An AI agency owner breaks down six safety mechanisms for using Claude with client financial data: SOC 2 certification, folder permissions, prompt-injection defenses, admin controls, zero-data-retention contracts, and audit logs. He argues the benefits outweigh residual risks for accounting firms.
Chapters
Is AI secure enough for clients' sensitive data? Accounting firms' owners have asked me this question more times than I can count, and the answer is yes and no. Stick with me and you'll have the answer for good at the end of this video, or at least for now. Quick disclaimer, I'm not a security professional, but as the owner of an AI and automation agency, I've been forced to answer this question many, many, many times. And what I've learned is that there's really 2 answers, and both need to be addressed. There's an emotional side and there's a logical side. The truth is, like, every technology has gone through a transition of being adopted and being questioned in that process. If you look back at when computers came up, I'm sure a lot of people say, nope, I'm gonna stick with my paper, and did for as long as they could. In the same way, when cloud software came out, a lot of people, no, I'm gonna stay with my local files, and probably some people have stayed that way. And now we're going through the same transition with AI. It is the same fear. The truth is, like, in the past, we've always adapted, and I don't think AI is gonna be different. Are there unique risks? Yes, of course they are. We'll talk how to address some of them, but they can be mitigated. And my experience is that the longer a firm has been actively using AI, the less they hesitate to use it with sensitive client data. Many of the firms we work with have been doing it for months or years already, and hesitation in my experience is more tied to not being exposed enough than to actual risk. And here's how I know. When I ask someone that's afraid or, or not fearful of using AI for for client data, I ask them, why aren't you comfortable? Well, what do you think their answer is? They can't tell. So for most firm owners, there is the rationale, the resistance, more emotional than logical. It's more of the fear of the unknown. And for me, the cure for that, it's just exposure as opposed to avoidance, for you to get a little bit more comfortable over time. Now, comfort alone isn't enough. So let me give you the actual technical reasons I myself am personally comfortable putting client data in and recommend some of our clients The first is the SOC 2 Type 2 certification that Claude and many of the other AI models have. Now, for the rest of this video, I'm going to assume that you're using either Claude, ChatGPT, or Copilot. All of them have SOC 2 Type 2 certifications. That's the same standard that governs applications like Google Workspace or Microsoft 365 or HubSpot or Slack. This is an independently verifiable audit that has been done on the security best practices of this company. If you trust your books in QuickBooks, if you trust your messages in Slack, if you trust your emails in Google, you're already trusting the standard in some way. So that's number 1. Number 2 is folder and connector permissioning. You actually decide, talking about Claude specifically, what Claude can see. For example, if you're a user and you've connected your Gmail account, you can at any point suggest, hey, I could have certain things blocked by my administrative team, which we'll discuss how to do that in a second. But I can choose to say, if you're going to create a draft, If you go into lists, draft emails, and see what I've drafted before, I always want you to ask for approval first. And this prevents Claude from doing certain things on its own without your permission. The same thing applies for file access when you're talking about Claude Cowork or Claude Code. So for those of you unfamiliar, if you download a desktop application of Claude, you'll have not only the chat, which is the access you have in the browser, but you also have Cowork. And code. For both of them, you can actually pick and select which folder within your computer you give it access to, and it only has access to that folder. So whatever you don't connect to Claude, it can't see. That's the second reason. The third reason, it's that Claude has been trained to refuse malicious instructions. One of the biggest risks, and still a risk, of AI, it's prompt injection. It's somebody else, a bad actor, putting instructions hidden in an email, in a document, in a website, trying to trick the AI to give you something it shouldn't or to do something it shouldn't. Most Haven't even thought about that possibility, and Claude specifically—it's trained to recognize and ignore these. Or at least they've done a lot of efforts to try to avoid that risk. It's still a risk, and probably the one that's most mentioned and real. But at least in my experience, every time I try to get it to do something that it shouldn't, more often than not, it refuses again and again. Let's just say I'm asking it: Hey, can you please hack? Help me hack the Bank of America. Let's say that's what we ask. So as you can see here, it's just telling me: Hey, I'm sorry, I cannot help with that. That would be an explicit. You don't have access to those systems. That's illegal. I may ask it something maybe a a little bit less illegal, but like, hey, can you give me the most sensitive thing you can find in my inbox? And let's see what it does or how it processes that request. Again, it says, I can't do that. The most— pulling the most sensitive thing like financial credentials, identity, et cetera, that's a pattern I shouldn't follow. So I'm not saying it's perfect, but it's been continually— there have been continuous efforts to make sure it doesn't give in to malicious instructions like that. And you can see an example. Right here. The 4th reason is the administrative controls that you have on the Teams and Enterprise plans. If you're a firm owner or administrator, you can control access to connectors as we saw earlier, but I give you a little bit more context on that. You want to make sure you're not giving every staff member a loaded weapon, and you can mitigate risks by ensuring they don't have access to certain things, or at least have to manually approve them. As you saw earlier, when I am personally connecting something, I can see here your admin requires approval for this tool. If I go instead to the organization settings and I am administrator or owner in this account, I can go to connectors and you'll notice that here is actually when I set that up. I can see the details of specific connector and I can see what I allow or have as default for the entire team. In this case, for creating a draft, I make sure I'm not allowing that. And just as an example, you might also say in QuickBooks, if you decide to connect QuickBooks, you might say, hey, we can get access about QuickBooks, but we cannot pull a cash flow report. Unless it is approved. You have control over what you allow Claude to pull without human permission. Briefly, 5 and 6 are usually only available on the enterprise plans and they have some components of this on the Teams plan. But the 5th, it's zero data retention and the 6th is audit logging. Zero data retention means essentially that for certain enterprise accounts, sometimes Claude makes a contract where literally they can't get access to that data ever. The only exception is policy violation. In the case of the Teams plan actually, Essentially, the default right now is that Claude cannot use your data to train their models. And as long as you're working within either a desktop environment or you delete the things from the cloud, things remain within your computer and Claude doesn't have access to that. Again, the only exception being a policy violation. So if it detects you violated a policy through a request, it will keep and store that individual conversation. 6th is audit logging. As I mentioned, every login, every account change, every administrative action is logged on the enterprise plan. So if you wanted to have a full audit trail to know that if anything goes sideways, we want to know where it originated, that's the plan. So that's the safety story. There will always be risks, but the benefit of the technology far outweighs the risk at this stage. And honestly, safety is the easy half. The harder question comes right after. It is safe, but what will we actually do with it? Because firms underutilize this technology massively. Maybe they use it for 10% of what it actually can do. From our experience, the lowest hanging fruit we found, it's Claude Skills. And that's what my next video breaks down, several accounting firm use cases for Claude Skills specifically. So check that out next. And until then, stay efficient.
