Financial advisors
AI for financial advisors, with client account data kept out.
Short answer
An advisory firm can use AI for review notes, client letters and meeting summaries if customer information does not reach the AI provider. Safe-Desk swaps account numbers, IBANs, balances, net worth figures and client names for placeholders before a message leaves, and gives the chief compliance officer a log of what was caught.
Updated September 24, 2026 · SOPHIA XT LLC
The risk
Advisors summarize reviews, write follow-up letters and prepare meeting notes. Those drafts carry account numbers, balances and names, which is customer information under Regulation S-P. An AI tool is a service provider as soon as that information reaches it.
The rules that apply
Regulation S-P, as amended in 2024. The SEC adopted amendments on May 16, 2024 (SEC press release; rule text at 17 CFR Part 248). Covered institutions, including SEC-registered investment advisers and broker-dealers, must have an incident response program, notify affected individuals of a breach of sensitive customer information, and oversee service providers, which must tell the firm of a breach affecting its customer information within 72 hours. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026.
GLBA. Regulation S-P implements the privacy and safeguards provisions of the Gramm-Leach-Bliley Act for SEC registrants. Advisers registered only with a state are generally outside Regulation S-P; ask your compliance counsel which federal and state rules apply to you.
Keeping customer information out of the AI provider means the AI provider never holds it, which keeps it out of your breach and service-provider analysis for that tool. Safe-Desk itself still handles the information in memory and belongs in your vendor oversight file.
How Safe-Desk works in an advisory firm
Staff keep using ChatGPT, Claude, Gemini, Copilot, Perplexity or DeepSeek. The Safe-Desk extension for Chrome and Edge, or the Safe-Desk Windows app for the ChatGPT, Claude and Copilot desktop apps, checks each message before it leaves. Client data becomes a placeholder such as [SSN_1], and only that version reaches the AI provider. When the answer comes back, the staff member who sent it sees the real values again; nobody else does. Passwords, keys and text marked privileged are stopped and sent nowhere. The owner gets a log of who sent what kind of data and which rule caught it, never the value itself, plus phone alerts and a monthly report. See how it works and the security page.
What the advisor template catches
Pick Financial advisors at sign-up. The owner can change names, places and dates to off, flag or protect, paste the client list, and add custom topics such as a pending transaction.
| What | What happens by default |
|---|---|
| Bank routing number | Swapped for a placeholder and reported to the owner. |
| Bank account number | Swapped for a placeholder and reported to the owner. |
| IBAN | Swapped for a placeholder and reported to the owner. |
| Employer ID number (EIN) | Swapped for a placeholder and reported to the owner. |
| Account balance or net worth | Swapped for a placeholder and reported to the owner. |
| Passport number | Swapped for a placeholder and reported to the owner. |
| Driver's license number | Swapped for a placeholder. |
| Private key | Stopped. Nothing is sent. |
| API key or access token | Stopped. Nothing is sent. |
| Login token | Stopped. Nothing is sent. |
| Password inside a link | Stopped. Nothing is sent. |
| Password or PIN | Stopped. Nothing is sent. |
| Payment card number | Swapped for a placeholder and reported to the owner. |
| ITIN (taxpayer number) | Swapped for a placeholder and reported to the owner. |
| Social Security number | Swapped for a placeholder and reported to the owner. |
| Privileged or work-product material | Stopped. Nothing is sent. |
| Date of birth | Swapped for a placeholder. |
| Email address | Swapped for a placeholder. |
| Phone number | Swapped for a placeholder. |
| Names on your client list | Swapped for a placeholder wherever they appear as written. |
| Other people's names, found from context | Swapped for a placeholder. |
| Addresses, found from context | Swapped for a placeholder. |
| Dates, found from context | Not checked, unless you turn it on. |
| Custom topics the owner adds (a matter, a deal, a code name) | Handled as the owner sets for each topic. |
Read from the Financial advisors and wealth management template in the product. In strict mode, messages with identifiers such as SSNs and account numbers are stopped instead of swapped.
A worked example
Your staff type
Summarize the review for client Robert Chen, account number 7788123456, balance $1,240,500, net worth about $3.1 million.
The AI sees
Summarize the review for client [NAME_1], account number [ACCOUNT_1], balance [BALANCE_1], net worth about [BALANCE_2].
The owner's log
Sep 24, 2026, 2:14 PM UTC: Front desk. The message was sent. Swapped out: Bank account number, 2 × Account balance or net worth, Person's name (detected).
The staff member reads the answer with the real values back in. The log names what kind of data was caught, never the values.
What it does not do
Safe-Desk does not make a firm compliant on its own and does not certify compliance. It has not been audited for SOC 2. It does not sign a Business Associate Agreement, so it is not for patient information. Names, addresses and dates are caught from your client list and from context; context detection is a best effort, because names have no checksum. Anything your firm sets to Flag is sent as written and reported to the owner.
Safe-Desk is not a books-and-records archive for your communications. Its log records what kind of data was caught and when, not the message.
Setup and price
Safe-Desk costs $19 per staff member a month, with a 14-day free trial. Each seat includes $5 of AI a month inside Safe-Desk, pooled across the firm, and AI beyond that is billed at the model's cost plus 30%. Using your own ChatGPT or Claude through the extension or the connector costs nothing extra. Optional setup: we set it up for $149 for up to 10 staff, $10 for each extra person.
Questions
Is an AI tool a service provider under amended Regulation S-P?
If it receives customer information, treat it as one: the amended rule requires oversight of service providers, including notice to you within 72 hours of a breach affecting your customer information. If the AI provider only ever receives placeholders for that information, it is not holding it.
What does the owner or CCO see?
A log line for each message that tripped a rule: who, when, the outcome and the rule names, such as "Bank account number". Never the values. The log is tamper-evident, and the monthly report prints its head hash so the firm holds a copy we can't change.
Does Safe-Desk keep client messages for recordkeeping?
No. Chat messages and AI answers are never stored. If your firm must archive AI-assisted communications, do that in your existing archive.
Related
- Is it safe to use ChatGPT with client data?What happens to what you type, business versus consumer plans, and the rules that apply.
- A ChatGPT and AI use policy for small firmsWhat the policy should say, and a one-page sample to copy.
- How Safe-Desk compares with the other ways to keep client data out of AIEnterprise DLP, browser-only extensions, private workspaces and banning AI, side by side.
- Security reviewArchitecture, storage and retention, encryption, tenancy and audit.
Try it at your firm.
Start free trialSee how it worksSafe-Desk costs $19 per staff member a month, with a 14-day free trial. Each seat includes $5 of AI a month inside Safe-Desk, pooled across the firm, and AI beyond that is billed at the model's cost plus 30%. Using your own ChatGPT or Claude through the extension or the connector costs nothing extra. Optional setup: we set it up for $149 for up to 10 staff, $10 for each extra person.