Susan Pasted the Client’s Trial Balance Into a Chatbot. She Thought She Was Just Being Efficient.

Susan has kept the books for a twelve-person marketing agency for three years. Last month the owner asked why gross margin had dipped, and instead of digging through the general ledger line by line, she exported it and pasted it into a chatbot with a simple prompt: summarize what changed. It answered in about ten seconds, and she moved on with her day, pleased with how much time she’d saved.

Here’s the direct answer, before the story gets more uncomfortable: pasting financial data into a general-purpose AI chatbot is usually not safe. Most of those tools retain what you type by default, and some use it to train future models. Susan didn’t send an email with an attachment. She typed a client’s bank balances and payroll figures into a text box owned by a company with no contract, no signed data agreement, and no visibility into what happens to that data next.

What actually happens when you paste a spreadsheet into a chatbot

Free and consumer versions of most AI chatbots are set up to store your conversation history and, depending on the settings, use it to train and improve the underlying model. Turning that off usually means finding a toggle buried in account settings, or paying for a business tier that comes with its own data agreement. Almost nobody using the free version has gone looking for that toggle, because nothing about the experience suggests there’s a reason to look. The chatbot just answers the question.

That’s the part that makes this different from a normal data-security mistake. Nobody warns you mid-task. There’s no popup saying "this general ledger export contains account numbers, are you sure?" It behaves exactly like a calculator, right up until the moment you remember it isn’t one.

Susan didn’t think she was “sending” anything anywhere

If you’d asked Susan to forward the client’s full trial balance to a personal Gmail account, she’d have paused. That reads, correctly, as sending sensitive data somewhere it shouldn’t go. Pasting the same numbers into a chat window didn’t register the same way, because the word everyone uses for it is "automation," not "transmission." Automation sounds like something happening inside your own workflow. In this case, it wasn’t. The data left her laptop, traveled to a third-party server, and sat there for the AI provider to process, retain, and possibly reuse, all before she got her ten-second summary back.

None of this makes Susan careless. She’s a good bookkeeper who cares about her clients. The gap between what a tool feels like and what it actually does is the entire problem, and it’s a gap most software never bothered to close for her.

It isn’t only accountants doing this

Richard runs a nine-person e-commerce brand and does his own books in QuickBooks. Ahead of a lender conversation, he wanted a clean summary of cash trends over the last two quarters, so he exported the profit and loss and asked an AI tool to draft the narrative for him. He didn’t think twice, because it was his own data. That instinct is understandable and also beside the point. Ownership of the data doesn’t change what the AI provider on the other end can do with it once it arrives. A business owner uploading his own numbers exposes the exact same bank balances, customer names, and vendor list as an accountant uploading a client’s.

A few things quietly end up in a chat window whenever someone pastes in a spreadsheet for a "quick summary":

• ✓Bank and credit card account numbers, often sitting right in the account name or memo column
• ✓Vendor and payroll names, tied to specific dollar amounts
• ✓Customer names alongside exactly how much revenue each one generates
• ✓Partial SSNs or EINs that ended up in a memo field months ago and were never cleaned out
• ✓The full shape of a company’s cash position, which is exactly what a lender, competitor, or bad actor would want

The line most people miss between automation and exposure

There’s a real difference between AI running inside a system built to handle financial data and AI running in a general chat window meant for anything from a recipe to a line of code. The first can be built with rules: strip identifying details before anything leaves the system, restrict which providers ever see raw data, sign agreements that spell out what happens to it. The second has no idea what it just received. It treats a trial balance the same way it treats a grocery list, because that’s what it was designed to do.

The tool didn’t do anything wrong. It did exactly what a general chatbot is built to do. The mistake was assuming a general tool understood it had just been handed a client’s entire financial picture.

What we actually do differently

We use AI throughout the OnNumbers platform: AI Pulse flags anomalies daily, Ask AI answers plain-language questions about your books, and AI-assisted classification handles repetitive categorization. That only works if it’s built the right way. Across the substantial majority of our AI-powered features, customer, vendor, and employee names are replaced with anonymized tokens before any of that information reaches a third-party AI provider. Your real names come back only in what’s shown to you inside the product, never in what actually gets sent out.

On top of that, financial data is encrypted in transit and at rest, access is limited to your dedicated team through role-based controls, and we list every AI provider we use in production, along with the categories of data each one may process, on a public page. Where a provider has confirmed it doesn’t train its models on our customer data, that confirmation is stated plainly rather than assumed. None of this is a claim that no data ever reaches an AI model. It’s a description of what gets reduced, tokenized, and controlled before it does, and it’s the exact thing missing when someone pastes a spreadsheet into a general chatbot.

A short checklist before you paste anything financial into an AI tool

You don’t need a security background to check this. A few honest questions cover most of it:

• ✓Does this tool retain what I type by default, and have I checked the setting rather than assumed the answer?
• ✓Is there a signed agreement covering how this vendor handles data, or just a consumer terms-of-service page nobody read?
• ✓Does the provider publish what data categories it processes, or do I have to take "we take privacy seriously" on faith?
• ✓Could I answer this question with a smaller, redacted excerpt instead of the full export?
• ✓If I can’t answer the first three about a tool I already use every week, what does that tell me?

AI clearly has a place in accounting work. Categorizing transactions faster, catching a duplicate payment, drafting a first pass at a variance explanation: all of that is genuinely useful, and refusing to use any of it isn’t realistic advice for anyone running a business in 2026. The point isn’t to avoid AI. It’s to notice the difference between a tool built to handle your financial data responsibly and a chat window that has no idea what you just handed it.

If Susan’s story sounded a little too familiar, the fix isn’t to stop using AI. It’s to know exactly where your numbers go before you hit enter. See the specific providers and data categories on our Subprocessors & AI Data Use page, or read how AI actually fits into accounting work, and where it still needs a person. Curious what visibility into that work looks like day to day? Here’s why accounting so often feels like a black box, and what changes when it isn’t.