Insights

Is it safe to put confidential deal data into AI?

Mitchel Campbell, Co-founder and CEO

October 15, 2026 · 7 min read

The short answer

Yes, if you control where the data goes and who can see it – and the answer has almost nothing to do with which model you use. The risk that actually bites advisory firms is not a frontier lab training on your CIM. It is the four or five places your data travels on its way to and from the model, none of which anyone mapped before the first workflow went live.

This guide covers what the major providers actually commit to, the path your data really takes, what your existing NDAs already require of you, and the seven controls that do the work.

What the model providers actually say

Start here, because it is the thing people assume is the problem and it mostly is not.

OpenAI states that business data is not used to train its models by default, that this exclusion covers the API, that API inputs and outputs may be retained for up to 30 days to run the service and detect abuse, and that zero data retention is available on eligible endpoints for qualifying use cases. The API platform is audited to SOC 2 Type 2. Anthropic states that by default it does not use inputs or outputs from its commercial products to train models, unless you explicitly opt in or submit feedback.

Both positions are published and dated. Check them yourself before you rely on them, and check them again at renewal – these terms change, and a commitment you verified in 2024 is not a commitment today.

So on the narrow question of "will my deal end up in a model's training data", the default answer from the major providers is no. That is the easy part.

The risk that actually bites

Your data does not go from your laptop to the model and back. It goes through a chain, and each link is a place it can be stored, logged, read or leaked.

A realistic chain for a mid-market advisory firm running an AI workflow looks like this:

• The browser extension or desktop assistant that reads the document
• The note-taker sitting on the call the document was discussed on
• Your vendor's own application layer, which almost always logs prompts for debugging
• Whatever database that application writes to, and who at the vendor can query it
• The model provider itself
• Any sub-vendor in between: a document parser, a vector store, an email sender, an enrichment API
• The evaluation set your vendor keeps so it can tell whether its product is getting better

The model provider is the only link in that chain with a published, audited privacy posture. The others are the ones to ask about, and most firms never do.

The two failures I would actually expect to see are mundane. One: a vendor's debug logs retain full prompt text indefinitely, and a support engineer can read them. Two: an AI-drafted email goes out to a buyer with the seller named, because there was no approval gate.

What your NDAs already require

This is the part advisory firms skip, and it is the part that creates real exposure.

A standard sell-side NDA restricts disclosure to permitted recipients, usually defined as employees and advisers who need to know and who are bound by equivalent obligations. Some are tighter and name an approval requirement for any third party. An AI vendor that processes the confidential information is a third party, whatever the marketing calls it.

Three practical consequences:

Read the permitted-recipients clause before the first workflow, not after. If it requires consent for subprocessors, you need consent, and asking is cheaper than explaining.

Your vendor should be willing to sign back to the same standard. If they will not accept confidentiality terms that match what you owe your client, that answers the question.

Keep a list of what touches client data. When a client asks – and in 2026 they will – a one-page answer naming the systems, the retention and the approval gate is the difference between a short conversation and a long one.

Seven controls, in the order they pay

1. Run it in your own accounts. Your cloud tenancy, your keys, your logs. This removes most of the chain above in one move and it is the single highest-return decision.
2. Name a human approval gate for anything that leaves the firm. Not a setting that can be switched off – a step, with a person's name on it.
3. Get retention in writing, at every link. Not just the model provider. Ask each vendor how long prompt text persists and who can read it.
4. Scope permissions to the deal. Access by mandate, fund and team, so a workflow built for one engagement cannot read another.
5. Keep an audit trail. What was sent, by whom, when, and what came back. This is also what makes a client conversation easy.
6. Decide what never goes in. See below.
7. Re-verify at renewal. Terms change. Put it on the same calendar as your insurance.

Notice that none of these are about model choice. A firm that gets these seven right is safe on a mediocre model. A firm that gets them wrong is exposed on the best one.

Three things to keep out, whatever your setup

• Material non-public information where the counterparty has not consented to AI processing. Consent first, then build.
• Personal data you have no lawful basis to process – employee records in a diligence pack are the common one.
• Anything you would not put in a shared drive with a vendor's name on it. If the thought is uncomfortable, the control is missing, not the courage.

How to answer a client who asks

Short, specific, and in writing. The answer that ends the conversation has four parts: where the data runs, how long anything is kept, who can see it, and what reaches anyone outside the firm without a person approving it. If you can give those four in a paragraph, you are in good shape. If you cannot, that is the work.

Frequently asked questions

Will my deal data be used to train the model? Not by default with the major providers. OpenAI and Anthropic both state that business and API data is excluded from training unless you opt in. Verify the current terms before relying on them, and re-verify at renewal.

Is it safer to run an open-source model ourselves? Safer on data flow, harder on everything else. You take on hosting, patching, evaluation and the cost of the quality gap. For most advisory firms under 20 people, a commercial model running in your own cloud accounts is the better trade.

Do I need my client's consent to use AI on their deal? Read the permitted-recipients clause of the NDA. Many require that any third party receiving confidential information be approved or bound to equivalent terms. Where it is ambiguous, asking costs one email.

What about the note-taker on my calls? It is part of the chain and it is usually the least scrutinised link. Apply the same questions: where it runs, how long recordings and transcripts persist, and who can access them.

How do I know my vendor is telling the truth? Ask for it in the contract rather than the sales call. A vendor who will commit in writing to retention, access and deletion is making a different statement than one who describes a secure cloud.

How we do it, for completeness

Analyst3 builds AI workflows that run inside our clients' own accounts, on the systems they already use, with permissions aligned to client, fund, deal and team boundaries. Our clients own the code, the data and the workflows. Nothing reaches a buyer, seller, owner, client or LP until someone at the firm approves it.

We built it that way because we have sat on the other side of the NDA: a decade in investment banking and corporate development, where the answer to "who else has seen this" had to be short.

If this guide helps you ask better questions of a different provider, it did its job.