Quick answer
For an independent advisor or RIA, W&S discloses exactly where the AI that drafts client emails and summarizes statements sends that data: a named provider, under zero-retention terms, documented before you sign. On-premise inference is on our roadmap. A person on your team approves every outbound message before it sends.
Every advisor who looks at AI for the back office wants the same two things at once: the hours back, and the certainty that a client's financial life is not being copied off to a server they have never seen. Those two wants usually feel like a trade. With a consumer chatbot, they are. With a private AI employee whose data flow is disclosed in writing, they are not. The point of disclosure is that you stop guessing.
Why an advisor's client data is a target
Think about what is actually in a single client record. Account numbers and current balances. Held-away assets and outside accounts. Beneficiaries, often including minors. Income, tax posture, and the planning documents that lay out exactly how much someone has and what they intend to do with it. Put a household's records side by side and you have a full financial picture of a real person, the kind of file that is worth far more to the wrong party than a stolen password.
That is the thing an advisor is holding. It is also the reason a client picked a person over an app: discretion. When you paste a statement or a thread into a tool to get help drafting a reply, that complete picture is what moves. The question is not whether the AI is useful. It clearly is. The question is where the data goes to make it useful.
The stakes are not abstract. Financial services carried one of the highest breach costs of any industry, an average of $5.56 million, in IBM's 2025 Cost of a Data Breach Report (IBM). And the exposure is not only for the big firms: Verizon's 2025 Data Breach Investigations Report found that 88% of breaches at small and midsize businesses involved ransomware (Verizon).
Where client data goes with cloud AI tools
With a typical cloud AI tool, the text you type and the documents you upload leave your office and travel to servers you do not control, run by a company you do not employ. Where those servers sit, who can read what arrives, and how long it is kept are the vendor's decisions, not yours. You can read the policy. You cannot inspect the building.
Consumer-grade tools add a sharper edge: some of them may use what you type as training input by default. By default, OpenAI may use content from personal ChatGPT accounts to improve its models unless you opt out; its business and enterprise tiers are excluded (OpenAI). And there is no undo. Once a client's statement has been pasted into a service, you cannot un-send it. For a deeper walk through this, see where your client data goes when you use AI.
The risk is not only the tools you approve. IBM found that breaches involving shadow AI, the unsanctioned AI tools employees adopt without approval, cost an average of $670,000 more (IBM). When a private AI employee handles the work people would otherwise reach for a chatbot to do, that quiet, unsanctioned path has less reason to open in the first place.
The on-prem alternative
Disclosure flips the arrangement. Instead of a policy you have to trust, you get a named provider and a written data map before you sign. AI drafting runs through that disclosed provider, under zero-retention terms. The drafting, the summarizing, the document questions are documented end to end, so you know exactly where they happen.
That is privacy by disclosure, not privacy by promise. The reason you know where a client's statement goes is not that someone told you to trust them. It is that the path is written down and verifiable. If you want the longer explanation of the model, read what on-prem AI means. You own every credential. We configure it and manage it. You keep the runbook.
One honesty note, because it matters in this category: today, AI drafting runs through a disclosed cloud provider we name in your engagement, under zero-retention terms. On-premise inference is on our roadmap, and we will tell you plainly which one applies to your deployment. We never describe a cloud-assisted path as if it were on-premise.
What Paige does for an advisory practice
Paige is the private AI employee W&S configures for you. For an advisory practice she handles the routine back-office pile that eats your week:
- Drafts client replies in your voice, ready for you to review.
- Summarizes statements and long threads so you walk into a call already caught up.
- Answers plain questions about your own files and gives you a citation back to the source document, so you can check the answer rather than trust it.
- Pulls together meeting follow-ups from your notes into a clean recap and next steps.
- Processes intake and enters data, taking the repetitive typing off your plate.
Across all of it, the same rule holds: a person on your team approves every send. Paige drafts and prepares. She never sends an outbound message on her own, and that gate is enforced by the system, not by a habit anyone could quietly drop. You can read more about how we fit this to AI for advisory firms.
Confidentiality, client trust, and your own reviewer
Advisors carry confidentiality and client-records obligations, and clients expect discretion as a matter of course. That is the reason a firm cares so much about where its data goes in the first place. We are software builders, not your compliance counsel, so we will not tell you what any rule demands of your practice. What we can do is hand you something you can show your own people.
Disclosure gives you two concrete things: a written data map and auditability. The data map names exactly where AI drafting runs, and the runbook documents how to verify it. Your own compliance person or IT reviewer can take that runbook and confirm the data flows for themselves. You are not asked to take our word for it, and you are not handed a compliance verdict. You are handed the means to check.
What we verify at install
The promise is only as good as the proof, so we make the proof part of setup. At setup we document the following:
- Exactly where your data flows. We name the disclosed AI provider and write down the path, so the claim is something you can point to, not something you have to assume.
- Only telemetry reaches W&S. The operational signals we need to keep the system healthy are the only thing that comes back to us. Your client content is not part of that.
- You own the credentials. If our arrangement ends, you keep the runbook.
- Support is 24 hour response, next business day resolution target, remote-first. We handle the upkeep so you do not have to staff for it.
What it costs
We keep pricing plain. An optional data residency assessment runs $500 to $1,500 if you want a documented look at your current data flows first. Setup starts at $3,000, done in person. From there, an ongoing management retainer starts at $300 per month, so the system stays maintained and current without you hiring for it.
The hours come back, and the complete financial picture your clients trusted you with is handled the way you told them it would be. That is the entire pitch, and disclosure is how you get both at once.