Using AI on financial documents without exposing who they belong to.
Before AI reads a financial document, establish what the model receives, which services retain it, who can access the original and who confirms the extracted fields. Confidentiality is a data-flow property, not a generic “private AI” label.
Written by the Fundamental View editorial team. Updated 28 October 2026. This operational guide is not legal advice. External sources below discuss governance and risk; they do not endorse Fundamental View.
What is actually at risk
A financial document contains operational data and identifiers. Amounts, dates, currencies and line structure may be needed for recognition. Names, account numbers, addresses, tax references and the relationship between a family and its assets can reveal far more than the transaction itself. Risk also lives in prompts, output logs, embedded metadata and access to the original file—not only in model training.
Masking selected fields reduces exposure but does not prove anonymity. A combination of uncommon amounts, dates, counterparties or document layout may permit re-identification. The review therefore needs to cover the complete workflow and the document context.
A vendor-diligence table you can save
| Question | Evidence to request | Failure mode to test |
|---|---|---|
| What does the model receive? | Data-flow diagram and an example redacted input | Identifiers survive in metadata, images or rare combinations of fields |
| Which providers touch the data? | Model, hosting and subprocessor list with regions | An undisclosed service receives originals or logs |
| Is content used for training? | Current provider terms for the exact product and configuration | A consumer-default setting is assumed to be an enterprise control |
| What is retained and for how long? | Retention and deletion terms for inputs, outputs and logs | The document is deleted but derived logs remain |
| Who can access originals? | Role model, access review and audit events | Vendor support or a broad shared folder bypasses the intended boundary |
| Who confirms extracted fields? | Review queue, correction path and audit trail | Low-confidence recognition is saved without human review |
| How do you exit? | Export and deletion procedure covering records and evidence | Export separates extracted rows from their source documents |
Six controls to test, not just read about
- Minimise before processing. Remove or mask identifiers before the model sees the document, then inspect the actual payload rather than trusting a diagram.
- Keep originals under controlled ownership. Establish where originals and confirmed records reside, how access is granted and how it is removed.
- Use human confirmation. A person should confirm fields before they enter the register, with a manual path for failure and correction.
- Log operational events. Agree which access, submission, confirmation and deletion events are recorded without creating an unnecessary second store of sensitive content.
- Classify permitted use cases. Define which documents may be processed, which require redaction and which must never enter an external AI workflow.
- Test deletion and exit. Verify what happens to originals, extracted records, prompts, outputs and service logs at the end of the engagement.
Three failure modes a polished demo can miss
Re-identification after masking
Removing a family name may not remove identity. A distinctive property, exact transaction amount and date can still identify the parties. Test whether the remaining context needs to be processed at all and whether access to the redacted output is appropriately limited.
Identifiers outside the visible text
A PDF can contain hidden text, annotations, attachments or metadata. An image-only redaction may leave underlying content recoverable. The implementation should define conversion and inspection steps rather than assuming that a black rectangle equals deletion.
A safe model inside an unsafe workspace
Strong provider terms do not repair a shared folder with excessive access. Review original-file permissions, downloads, shared links, administrator roles and offboarding as part of the same control environment.
Questions to put to your own team
- Which document classes are permitted, and who owns that decision?
- Who may submit documents, see originals and confirm recognised fields?
- What legal, contractual or fiduciary duties apply across the relevant jurisdictions?
- Which outputs require qualified accounting, tax, legal or investment review before action?
- How are prompts and AI-assisted outputs treated in retention, litigation and access policies?
How Fundamental View handles the workflow
Fundamental View anonymises documents before AI reads them: names, account numbers and other identifiers are masked, and the recognition model receives figures, dates and structure rather than the direct identifiers. It proposes fields; a person confirms each one before it is saved. The register and evidence live in the client's own Google Workspace. Fundamental View does not hold the records, move money or ask for banking credentials. The full list of services involved, with regions, is to be provided before implementation.
These statements describe the intended operational boundary, not a certification or a guarantee against every re-identification or security risk. The specific provider terms, configuration and client responsibilities still require review.
External governance reading
- J.P. Morgan recommends clear rules for information that must not be shared and highlights the potential discoverability of AI inputs. J.P. Morgan Private Bank, checked 28 October 2026.
- PwC discusses risk tiering, privacy-by-design, access governance and human oversight for consequential AI outputs. PwC, responsible AI in family offices, checked 28 October 2026.
- Citi Institute describes data minimisation, controlled environments, access controls and human decision-making. Citi Institute, AI in the Family Office, checked 28 October 2026.
Related implementation guides
- Map data handling and implementation responsibilities
- Follow a document into a reviewed record
- Define confirmation and exception states
- Include AI controls in software selection
Download the blank AI vendor-diligence checklist as CSV. Complete it with written evidence for the exact proposed configuration.
Discuss your workflow
Describe the record-keeping problem you want to solve. Please do not include confidential financial information or documents in the enquiry.
Discuss implementation