Is it safe to upload bank statements to ChatGPT, Claude or Gemini? A guide for individuals and accountants

Is it safe to upload bank statements to ChatGPT? The short answer

It can be reasonably safe, but not in the default consumer setup. On personal ChatGPT plans your conversations can be used to train OpenAI’s models unless you switch that off, chats stay in your history until you delete them, and an uploaded file is saved to your Library separately from the chat. ChatGPT Business, Enterprise and the API do not train on your data by default, and that is where client documents belong, if they go anywhere.

None of the three big vendors sells your data, and none of them publishes your statement for other users to read. The realistic risks are more ordinary: a file that stays in an account far longer than you meant it to, an account that gets compromised along with its whole chat history, a conversation picked for training or human review, and, for professionals, a disclosure of client information the client never agreed to. Whether an upload is acceptable comes down to four questions.

• Which plan is it? Personal plans and business plans have different defaults for training and retention.
• Which settings are on? Training, chat history, memory and temporary or incognito chats change what is kept and for how long.
• What is in the file? A statement with the account number, routing number, name and address removed tells far less than the original.
• Whose statement is it? Your own is your call. A client’s brings in the FTC Safeguards Rule, IRS guidance, section 7216 and, for CPAs, the AICPA confidentiality rule.

What a bank statement gives away, and the risks that are real

A statement is a dense document. The header carries the account holder’s name and mailing address, the full or partial account number and often the routing number. The body shows the balance, the employer that pays in, the landlord or lender that is paid out, every recurring subscription, and payments that reveal health providers, churches, charities and political donations. A business statement adds vendors, payroll amounts and customer names. Very little of that is needed to answer a question such as “what did I spend on software this year?”

It helps to separate the risks people worry about from the ones the policies describe. A model does not memorize your statement and recite it to a stranger on request. What the policies do describe is this:

• Training. On consumer plans, conversations may be used to improve future models when the training setting is on. Vendors say they filter or reduce personal information first, but the text still leaves your hands for that purpose.
• Retention. Chats and files persist until you delete them, and deletion from the vendor’s back end takes up to 30 days. Some categories, such as feedback and conversations flagged by safety systems, are kept for longer.
• Human review. Google says a subset of Gemini chats is read by human reviewers when activity is saved. OpenAI and Anthropic describe access by authorized staff for abuse investigations, support and legal reasons.
• Account takeover. Anyone who gets into your AI account can read every saved chat and file. That is the most common way a stored statement would actually be exposed, and multi-factor authentication is the fix.
• Wrong account. A bookkeeper who uses a personal subscription for client work puts client data under consumer terms, outside the firm’s control and out of reach when the person leaves.

ChatGPT bank statement privacy: what OpenAI’s settings do

OpenAI’s policy page on model improvement says that for services for individuals, ChatGPT included, “we may use your content to train our models,” and that you can opt out. As of October 2026 the switch is in Settings, then Data controls, on the web and in the mobile apps:

Improve the model for everyone

Turning it off stops new conversations being used for training. It does not delete or hide anything: OpenAI’s help center says regular chats stay in your history and archived chats stay archived. And if you click thumbs up or thumbs down on a reply, OpenAI says the entire conversation behind that feedback may be used for training even after you have opted out.

Temporary Chat is the closest thing to a clean room. While a chat stays temporary it does not appear in your history, does not create or update memories and is not used to improve models, though OpenAI may keep a copy for up to 30 days for safety purposes. If you save it, it becomes a regular chat and follows your normal settings.

The business plans work differently. OpenAI’s enterprise privacy page, updated January 2026, says it does not train on data from ChatGPT Business (some OpenAI pages still call it Team), Enterprise, Edu or the API Platform by default. Business workspace admins can set how long data is kept, and OpenAI will sign a data processing addendum for Business, Enterprise and the API. API inputs and outputs may be held for up to 30 days to provide the service and detect abuse, with zero data retention available for eligible endpoints and use cases.

