Broker complaint responses and AI confidentiality: what a reply to a client gives away in ChatGPT or Claude.

A complaint response from a brokerage has a deadline, a standard and an audience that includes AFCA. It must say what happened, what the brokerage found and what it will do, and it draws on the file notes, the call recording and the dates. That is the brief brokers give ChatGPT or Claude. It also carries the allegation, the chronology, the quoted recording and an admission of fault. This page marks every item in a routine complaint response that the National Consumer Credit Protection Act, ASIC’s RG 271 and the Privacy Act bear on, and shows how the same response is drafted on Ermos inside the brokerage.

The complaint response

Sent within 30 calendar days of receiving the complaint, which is the general maximum timeframe in ASIC’s RG 271.56. Section 47(1)(h) and (i) of the National Consumer Credit Protection Act require a credit licensee to have an internal dispute resolution procedure that meets ASIC’s requirements and to be a member of AFCA.

Harbour Ridge Finance Pty Ltd

Mr Daniel Whitlock and Mrs Sophie Whitlock¹
By email · 4 November 2026

Re: Your complaint of 29 October 2026

Dear Daniel and Sophie,

Thank you for your email. I have reviewed the file and the call recording, and I set out our response below.

Your complaint. You say that Anita lodged your application with Tamarind Bank without checking its overtime rules, that this put an unnecessary enquiry on both your credit files, and that the five-day delay meant you could not put in an offer on 9 Tarrant Close last weekend.²

What happened. We gave you our credit guide on 5 October. On 13 October Anita spoke with you for 38 minutes. She lodged with Tamarind Bank on 16 October. Tamarind declined on 20 October. Anita told you the same day and lodged with Southgate Bank on 21 October, and Southgate issued a conditional pre-approval on 26 October.³

The recording of the 13 October call shows that at 21 minutes 40 seconds Anita said, “I will check the policy for each lender before we lodge anything.”⁴

Our finding. We uphold your complaint in part. Anita did not confirm Tamarind’s rule with its business development manager before lodging, and she should have. She has apologised and I add mine. The enquiry on your credit files records a real application and cannot be removed, and Tamarind has told us its decision rested on its income policy. We do not accept that the delay cost you the property, because the contract has not been exchanged and the agent confirmed on 28 October that it remains available.⁵

What we are doing. We have charged you no fee and we received nothing from Tamarind. From 2 November we confirm each lender’s policy in writing before any lodgement. I have asked our compliance consultant to review your file, and I will phone you on Friday to go through it.⁶

As you asked, I enclose a copy of the preliminary assessment dated 21 October. You are entitled to a copy on request without charge.⁷

If you are not satisfied with this response you can take your complaint to the Australian Financial Complaints Authority at afca.org.au or on 1800 931 678. Time limits may apply.⁸

Elena Voss
Director, Harbour Ridge Finance Pty Ltd, ACL 000000⁹

An invented letter. The brokerage and its people are invented; the licence value is a placeholder. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the brokerage

The complainants

Two named clients, and the fact of a complaint. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Transmitted to the provider, generally offshore on personal plans
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The allegation

What the clients say went wrong, including a criticism of a named broker and a claim about a lost opportunity. Personal to the clients and the broker, and a dispute that may reach AFCA. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	An allegation against a named broker transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The chronology

Dates of the credit guide, the call, the lodgement, the decline and the pre-approval. The brokerage’s own account of the file, and the sequence it relies on. Section 113 requires the credit guide as soon as practicable once credit assistance is likely.

Frontier Models (ChatGPT, Claude)	Your account of the file transmitted before AFCA sees it
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A quote from the call recording

The broker’s own words, with a timestamp. The strongest evidence in the file and the sentence the complaint turns on.

Frontier Models (ChatGPT, Claude)	Your best evidence transmitted
Ermos Edge	Stays on your instance; quote the recording exactly, because a transcription tool can mishear
Ermos Dominion	Stays on the unit; quote the recording exactly, because a transcription tool can mishear

The finding and the apology

What the brokerage accepts and what it rejects, with reasons. RG 271.54 requires a response that rejects or partly rejects a complaint to set out reasons and the findings on material questions of fact.

