How do I keep client financial data safe when using AI tools?
Client financial data is some of the most sensitive data a business holds. AI use needs rules first.
- Can staff paste client data into ChatGPT?
- Which AI tools are safe?
- Where is our data stored?
Write a short AI policy, approve specific business-grade tools with clear terms on training, retention and data location, decide what client data may go into each, limit access by role and train staff. PIPEDA applies to personal information in most provinces, with similar laws in Alberta, BC and Quebec. Never put SINs, credentials or full returns into tools not approved for them.
Data rules
| Data | Approved AI tools? |
|---|---|
| Public information, firm marketing | Yes |
| Anonymized questions | Yes |
| Client names and contact details | Only tools approved for client data |
| Returns, statements, slips | Only tools approved and contracted for this |
| SINs, passwords, banking credentials | Never |
Check vendors
Ask where data is stored, whether it's used for training, how long it's kept, who can access it and how to delete it. Canadian data hosting matters to some clients.
How we look at it at ShoutEx
We design automations that keep sensitive data in approved systems and document data flows so you can answer client questions about your AI use.
- Personal AI accounts for client work.
- No written AI policy.
- SINs or credentials in AI tools.
- Vendors that won't explain data use.
- An approved tool list.
- Clear data classification.
- Role-based access.
- Staff training each year.
What accountants and regulators say
Here is what regulators say.
PIPEDA's ten principles, including consent, limiting use and safeguards, apply to client information. Alberta, BC and Quebec have similar laws.
Read PIPEDA in brief →CPAs should check that third-party AI tools meet legal, regulatory and governance requirements.
Read the guidance →The principles call for limiting personal information and openness when using generative AI.
Read the principles →Community summaries describe recurring themes in public threads, not individual posts. Vendor pages describe vendor claims, so test them on your own calls.
Read next
Go deeper in the ShoutEx guides, or check the sources behind this answer.
We'll design automations that keep sensitive data where it belongs.
Book a call →Follow-up questions
Is cloud practice software safe?
Reputable vendors invest heavily in security. Check their certifications and data location.
Do US clients change anything?
US clients may bring state privacy laws and IRS rules for preparers. Treat them separately.
Should we run AI privately?
Some firms use private deployments for sensitive work. They cost more to run.