Is Claude safe for financial documents? Anthropic’s 2025 change, and where it stands

Anthropic changed its consumer terms on 28 August 2025. Until then, consumer chats were not used for training. Since then, users of Claude’s consumer plans (the entry plan, Pro and Max, including Claude Code used from those accounts) choose whether their chats and coding sessions can be used to improve Claude. New users pick during signup; existing users had to choose by 8 October 2025 to keep using the service. Anthropic’s privacy center, last revised in 2026, still describes it this way. The control is in Settings, then Privacy:

Help improve our AI models

The choice changes retention as well as training. If you allow training, Anthropic may keep data from new or resumed chats in de-identified form for up to five years in its training pipelines. If you do not, a chat you delete leaves your history at once and Anthropic’s back end within 30 days. Turning the setting off later stops future use, but Anthropic says data already in a training run, or in a model that has been trained, stays there.

• Incognito chats are not used for training even with the setting on. They stay out of your history and memory, and are retained for 30 days.
• Thumbs up or down feedback stores the whole conversation for up to five years.
• Chats flagged by safety classifiers may be used to train Anthropic’s trust and safety systems whatever your setting, and inputs and outputs that violate the Usage Policy can be kept for up to two years.

None of that applies to Anthropic’s commercial products. Its commercial privacy article says inputs and outputs from Claude for Work (the Team and Enterprise plans), the Anthropic API and Claude Gov are not used for training by default. API inputs and outputs are deleted from Anthropic’s back end within 30 days, with exceptions for services you control such as the Files API, for zero data retention agreements, for Usage Policy enforcement and where the law requires. Team and Enterprise owners can also switch off the feedback button for the whole organization.

Google Gemini, briefly

In the consumer Gemini app, the setting that matters is Keep Activity. With it on, your chats and the files you share are saved to your Gemini Apps Activity and used to provide and improve Google’s services, generative AI models included. A subset of chats is read by human reviewers, and reviewed chats are kept for up to three years, disconnected from your account, even if you delete your activity. Activity auto-deletes after 18 months by default. Google’s own privacy hub says that if Keep Activity is on, you should not enter data that is confidential or that you would not want a reviewer to see.

With Keep Activity off, or in a temporary chat, Google keeps the conversation with your account for 72 hours and does not use it to train its models unless you send feedback. Gemini inside a Google Workspace business account is a separate service: Google says your content is not human reviewed or used for model training outside your domain without permission, and your existing Workspace controls apply.

Training and retention by plan, side by side

Every vendor keeps a carve-out for legal holds and abuse investigations, so “deleted within 30 days” always carries an “unless.” Feedback buttons are the most common way people undo their own privacy settings without noticing.

Can accountants use ChatGPT with client data? The US rules

None of the US rules below mentions AI chatbots by name. The current IRS publications and the AICPA Code (updated through September 2026) say nothing about generative AI. They do not need to: a chatbot that receives a client’s statement is a cloud service run by a third party, and the rules already cover those.

The FTC Safeguards Rule (16 CFR Part 314). The rule applies to financial institutions under FTC jurisdiction, and its own definitions name tax preparation firms and give the example of “an accountant or other tax preparation service that is in the business of completing income tax returns.” A covered firm must keep a written information security program, the WISP, with a Qualified Individual in charge, a risk assessment, access controls, encryption, multi-factor authentication and staff training. Three provisions bear directly on AI tools:

• Oversee service providers (314.4(f)): take reasonable steps to select providers that can safeguard the data, require those safeguards by contract, and reassess them periodically. A consumer chatbot account has no contract with your firm at all.
• Dispose of customer information no later than two years after it was last used to serve the customer, unless it is needed for business or legally required (314.4(c)(6)). Statements left in a chat history are part of that inventory.
• Notify the FTC within 30 days of discovering unauthorized acquisition of unencrypted information involving at least 500 consumers (314.4(j)).

Firms holding information on fewer than 5,000 consumers are exempt from a few parts, including the written risk assessment and the written incident response plan, but not from the program itself. Bookkeepers who do not prepare returns should check whether their services bring them under the rule; the WISP is sound practice either way.

IRS Publication 4557 (Safeguarding Taxpayer Data). The current revision states plainly that under the Safeguards Rule, tax return preparers must create and enact security plans to protect client data, and that failing to do so may lead to an FTC investigation. It points to Publication 5708 for building a WISP. That template asks the firm to document every place client data is stored, naming “online (web-based) applications, portals, and cloud software applications,” and requires third-party service providers with access to client data to meet the WISP’s standards. An AI tool the firm uses belongs on that list.

