What can go into which tool.
The account tier decides more than the brand name does. Plus the consent script and the states where you need everyone to agree.
The tier matters more than the tool. A consumer account is the wrong place for client-identifiable information almost regardless of which model is behind it, because the terms generally permit training on what you submit. A business or enterprise tier with written no-training terms, a data processing agreement and a defined retention period is a different analysis — and that analysis is the thing your policy should record.
Where the line actually falls.
Consumer account
Consumer terms generally permit training on what you submit. Whatever the securities rules say, this is the wrong place for a client name, an account number, a tax document or a financial statement. Use it for the language around the numbers, never the numbers.
Business or team tier
Usually no training on your content by default, but default is not the same as contractual. What you want in writing: no training, a data processing agreement, a named retention period and a deletion path.
Enterprise with zero retention
Written no-training terms, a DPA, and zero or short retention configured. This is the tier where client-identifiable data becomes a policy decision rather than an obvious no. Record the analysis in your vendor file.
The states where everyone has to agree.
Recording consent is state law, not securities law. Most states require only one party to consent, which is you. These twelve are generally treated as requiring all parties:
- California
- Connecticut
- Delaware
- Florida
- Illinois
- Maryland
- Massachusetts
- Montana
- New Hampshire
- Oregon
- Pennsylvania
- Washington
Treat that as the starting point and confirm it for your states. These are criminal statutes in several of them, the published lists disagree at the margins, and the law moves.
For anything crossing state lines the workable posture is to notify and get agreement every time. The stricter state generally governs and you will not always know where a client is sitting when they pick up.
Ten seconds, said out loud.
The reason advisers skip this is that they have not decided what to say. So here is what to say:
I use a tool that takes notes while we talk, so I can pay attention to you instead of my keyboard. It writes a summary that goes in your file. Are you comfortable with that?
Four things happen in that sentence. They learn what it is, what it produces, where it goes, and that they can say no. Asking properly takes ten seconds and it is also the record that you asked — so note it in the file the same way you would note any other client instruction.
If they decline, take notes by hand. A client who said no and got recorded anyway is a worse problem than a slower meeting.
Transcript or summary — pick one.
Advisers ask whether they have to keep the full transcript or just the summary, and the honest answer is that the rule does not name either. Rule 204-2 asks whether an artifact falls into a listed record category. Whichever document your firm treats as the record of the meeting is the one that has to be retained and retrievable.
The trap is keeping both by accident with no policy about either, because then a dispute decides for you and it decides badly. Pick one, write down why, apply it consistently, and confirm your archive actually holds what you picked. Then test retrieval, because most retention failures turn out to be retrieval failures.
Get the next one.
Field notes from real deployments, written the way this one was. No schedule promised and nothing sold to you. Unsubscribe whenever.
Sources and standing.
Last reviewed: September 2026. The consent-state list is a starting point for your own check, not a legal conclusion, and state recording law changes. This is not legal advice. If something here is wrong, tell me and it gets corrected.
- Anthropic Privacy Center, Is my data used for model training? (consumer plans) (checked 2026-10-27)
- Microsoft Learn, Enterprise data protection in Microsoft Copilot (checked 2026-10-27)
- 17 CFR 275.204-2, Books and records to be maintained by investment advisers (checked 2026-10-27)
Keep reading
Build with us in Milwaukee.
Thirty minutes, one real constraint, and a written description of what could be built. No pitch decks, no small talk.