Where client data goes with AI tools for financial advisers
Hosted platforms and desktop apps send client data to different places under different contracts. A fair comparison of the main UK options, what each vendor says about hosting and training, and the questions to ask.
On this page
- Why the data question comes first
- Design one: the hosted platform
- Design two: the desktop app with your own AI account
- A fair note on meeting recorders
- Comparing the two designs side by side
- Questions to ask about client data and AI tools
- Frequently asked questions
- Do desktop AI apps keep client data on the computer?
- Are cloud AI platforms for advisers safe to use?
- Do we need a DPIA before using an AI tool with client data?
Every AI tool an advice firm uses has to answer one plain question before anything else: when we give it a client file, a meeting recording or a valuation, where does that information go, and who is holding it? For client data, AI tools used by financial advisers broadly fall into two designs, and they answer that question differently.
Neither design is automatically safer, and both need the firm's own due diligence. This article sets out how each works, what the main UK vendors say publicly, and the questions to ask before any client data moves.
Why the data question comes first
The FCA has not written AI-specific rules. In its June 2026 blog on AI in financial services, it said it will "rely on existing frameworks, including the Consumer Duty, the Senior Managers and Certification Regime (SM&CR), and our expectations on governance and controls." That puts the decision, and the accountability for it, with the firm.
Data protection law sets the same tone. The ICO's (now the Information Commission's) guidance on AI and data protection says: "In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk… and will therefore trigger the legal requirement for you to undertake a DPIA." A DPIA cannot be written until you know where the data travels, so mapping the data flow comes first.
Design one: the hosted platform
Most of the adviser-specific AI products we reviewed are vendor-hosted online services. You upload files or connect a meeting, the vendor's service does the processing on its infrastructure, and the outputs live in the vendor's system or flow into your back office.
This design has real strengths. There is nothing to install, the vendor runs the service, and several platforms connect directly to systems advisers already use. Aveni lists integrations with Xplan, iO and Plannr on its Aveni Assist page, and AdvisoryAI lists Intelliflo, Xplan, Plannr and Curo on its website.
Here is what the main UK vendors say publicly, as seen on 7 October 2026. These are vendor statements and may change.
| Product | What the vendor says about hosting and security | What the vendor says about training | Source |
|---|---|---|---|
| Aveni Assist | "Aveni runs on AWS"; ISO 27001; UK GDPR; data encrypted | Customer data "never used to train our AI systems or those of any third-party AI provider" | Aveni Trust & Security |
| Saturn | SOC 2; "data stored in your local residency" | "We never train our models on your client data" | Saturn security |
| AdvisoryAI | ISO 27001 certification; hosting location not stated on the page we reviewed | Not published in the sources we reviewed | AdvisoryAI |
| PlannerPal | ISO 27001, GDPR, "UK-hosted" (Intelliflo partner page) | Not published in the sources we reviewed | Intelliflo partner page |
| Timeline Pennee | "Pennee is hosted in the UK & EU on AWS infrastructure" | Timeline says customer data is never used to train AI models | Pennee security |
| intelliflo IQ | Works inside intelliflo office; hosting location not stated on the page we reviewed | Not published in the sources we reviewed | Intelliflo IQ page |
"Not published in the sources we reviewed" means only that: we did not find a statement on the pages listed. Ask the vendor directly.
Design two: the desktop app with your own AI account
IFA Tools takes the other approach. Our six apps are desktop apps for Mac and Windows that run on the firm's own computers. The AI work goes through the firm's own account with Anthropic's Claude or OpenAI's ChatGPT, signed in with a subscription or an API key that the firm chooses in setup. We do not resell AI or sit between the firm and the AI provider, and IFA Tools does not hold the firm's client data.
"On your computer" is easy to overstate, so here is the data path precisely:
- Documents are read on the firm's computer. The content the AI needs is then sent to the AI provider the firm chose, under the firm's own account and that provider's terms.
