How to keep client data private when using AI in an RIA

The safe way for an RIA to use AI on client data is to use a model deployment where your data is never used for training, where access is logged, and where the model runs in an environment your firm controls or contractually owns. Free ChatGPT does not meet this bar; properly installed enterprise deployments do.

What to ask any AI vendor

• Is my data used to train your models? (Answer must be no.)
• Where is the data stored, and who has access?
• Do you sign a Business Associate Agreement or equivalent data processing agreement?
• Can I delete all my data on demand?
• Is access logged and auditable?

Safe setups

• Enterprise model deployments (OpenAI Enterprise, Anthropic Claude for Work, Azure OpenAI) where data is contractually excluded from training.
• Private deployments where the model runs in your firm's cloud account.
• Custom-installed brains that route data through approved pipelines only.

Unsafe setups

• The free tier of ChatGPT, Gemini, or any consumer LLM.
• Browser extensions that send your data to unknown third parties.
• AI tools that don't publish a data processing agreement.

The install matters

When Quiet Machines installs an AI brain inside an advisory firm, every connection — email, CRM, documents — runs through a controlled, logged pipeline with a real data processing agreement. The principal can see exactly where every byte goes.