Section 7216 of the Internal Revenue Code. It is a misdemeanor for a preparer to knowingly or recklessly disclose information furnished for a return, or use it for anything other than preparing the return, with fines up to $1,000 and up to a year in prison. The regulations define tax return information broadly, including information supplied by third parties, so bank statements gathered to prepare a return count. They allow some disclosures without consent, such as to another US preparer for processing or auxiliary services that are not substantive determinations, but not offshore and not for substantive advice. Whether a general chatbot fits those exceptions is not something the regulations address. Where you are unsure, get the client’s written consent in the form section 301.7216-3 requires, or keep identifiable return information out of the tool.

The AICPA Code of Professional Conduct. The Confidential Client Information Rule (1.700.001) says a member in public practice “shall not disclose any confidential client information without the specific consent of the client.” The interpretation on third-party service providers (1.700.040) gives two routes before disclosing to one: a contract that requires confidentiality and gives reasonable assurance of the provider’s procedures, or the client’s specific consent. A related interpretation (1.150.040) adds that you should tell the client, preferably in writing, that you may use a third-party provider. There is an exception for administrative support such as record storage or software hosting, but a tool that reads and summarizes a client’s statements is doing more than storage, so the safer reading is that the steps apply.

Checklist: how to upload financial documents to ChatGPT or Claude more safely

1. 1Ask whether you need the file at all. Many questions, such as how to categorize a type of payment or how to build a reconciliation formula, can be answered with made-up figures.
2. 2Use a business plan for anything that is not your own. ChatGPT Business or Enterprise, Claude Team or Enterprise, or Gemini in Workspace: no training by default, admin control over retention, and a data processing agreement the firm can sign. Ban personal accounts for client work in writing.
3. 3Turn training and history off where the plan allows it. On a personal plan, switch off the training setting and use Temporary Chat in ChatGPT, an incognito chat in Claude or a temporary chat in Gemini. Do not use the feedback buttons on chats that contain statements.
4. 4Redact before you upload. Remove the account and routing numbers, the name, mailing address, Social Security or EIN, check images and any card numbers. Use a PDF tool’s true redaction, which deletes the text underneath; a black box drawn over a PDF often leaves the text selectable. Or paste only the transaction lines you need.
5. 5Get client consent. Add AI use to the engagement letter, name the tool and what it is used for, and where section 7216 applies, get the separate written consent the regulations require.
6. 6Turn on multi-factor authentication for every AI account that touches client data.
7. 7Delete files after use. In ChatGPT delete the chat and the file in Library, and any project files. In Claude delete the conversation. In Gemini delete the activity. Note in the client file what was deleted and when.
8. 8Document it in the WISP. List approved tools and plans, the required settings, who may use them, what data may go in, where it is stored, how long it is kept, and when you last reviewed the vendor.

Accuracy is a separate risk from privacy

Even a perfectly configured chatbot is a text generator, not a ledger. Asked to list the transactions on a long statement, it can skip rows, merge two lines, flip a withdrawal into a deposit or guess the year on rows that print only month and day. It will not tell you it did any of that unless you check. So if you use one to extract transactions, reconcile the result against the statement before it goes anywhere near QuickBooks or a tax return.

If the extracted rows do not produce the printed closing balance, something was dropped or misread, and the size of the gap is the best clue to which row. Count the transactions too: a statement that prints a count, or a page total, gives you a second check that costs nothing.

How a purpose-built converter differs from a general chatbot

A bank statement converter is a narrower tool. It does one job, turning a statement into rows, and produces a file rather than a conversation. That narrowness is the difference that matters. VouchRow, for example, requires an account to upload; unlocks password-protected PDFs in your browser so the password is never sent; and checks every conversion against the statement’s own numbers: the running balance on each row where the statement prints one, page subtotals, opening balance plus movement against the closing balance, the printed credit and debit totals and the transaction count. A mismatch is shown as the dollar difference, and clicking a row highlights its line on the PDF.

For firms, seats come with roles and client-level access, so a staff member sees only the clients they work on. Files are processed to produce the conversion; for the details of where processing happens and what is kept, read the security page rather than any summary, ours included.

Be clear about what does not change. A converter is still a third-party service provider. It still belongs in your WISP, still needs a vendor review under the Safeguards Rule, and still needs the AICPA notice and contract-or-consent steps if you are a CPA. And if your bank offers a CSV, Excel or QBO download for the period you need, use that: the data never leaves the bank and your own machine, which no outside tool can beat.