Private AI vs Public AI for Client Data: Where Data Lives.

A trust company asks an AI assistant to summarise a beneficial ownership structure. A compliance officer pastes a source-of-wealth memo into a public chat tool such as ChatGPT or Claude to tidy the wording. Both save time. Both also send client information to a place the firm does not control, often a data centre in another country.

AI is now part of compliance work, so the question for fiduciary firms is no longer whether to use it. The question is which kind of AI, where it runs and who answers for the data. This article explains private AI vs public AI for client data, setting out the difference between a private, embedded AI such as WealthSphere IQ and public AI clouds, and when each is the right tool.

What happens to your data in a public AI cloud

When you use a public AI assistant such as ChatGPT or Claude, your prompt and any attached documents travel to the provider’s infrastructure to be processed. Those environments commonly sit in the United States or in other regions the provider selects, which may not be where your client, your regulator or your contract expects the data to be. Retention periods, human review and whether inputs can be used to improve models differ by provider and by subscription plan, and they change over time.

For a firm holding passport details, tax residency, trust deeds and ownership structures, that raises practical questions. Cross-border transfer and data residency rules apply. Confidentiality duties to clients apply. Outsourcing and sub-processor obligations apply. And a file pasted into an outside tool leaves no record inside the firm’s own audit trail.

Public AI can be excellent for general research and for drafting non-confidential material. Client files are a different category.

How WealthSphere IQ is different

WealthSphere IQ is built into the platform rather than sitting beside it. Each firm’s IQ runs in its own ring-fenced Azure environment, in the region the firm chooses, isolated from every other client. Customer data is never used to train a model, and nothing is shared between customers.

Because IQ lives inside WealthSphere, it works from governed records instead of pasted copies. Every answer respects the same entity security as the rest of the system, so IQ cannot show a user anything they are not entitled to see. Ownership answers follow jurisdiction-specific rules with the evidence behind them, rather than a language model’s best guess, and a result can be exported or traced back to the record it came from.

IQ is available from every page and knows which entity, case or meeting you are looking at. That context is the privacy benefit in practice: staff get timely intelligence where they already work, so there is no reason to copy a client file into an outside tool just to keep a case moving.

Private does not mean cut off from the outside world

A common assumption is that a private AI must be an isolated one. It does not. RegSphere, the regulatory case management module, watches regulator sources across many jurisdictions, covering beneficial ownership, FATCA, CRS, economic substance, AML and corporate meeting rules. When a regulator publishes a change, it is read, classified and placed in a review queue. The affected entities and deadlines can then be identified and turned into tasks for the right person, with a human deciding what matters.

The direction of travel is the point. Public information flows in: regulator pages, reference data and filing requirements. Client records do not flow out. The firm gets an assistant that looks outward for regulatory change while the data boundary stays exactly where the firm drew it.

The same approach applies to corporate meetings and resolutions. In WealthSphere 2, IQ can draft an agenda, resolutions or minutes from the documents the secretary chooses, tag each paragraph with its source and label the result as AI drafted. Nothing is ratified until a named person has reviewed it. The drafting happens inside the firm’s environment, using the firm’s own documents and drafting style.

When a firm chooses a public AI cloud

Some firms will still want to use a public AI assistant they already know, such as Claude or ChatGPT, for example to explore their data conversationally or to combine WealthSphere with other tools. We can support that choice through open, permissioned interfaces, including MCP, the Model Context Protocol, the emerging standard for connecting AI assistants to business systems. A connected assistant acts as a named WealthSphere user and sees only what that user is allowed to see, using an access key the firm issues and controls.

The responsibility shift is the important part. Once data reaches a public AI cloud, it is processed under that provider’s terms and in that provider’s locations. The firm becomes responsible for privacy, residency, retention and client consent in that environment. WealthSphere provides the connection and the permissions, while the decision and the accountability sit with the customer. That is a legitimate choice, provided it is a deliberate one.

Three everyday examples

Ownership analysis. A private, embedded IQ answers from the firm’s live structure data, applies the relevant jurisdiction’s rules and shows its evidence. A public assistant can only analyse what someone exports and pastes, and the result sits outside the firm’s records.

Regulatory change. RegSphere reads the regulator’s own pages, classifies the change and links it to affected entities and deadlines inside the firm’s workflow. Asking a public assistant what changed gives a general answer with no link to the firm’s client book.

Board minutes. IQ drafts minutes from selected source documents within the firm’s environment, marks them as AI drafted and requires a named reviewer. Pasting a draft board pack into a public tool creates a copy that the firm cannot track or withdraw.

A practical way to decide

Before any client data goes to an AI tool, ask five questions:

• Where is the data processed, and does that match client contracts and regulator expectations?

• Is it retained, reviewed by people or used to improve models?

• Who in the firm can see what the AI sees, and is there an audit trail?

• Does a person approve the output before it becomes a record or an action?

• Who is accountable if something goes wrong?

Use private, embedded AI for client files, ownership analysis, risk reviews and regulatory change. Use public AI for general research and non-confidential drafting. Connect a public assistant to client data only by informed choice, with the responsibility understood and written down.

Privacy is a reason to choose carefully, not to wait

Data privacy is not a reason to avoid AI in compliance. It is a reason to choose where that AI lives. A firm that keeps client data inside its own governed environment, lets AI reach out for public regulatory information and treats any public cloud connection as a deliberate decision gets the speed of AI without giving up control.

To see how IQ, RegSphere and meeting workflows keep client data inside your environment, and how a controlled MCP connection works when you want one, book a WealthSphere demo.