Frontier Models (ChatGPT, Claude)	Your defence and your concession transmitted; on consumer tiers they can train future models
Ermos Edge	Stays on your instance; the finding is the director’s judgement to make and sign
Ermos Dominion	Stays on the unit in your office

The remedy and the process change

What the brokerage will do, including that it received nothing from the other lender. The brokerage’s position, written down.

Frontier Models (ChatGPT, Claude)	Your offer and process change transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The preliminary assessment

A copy of the assessment sent on request. Section 120 requires a copy to be given without charge, within 7 business days of a request made within 2 years of the quote. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	The clients’ assessment transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

8
The AFCA wording
The statement of the right to take the complaint to AFCA, with contact details. RG 271.53 requires an IDR response to inform the complainant of the final outcome, their right to go to AFCA and AFCA’s contact details.
9
The signatory
The director who owns the response, with a licence number from the public register.

Frontier Models (ChatGPT, Claude)	Standard wording the brokerage must include; no client data in it
Ermos Edge	Nothing client-specific to keep in
Ermos Dominion	Nothing client-specific to keep in

Frontier Models (ChatGPT, Claude)	Public register details
Ermos Edge	The director’s own sign-off; nothing for Ermos to change
Ermos Dominion	The director’s own sign-off; nothing for Ermos to change

What happens in Frontier Models (ChatGPT, Claude)

The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
On consumer tiers, prompts can be retained and used to train future models.
The provider’s staff and systems can reach the content under the provider’s own policies.
Once sent, the brokerage no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

	Frontier Models (ChatGPT, Claude)	Ermos Edge	Ermos Dominion
Where the document is processed	Provider servers, generally offshore on personal plans	Your instance in an Australian data centre; answers generated in Australia	The unit in your office
Who can read it	Provider staff and systems, under policy	Your staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothing	Your staff only
Is it kept	On the provider’s terms	Kept on your instance; the provider is barred from retaining it	Stays on the unit
Can it train a model	On consumer tiers, yes	No, by contract	Only your own unit learns from it, on your hardware

Part of AI data leakage in mortgage brokerages. See how this works in practice: Documentation best practice on Ermos.

Common questions

Do ChatGPT and Claude use the information in a complaint response?

A pasted draft goes to the AI company's servers and is processed there to produce a reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The letter names the complainants, sets out the chronology, quotes the broker from the call recording and records what the brokerage accepts and rejects.

Is it safe to paste a complaint response into ChatGPT or Claude?

No, because a complaint response is the brokerage's own account of a dispute that may reach AFCA. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. It sets out the clients' allegation against a named broker, the dated chronology, the partial finding and the remedy. Taking out the names does not hide the call quote or the Tarrant Close purchase. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised.

Does a ChatGPT Business or Claude Team plan make it safe for a complaint response?

Not on its own. A business plan changes the default on training, but it does not change who receives the content. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. A complaint response would reach the AI company with the finding, the apology and the quote from the recording before the clients have received it. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.

How can a mortgage brokerage use AI for a complaint response without sending it to ChatGPT or Claude?

Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The response is drafted from the complaint, the client file and the brokerage's own response template. The director checks the findings and the AFCA wording and signs it.

How long does a brokerage have to respond to a complaint?

ASIC's RG 271.56 sets the general maximum at 30 calendar days after receiving the complaint, with different timeframes for some categories such as certain credit hardship complaints and exceptions in specific circumstances. The response must tell the complainant the final outcome, their right to go to AFCA and AFCA's contact details. This is the version of RG 271 dated 2 September 2021.

What must a response say if it rejects part of a complaint?

RG 271.54 says it must set out clear reasons by identifying and addressing the issues raised, giving the findings on material questions of fact and the information that supports them, and giving enough detail for the complainant to decide whether to go to AFCA. The detail should reflect the complexity of the complaint.

Does a licensee have to keep a record of complaints?

RG 271.179 says all complaints received must be recorded in an effective system that tracks the progress of each. Section 47(1)(h) and (i) of the National Consumer Credit Protection Act require an internal dispute resolution procedure and AFCA membership. The complaint file is the licensee's record, wherever the draft is written.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo

Keep reading

AI data leakage in mortgage brokerages AI for mortgage brokers The Privacy Act, the APPs and AI All professions