How to use AI with confidential client data
For accountants, lawyers, HR teams and anyone else who holds other people's information and wants AI help with it.
Short answer
Choose one of three setups and write the choice down: a business AI plan whose terms exclude training and set retention, a model that runs on your own machine so nothing is uploaded, or redaction before anything leaves your network. For the most sensitive files, run the model locally. Whichever you choose, check your professional rules and client contracts first.
What happens when you paste a client file into a chatbot
The text goes to the provider's servers, is processed there, and is normally stored for a period. Whether it is also used to improve future models depends on the plan:
- ChatGPT Free, Plus and Pro use conversations for training by default; you can switch that off under Settings → Data Controls.
- ChatGPT Business and Enterprise do not train on business data by default.
- Microsoft 365 Copilot does not use prompts, responses or the Microsoft Graph data it reads to train foundation models, and processes them inside the Microsoft 365 service boundary.
- API access to the major providers is generally excluded from training by default under their commercial terms.
Training is not the only question. Data can be retained for abuse monitoring, handled by subprocessors, reached by legal requests, or exposed through a compromised account. The most common leak is simpler: a colleague pasting a client file into a personal account because it was quicker.
Three setups that work
| Setup | Data leaves your machine? | Trains on your data? | Good for | Watch out for |
|---|---|---|---|---|
| Business cloud plan | Yes, to the provider under contract | No, by default | Drafting and summarising with the strongest models; teams already on Microsoft 365 | Retention settings, the data processing agreement, where data is stored, personal accounts |
| Local model | No | No | The most confidential files; work offline | Smaller models are less capable; you need the hardware and you own the updates |
| Redact, then send | Yes, the redacted text | Depends on the plan | When a task needs a frontier model | Redaction misses things — names in file paths, account numbers in footers — and context can re-identify people |
Most offices end up with two of these: a business plan for general work, and a local model for anything covered by confidentiality duties. What matters is that the rule is written down and everyone uses the same accounts.
A checklist before you start
- Read your professional rules. Accountants, lawyers and HR professionals owe duties of confidentiality that do not change because a tool is new. Your engagement letters may also restrict where client data can go.
- If you handle personal data of people in the EU or UK, apply data protection law. You need a lawful basis, a processor agreement with any cloud provider, safeguards for transfers outside the region, and to send no more than the task needs.
- Classify what you hold — public, internal, confidential, special-category — and decide which setup each class may use.
- Use company accounts only. Switch training off where it is an option and set the shortest retention that works.
- Keep a record of which data went to which provider and model, and when.
- Review it every six months. Plans, terms and defaults change.
This is practical guidance, not legal advice. If you are unsure whether a setup meets your obligations, ask your professional body or a data protection adviser.
Where OpenClerq fits
OpenClerq is built for the second setup, and makes the first one auditable.
- It runs on your Mac or PC. The gateway listens on 127.0.0.1 only and every endpoint except the health check needs a bearer token. Its files under
~/.clerqare readable only by your user account, and the secrets vault key is kept in the operating system's keychain. - Choose a local model through Ollama or LM Studio and prompts never leave the machine. Or use one of six cloud providers under your own API key for the tasks where you have decided that is acceptable.
- See before you send. Context preview shows the exact text that would go to the model without calling it, and a dry run shows the steps without calling anything.
- A record of what went where. Every model call is recorded against its run with the provider, model and token counts.
Limits today
OpenClerq reads plain-text files of up to 1 MiB from one folder you choose; it does not yet read PDFs or scans, and it has no built-in redaction. It is 0.5 software, supplied without warranty — read its security notes before relying on it.
Frequently asked questions
Is it safe to put client data into ChatGPT?
On a consumer plan with default settings, conversations can be used for training and are stored by OpenAI. Business and Enterprise plans exclude training by default and add admin controls. Whether that is acceptable depends on your professional rules and client agreements; for the most sensitive material, a local model avoids the question entirely.
Does a local AI model send anything to the internet?
Running the model does not need a connection. The app around it may check for updates or download models, so check its settings. In OpenClerq, when the provider is Ollama or LM Studio, model calls go to localhost.
Is using AI on client data compatible with GDPR?
It can be. You need a lawful basis, a processor agreement with any cloud provider, safeguards for international transfers and data minimisation. Processing on your own machine removes the third-party processor for the AI step, but your other obligations as controller stay the same. This is not legal advice.
Does Microsoft 365 Copilot keep data inside our tenant?
Microsoft says Copilot processes prompts and the data it retrieves inside the Microsoft 365 service boundary and does not use them to train foundation models. It is still a cloud service; it does not run on your own machine.