mar 20260.65% = 3,380Ended11 Mar 2028
8Southgate Bank868,000Pre-approved0.65% = 5,6420.15% = 1,302Settlement + 24 moSettlement expected Dec 2026
9Total before clawback4,635,00029,8676,413
10Rule
CommissionTrailClawbacks

An invented commission and clawback sheet. The clients, lenders and rates are invented. Hover or tap any highlighted cell for the analysis; the full list is below.

What leaves the brokerage

  1. 1
    Client names

    Every client with a loan, in one column. The brokerage’s book of business, and personal information about each person in it. Privacy Act guide.

  2. 2
    Lenders by client

    Which bank holds which client’s loan. A map of each household’s credit relationships. Privacy Act guide.

  3. 3
    Loan amounts

    What each client borrowed. Financial information about each person on the list. Privacy Act guide.

  4. 4
    Upfront commission rates

    What each lender pays the brokerage. Commercial terms, which the brokerage may hold under confidentiality in its aggregator or lender agreements; check yours. Section 113 requires the credit guide to give a reasonable estimate of the amounts or range of indirect remuneration and the method for working them out.

  5. 5
    Trail commission

    Ongoing payments by loan. Regulation 28VC’s drawdown cap applies to benefits given in the first year after drawdown, so trail paid after that year is outside the cap, though still subject to the other conditions in regulation 28VB(3).

  6. 6
    Clawback dates

    When a lender can recover commission if a client leaves or repays early. Where a benefit carries a repayment obligation, regulation 28VG limits it to two years from first drawdown, as one of the conditions in regulation 28VB(3) for the benefit not to count as conflicted remuneration under the ban in section 158NB.

  7. 7
    A client who refinanced away, and the clawback invoice

    A named client who left within the clawback period and the amount recovered, limited by regulation 28VG to no more than the benefit paid. Reveals that a client refinanced elsewhere. Privacy Act guide.

  8. 8
    A live deal and its expected settlement

    A pre-approved client with an expected settlement month and the commission it will earn. A deal in progress. Privacy Act guide.

  9. 9
    Totals and the forecast

    The brokerage’s expected upfront and trail revenue. Commercial information, and a number that must be reconciled to lender statements by a person.

  10. 10
    The rule behind the dates

    A date formula and a policy statement. No client data.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the brokerage no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in mortgage brokerages.

Common questions

Do ChatGPT and Claude use the information in a commission and clawback spreadsheet?
Whatever is pasted or uploaded from the sheet goes to the AI company's servers and is processed there to produce a reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The sheet lists every client with a loan, the lender, the loan amount, the commission rates and the date a lender can recover commission.
Is it safe to paste a commission and clawback spreadsheet into ChatGPT or Claude?
No, because the sheet puts the brokerage's whole book in one place. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. Each row ties a named client to a lender and a loan amount, and one row shows a client who refinanced away and the clawback invoice that followed. The commission rates may also be confidential under the brokerage's aggregator or lender agreements, so check yours.
Can I upload a commission and clawback spreadsheet to ChatGPT or Claude instead of pasting it?
An uploaded spreadsheet leaves the brokerage as a whole file, which can carry other sheets, hidden columns, comments, tracked changes and file properties as well as the part you meant to share. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. Here the Commission, Trail and Clawbacks tabs, with their formulas and the live deal for a pre-approved client, would all travel together.
How can a mortgage brokerage use AI for a commission and clawback spreadsheet without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Questions about the book are answered from the brokerage's own records. A person reconciles every total and forecast to the lender statements before relying on it.
What are the clawback rules for broker commission?
Regulation 28VG sets the clawback requirements that apply, where a benefit carries a repayment obligation, for it not to count as conflicted remuneration under regulation 28VB(3). The repayment obligation must not apply for more than two years after first drawdown, must not require repayment of more than the benefit, and must not make the consumer liable to pay anything as a result. Lender agreements can set shorter periods.
What must the credit guide say about commission?
Section 113(2)(g) requires it to give information about any indirect remuneration the licensee, or an employee, director or credit representative, is likely to receive from credit providers on contracts for which it provided credit assistance, a reasonable estimate of the amounts or range, and the method for working them out. It must be in writing and given as soon as practicable once credit assistance is likely.
What kinds of commission does the conflicted remuneration regime single out?
The regulations say a monetary benefit given to a broker is not conflicted remuneration if, among other conditions, it is not a volume-based benefit or a campaign-based benefit. Volume-based benefits depend on the total amount or number of loans. Campaign-based benefits depend on the loan being written within a limited period, and are either not ordinarily available outside it or worth more than usual. Section 158N defines conflicted remuneration.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in mortgage brokerages AI for mortgage brokers The Privacy Act, the APPs and AI All professions