Masking Client Names Is Not Confidentiality
Is masking client names before using ChatGPT enough to keep client data confidential? No. Replacing a client's name with a code hides who the numbers belong to. It does not hide the numbers, and in accounting and tax work the numbers are the sensitive part. Masking lowers risk, and for some tasks that is enough. It is not the same as the AI model never receiving the data.
Most AI advice for accounting firms comes down to two moves: use a business plan that doesn't train on your data, and take client names out before pasting anything in. Both are sensible. Neither answers the question a client, a state board or an examiner will eventually ask: what did the model actually receive?
This article covers what a model still sees after masking, what the research says about tracing masked data back to its source, what the IRS has said about AI and client data, where Section 7216 fits, and the questions to ask a vendor before client numbers go in. We build a product on the alternative, so weigh our view with that in mind and check the sources linked throughout.
What does an AI model see when you mask a client's name?
Masking tools swap names, tax IDs and account numbers for tokens. Everything else stays readable: revenue, payroll, deductions, dates and line-item descriptions. That is by design. If the tool hid those too, the model could not analyze anything.
Take a made-up profit and loss statement labeled "Client 4417." It shows $4.2 million in revenue, one state, a payroll line, a depreciation schedule and a rent figure. The name is gone. Anyone who knows that industry in that city can still guess whose books these are. Then there is a line item reading "quarterly distribution to a family trust," which a field-level masking tool will miss unless it also scans free text.
Can masked financial data be traced back to a client?
Sometimes. NIST's report on de-identification, written by Simson Garfinkel in 2015, notes that researchers have shown some de-identified data can sometimes be re-identified (NIST IR 8053). Masking still reduces risk. It is not a guarantee.
The best-known demonstration is a 2015 study in Science by Yves-Alexandre de Montjoye and colleagues. They took three months of anonymized credit card records for about 1.1 million people and found that four spatiotemporal points were enough to identify about 90% of individuals. That was consumer purchase data, and we know of no comparable study of small-business books. But a handful of specific details singling out one record is a mechanism, not a quirk of credit cards.
What do no-training and zero-retention plans protect?
They protect what the provider does with your data after the model answers. OpenAI, for example, says it does not train its models on business data by default for ChatGPT Enterprise, ChatGPT Business and the API, lets qualifying organizations set how long data is retained, and offers zero data retention on its API platform. Those are real controls and worth having.
They do not change what the model receives while it works. The prompt and any attached files go in, values included. For plenty of tasks that is an acceptable risk. If a client's engagement letter or contract promised their numbers stay private, it may not be the promise you made.
| Approach | Does the model receive client values? | What the provider does afterward |
|---|---|---|
| Consumer chatbot | Yes | Varies by plan and settings; consumer and business terms differ |
| Business plan | Yes | Not used for training by default, per the provider's stated policy; retention depends on settings |
| API with zero data retention | Yes | Not retained, per the provider's description |
| Masking tool in front of any of these | Yes, with names and IDs replaced | Same as the plan behind it |
| Protection applied before data leaves the firm, so values are never sent | No. The model works on the question and the structure of the data | Nothing to retain, because the values were never sent |
What has the IRS said about AI and client data?
On June 24, 2026, the IRS Office of Professional Responsibility (OPR) issued its first guidelines on AI in federal tax practice, applying existing Circular 230 duties to AI-assisted work. The accompanying OPR Alert 2026-19 says practitioners remain responsible for the confidentiality of client data when they use AI, and that client data should be handled only with "secure, enterprise-approved AI systems." It warns that uploading sensitive client data to unsecured or public AI platforms is a significant risk, ties unauthorized disclosure of tax return information to penalties under IRC Sections 6713 and 7216(a), and tells firms to vet third-party AI tools, train staff and document their data-handling protocols (Journal of Accountancy; Thomson Reuters Tax & Accounting).
Two things the coverage we reviewed does not say. It does not address masking or de-identifying data before use, so it neither approves nor rejects the practice. And as of October 2026, a CPA Practice Advisor analysis notes the IRS has not said whether sending return information to an AI tool counts as a disclosure to a third party (CPA Practice Advisor).
Where does Section 7216 apply to tax preparers?
