Yes, client data can be safe when a CPA firm uses AI, but only when the firm controls how employees access the tool, what information they enter, where that information goes, and who can retrieve it. Strong AI data security does not come from trusting an application by default. It comes from approved business accounts, firm-managed identities, limited permissions, monitoring, clear policies, employee training, and ongoing governance. Without those controls, tax records, payroll details, financial information, and personally identifiable information can leave the firm’s managed environment in seconds.
Ma’atIT sat down with Automata Practice Development for a three-part blog series designed to help CPA firms use automation and AI effectively and securely. Together, they combine Ma’atIT’s expertise in cybersecurity and IT management with Automata Practice Development’s experience improving accounting workflows to explore what firms should automate first, how to implement AI successfully, and how to protect sensitive client data.
Where AI Data Security Breaks Down: Unapproved Public Tools
The greatest risk often starts with a reasonable goal. An employee wants to summarize a document, analyze a spreadsheet, draft a client message, or work through a tax research question more quickly. If the firm has not provided an approved option, that employee may open a public AI application and paste in live client information.
The employee may create the account with a personal Gmail address, reuse a weak password, skip multifactor authentication, or accept terms without understanding them. If that employee leaves, the account and its history may remain outside the firm’s offboarding process. The firm may have no reliable way to audit activity, revoke access, apply retention rules, or confirm deletion.
Fady Salama, owner of Ma’atIT, described the exposure in direct terms: “If the lifeblood of your firm is people’s confidential information, then you should protect that with everything that you possibly can.”
An employee can also choose the wrong website without realizing it. Wesley Hartman, Engineer and Founder of Automata Practice Development, recalled an AI workshop attendee who searched for ChatGPT and selected a sponsored result. The site looked legitimate and produced AI-generated answers, but it was not the official provider’s website. The attendee had already entered credit card information before Wesley noticed the unfamiliar URL.
That is the perfect example of why AI data security involves more than choosing a well-known model. A third-party wrapper can receive everything an employee types before sending the request to another AI service. Even if the underlying model offers appropriate business protections, the unknown intermediary may log tax data, payroll records, account numbers, or Social Security numbers.
Salama offered a simple test, “If you wouldn’t put your Social Security number in it, don’t put somebody else’s Social Security number in it.”
Public Access Is Not a Firm Deployment
Giving employees permission to open ChatGPT or another public application does not qualify as an AI strategy. A real deployment starts with a specific business problem and places the solution inside the firm’s technology and security structure. Leadership should know what the tool will do, which data it needs, who should use it, and who owns security governance, support, and improvements.
Learn more about AI deployment and automation: Accounting Automation: What CPA Firms Should Automate First.
This division of responsibility matters. The automation specialist may design the workflow, while the IT and cybersecurity team manages identities, access, devices, monitoring, and risk. As Salama explained, each person should “play to their superpower.” No single employee should quietly select, configure, secure, support, and govern a system that touches confidential client data.
Build AI Data Security into the Firm's Existing Environment
An AI solution deployed through the firm’s managed Microsoft environment differs sharply from an employee’s personal public account. The firm can connect access to company identities, enforce sign-on requirements, assign permissions by roles, monitor activity, and remove access when an employee changes positions or leaves. Those capabilities give the firm visibility and control that a personal account cannot provide.
The platform alone does not make the deployment secure. Microsoft 365 permissions, SharePoint access, group memberships, devices, and security policies must already reflect what each employee needs. An AI tool may work with the access it receives. If permissions are too broad, AI can make an existing access problem easier to discover and use.
Salama likes to say the security tools don’t fit into the AI infrastructure. The AI infrastructure fits into the security tools. In practical terms, the firm should apply its established security standards to AI rather than create a weaker exception for new technology. The most important safeguards include:
- Firm-managed accounts that remain under organizational control
- Multifactor authentication to reduce stolen-password risk
- Single sign-on for consistent access management
- Conditional access based on the user, device, location, and risk
- Least-privilege permissions for employees and AI workflows
- Audit logs for access, inputs, outputs, administrative changes, and unusual behavior
- Approved devices that keep access within the managed environment
- Retention and deletion rules for prompts, files, outputs, logs, and connected data.
These safeguards matter because people and tools both make mistakes. Hartman compared AI to an extremely knowledgeable professional entering an unfamiliar technology environment. The person may have good intentions and strong subject knowledge yet still click the wrong options or take unexpected action. Technical guardrails reduce the likelihood and reach of that mistake. They also create evidence that the firm can review if something goes wrong.