- Some steps stay on the machine. Scrutineer reads scanned documents with on-device text recognition and transcribes meeting recordings found in a client file on the computer, with nothing uploaded for that step.
- Meeting apps use Fireflies. Carbon, Asclto and Freeboard connect to Fireflies, where many firms already record their meetings. Carbon and Freeboard can also connect Google for Gmail drafts and Google Forms questionnaires.
- Keys stay in the computer's keychain. API keys are stored in macOS Keychain or Windows Credential Manager.
- Sync is optional and off by default. Firms that want several computers to share data can connect their own sync server.
So client data does leave the computer: it goes to the AI provider, and for the meeting apps it is already held by Fireflies. The difference is whose contracts govern it. The firm holds the AI account directly, so it can read and choose the provider's terms itself. On model training, Anthropic's pricing page (seen 7 October 2026) says its Team plan has "No model training on your content by default", while on consumer plans model training is opt-out. Check and record that setting. We explain the reasoning in more detail in why we use your own Claude or ChatGPT account.
A fair note on meeting recorders
If you use Fireflies, read its security material for your plan. Its security FAQ (7 August 2023) says "All your data is stored and processed in the US cloud infrastructure by default", and describes an Enterprise "Private Storage" option that lets customers choose the location. The same FAQ states SOC 2 Type II and GDPR compliance, and says Fireflies does not use customer data to train its AI model. Firms using it with our meeting apps should include it in the DPIA.
Comparing the two designs side by side
| Question | Hosted platform | Desktop app with own AI account |
|---|---|---|
| Where is the software run? | On the vendor's hosted service | On the firm's computers |
| Who processes the AI request? | The vendor, and any AI provider it uses | The AI provider the firm chose, under the firm's account |
| Who holds the client files? | The vendor's platform, per its terms | The firm; IFA Tools does not hold them |
| Whose AI terms apply? | The vendor's arrangements with its providers | The firm's own agreement with the AI provider |
| Back office integration | Often available (see vendor pages) | IFA Tools reads documents and connects Fireflies and Google; no CRM integration |
| Extra accounts to run | Usually just the platform | An AI account, paid for separately |
The honest trade-off is this. A hosted platform gives you one supplier, one contract and, often, direct integrations. A desktop app with your own AI account gives you a direct relationship with the AI provider, and the software vendor does not hold your client files, at the cost of managing an extra account and bill. The number of parties in your data map may be similar; what changes is who they are and who signed with them.
Questions to ask about client data and AI tools
Whichever design you prefer, put these to the vendor in writing and keep the answers with your DPIA:
- Which organisations will receive or store our client data, and in which countries?
- Is the vendor a processor for us, or does it act as a controller for any purpose? The ICO expects the firm to decide and document this.
- Which AI models are used, and under whose agreement with the model provider?
- Is any of our data used to train models, the vendor's or anyone else's? Is that a default or a setting?
- How long are files, transcripts and outputs kept, and how do we delete them?
- What security certifications does the vendor hold, and can we see the current certificate or report?
- If we leave, how do we get our outputs back, and what happens to our data?
- Does any step run on our own computer, and which steps do not?
We have expanded these into a full checklist in questions to ask an AI vendor.
Frequently asked questions
Do desktop AI apps keep client data on the computer?
Not entirely. With IFA Tools, documents are read on the firm's computer, but the content the AI needs is sent to the AI provider the firm chose. Scrutineer's text recognition and recording transcription run on the machine.
Are cloud AI platforms for advisers safe to use?
Many publish certifications such as ISO 27001 or SOC 2 and clear training statements, as the table shows. Safety depends on your own due diligence and DPIA, whichever design you use.
Do we need a DPIA before using an AI tool with client data?
The ICO says AI use will, in the vast majority of cases, trigger the legal requirement to carry one out. Plan for a DPIA as the default.
If you would like to see how the data moves in practice, Scrutineer shows it clearly. Book a demo: twenty minutes on Microsoft Teams with Adam Booth, run live on a demo firm, with nothing to prepare.