Section 7216 of the Internal Revenue Code makes it a misdemeanor for a tax return preparer to knowingly or recklessly disclose information received for preparing a return, or to use it for another purpose. The penalty is a fine of up to $1,000, up to one year in prison, or both.
The regulations define disclosure as making tax return information known to any person in any manner whatever. Tax return information is any information the preparer obtains for the return. A taxpayer's name, address and identifying number are examples, not the whole definition. An IRS FAQ, now marked archival, adds that contractors who receive the information are treated as preparers, and that unauthorized disclosure or use needs the taxpayer's written consent in the form Rev. Proc. 2013-14 specifies.
Whether pasting masked data into a chatbot counts as a disclosure is a question for your counsel, and this is not legal advice. What we can say is that the rule is written around information, not identity. Removing the name does not settle it.
What about firms and fractional CFOs that don't prepare returns?
Section 7216 is about preparers. Everyone else answers to contracts, NDAs, professional confidentiality duties and, for many firms, the FTC Safeguards Rule. A June 2026 article in CPA Practice Advisor, written by a hosting provider, says the rule almost certainly applies to CPA firms, bookkeepers and tax preparers and requires them to monitor the service providers that handle client data, with contracts that spell out security expectations.
An AI tool that receives client values is a service provider in that sense, and you have to vet whichever vendor sits in the middle, Nera included. The difference is the question you are asking. With a vendor whose model never receives the values, it is what happens to protected data. With one that does, it is what a third-party model does with your client's trial balance.
What does it take for the model never to receive the values?
The protection has to happen before the data leaves the firm's side. The model works on the question and the structure of the data, and the values stay readable only to the firm. The numbers are analyzed without being exposed to the model or to the vendor.
Nera is built for structured and numerical data: ledgers, trial balances, payroll files and schedules. Masking is a different architecture. It keeps the values readable and hides whose they are. For the full picture of what is safe on public tools and what is not, see How Accounting Firms Can Use AI on Client Data Without Exposing It.
Which approach fits which job?
A client email with no figures in it, or a summary of a public notice, needs little beyond a business plan with no-training terms. Masking works for qualitative tasks where the amounts do not matter, provided someone has actually checked what stays readable.
Trial balances, payroll, tax return data and anything a client's contract calls confidential are a different matter. Those belong in a setup where the model never receives the values, or under documented client consent and a counsel-reviewed policy that covers the model's provider.
What should you ask an AI vendor before client numbers go in?
- What exactly does the model receive when I run a task: identifiers, amounts, descriptions, file contents, structure?
- Is any of it retained or used for training, and is that in the contract or only on a marketing page?
- If you mask data, which fields stay readable, and what happens to free text?
- Who at your company and at your model provider can see my client's data, and is access logged?
- What will you put in writing that I can reference in my engagement letter and information security plan?
Credit unions face a sharper version of this question, because their regulator cannot examine the AI vendor at all. See Can NCUA Examine Your AI Vendor?.
Sources
- IRS Office of Professional Responsibility, AI guidelines and OPR Alert 2026-19, June 24, 2026 (Journal of Accountancy; Thomson Reuters)
- Steven de la Fe, "What to Settle Before Client Tax Data Touches AI," CPA Practice Advisor, October 12, 2026 (link)
- S. Garfinkel, De-Identification of Personal Information, NIST IR 8053, 2015 (NIST)
- Y.-A. de Montjoye et al., "Unique in the shopping mall," Science, 2015 (MIT DSpace)
- 26 U.S.C. § 7216 (Cornell LII); 26 CFR § 301.7216-1 (Cornell LII); IRS FAQ on Section 7216 (irs.gov)
- FTC Safeguards Rule and client tax data, CPA Practice Advisor, June 17, 2026 (link)
- OpenAI, business data privacy (openai.com)
Rami Akeela, Ph.D., is Founder and CEO of Nera Systems, a confidential AI infrastructure company. He holds PhDs in Electrical Engineering and Computer Engineering and has spent 20+ years in engineering and research. Nera Systems builds confidential AI infrastructure for organizations that cannot afford for their most sensitive data to be exposed to a model, a vendor, or each other. To see how it works for accounting firms, book 20 minutes with Rami.