Questions to Ask Before Approving an AI Tool
Good AI Data security requires due diligence before a vendor receives client information. A firm should not rely on a polished website, a familiar logo, or a general promise that the product is secure. CPA firm leaders should ask:
- Will the provider use the firm’s prompts, uploaded files, or outputs to train any model?
- Who at the provider can access firm data, and under what circumstances?
- Where does the provider store and process the information?
- How long does the provider retain prompts, files, outputs, backups, and audit records?
- Can the firm set its own retention period and permanently delete information?
- Does the service support managed accounts, single sign-on, multifactor authentication, role-based permissions, and audit logs?
- Which systems can the tool connect to, and what permissions does each connection require?
- Can administrators restrict features, file uploads, external sharing, plug-ins, or third-party connectors?
- What independent security evidence can the vendor provide, including a current SOC 2 Type II report?
- Who will the vendor notify the firm of a security incident or a material change to its data practices?
- What happens to the firm’s information when the contract ends?
Hartman recommended starting with established providers and reviewing baseline certifications, while also researching specialized tools such as tax research applications. Salama added an important caution: a compliance logo on a website does not prove the vendor earned or maintains that status. The firm, or a qualified advisor, should review the evidence instead of treating a badge as the end of due diligence.
The review should match the risk. A tool that rewrites public marketing copy does not create the same exposure as one connected to tax organizers, payroll records, client portals, document management systems, or Microsoft 365. The more sensitive the information and the broader the access, the more scrutiny the firm should apply.
Maintain AI Data Security After Deployment
Approval is not the final line. Vendors update products, employees find new uses, permissions change, and AI capabilities evolve quickly. AI data security therefore requires ongoing monitoring, training, and governance.
One persistent issue is shadow AI. Shadow AI means employees use AI tools, accounts, browser extensions, plug-ins, or automated services without the firm’s approval or oversight. A firm may block a website on a managed computer, but an employee can still use a personal phone, take a photo of a screen, or open a personal AI account elsewhere. Hartman acknowledged that no control would stop every possible workaround.
The best response combines visibility, useful alternatives, and reasonable friction. The firm should inventory approved applications, review sign-in and activity logs, remove unnecessary extensions and connections, and restrict high-risk tools. Policies should explain which tools and data employees may use and how they can request approval.
However, a policy that only says no can push experimentation out of sight. Hartman said, “The number one thing you can do is give people a tool.” If a firm gives employees no approved way to use AI, many will still look for ways to save time. A controlled tool, safe testing environment, and clear request process allow employees to explore legitimate efficiencies without using live client data in an unknown system.
Salama described the goal as adding guardrails and making unsafe choices harder. Firms can block unapproved services, limit installation rights, control connections, and give employees a channel to propose useful ideas.
Monitoring and Training Should Continue
The firm should assign people to review AI access, audit logs, permissions, exceptions, vendor changes, and concerns. If administrators can inspect inputs and outputs, the firm should define who may review them. Periodic access reviews can identify former employees, outdated roles, excessive permissions, and unused integrations.
Training should cover more than how to write prompts. Employees need practical examples of prohibited data, approved tools, fake or sponsored AI sites, personal-account risks, verification requirements, and the steps to report a mistake. Tabletop exercises can help the team rehearse what to do if someone enters client information into an unapproved tool or connects an AI service to the wrong data source.
Hartman explained that repeated training helps secure behavior become second nature. Like phishing, an AI security mistake may happen during one rushed moment. Salama also emphasized that education cannot be a one-time certification. The rules, products, and risks change too quickly.
The firm should regularly revisit its AI policy and approved-tool list. Incidents, near misses, employee questions, and new use cases should improve controls and training. This protects information without freezing innovation.
A Secure Path Forward for CPA Firms
Client data can remain safe with AI when the firm treats protection as part of the implementation, not as a final checkbox. The right approach keeps information within managed systems, gives employees approved tools, limits access, verifies vendors, records activity, and reinforces expectations through ongoing education.
CPA firms do not need to choose between innovation and client trust. They need technology, automation, and security specialists working together. That partnership helps the firm use AI for a defined purpose while preserving the confidentiality that clients expect.
CPA firm leaders who want to understand their current security, Microsoft 365 permissions, devices, and readiness for AI can contact Ma’atIT to schedule a free IT assessment. Firms ready to design and implement secure, accounting-specific automation can book a discovery call with Automata Practice Development to discuss automation implementation.