The CFO’s Guide to Uploading Financials to LLMs Without Privacy Risk

TL;DR. The single biggest reason CFOs are not using LLMs on real financials in 2026 is fear of a data leak. It is a solvable problem. This is the exact playbook: three redaction techniques (scaled dollars, synthetic data, and named-entity substitution), the enterprise LLM tiers that meet CFO data-handling requirements, a “safe versus unsafe” table for what to upload and where, and the ten questions to ask any AI vendor before your general counsel signs.

Every CFO I talk to who is not yet using AI on their real financials cites the same reason: “I cannot put client data into ChatGPT.” That is a legitimate concern and also a partially wrong one. The full picture in 2026 is that you can put nearly any financial data into an LLM safely, provided you match the sensitivity of the data to the tier of the tool and do the two-minute prep step for anything that is genuinely client-identifiable.

Below is the framework I run at an operating role and inside multiple portfolio-company engagements, refined with input from a couple of general counsels who make their living saying “no” to things that put clients at risk. If your GC is currently blocking finance from using AI at all, this article is aimed squarely at closing that gap.

The Three Kinds of Data a CFO Handles

Before you can decide what is safe to upload, you have to classify what you have. There are three categories.

Category 1: Aggregated financial figures. Total revenue for the month, gross margin percentage, headcount, cash balance. These are numbers that describe your company at the top-line level. They may be confidential internally, but they do not identify a customer, an employee, or a counterparty.

Category 2: Line-item financial detail that is company-identifiable. A budget vs actual by department, a P&L rolled up to the account level, a trial balance. Confidential and competitively sensitive, but still not naming outside parties.

Category 3: Data that identifies real outside parties. AR aging by customer name, AP by vendor name, employee payroll register, cap table with individual investor names, K-1s with SSNs, bank account and routing numbers, deal-specific due diligence materials, MSA and DPA contracts with counterparty names. This is the tier that most legal teams (rightly) treat as sacred.

The rest of this article is essentially: what to do with each category, at what LLM tier.

The Safe vs Unsafe Table

Data Type	Consumer Free Tier	Consumer Paid	Enterprise Tier (with DPA)
Aggregated numbers (revenue, margin %, cash)	Yes (Category 1)	Yes	Yes
Line-item P&L, department budget	Scale first	Scale first	Yes
Trial balance	Scale first	Scale first	Yes
AR aging with customer names	NEVER	Redact names	Yes (with DPA)
AP with vendor names	NEVER	Redact names	Yes (with DPA)
Employee payroll register	NEVER	NEVER	Yes (with DPA + HR sign-off)
Cap table with individual names	NEVER	NEVER	Yes (with DPA)
SSN, EIN, bank routing, account numbers	NEVER	NEVER	NEVER (strip these regardless)
Deal-specific due diligence, NDA-covered material	NEVER	NEVER	Check the underlying NDA first

Two rows in that table deserve extra emphasis. First, SSN and bank routing data. There is no legitimate CFO analysis that requires those numbers to be inside the LLM prompt. Strip them before you paste, always. Second, NDA-covered deal material. Even at the enterprise tier, if a specific NDA prohibits disclosure to third parties, most LLM vendors qualify as third parties for that purpose. Read the NDA before you assume.

Redaction Technique 1: Scaled Dollars

The fastest, most reliable technique for financial data. Multiply every dollar figure by a constant (0.37 or 3.14 or whatever you pick), paste the scaled data to the LLM, get the analysis back, and un-scale mentally when you review.

Why it works. Ratios, variance percentages, directional patterns, and the shape of the P&L are all preserved. A 12% variance is still a 12% variance whether the underlying dollars are $118,000 or $43,660. What is lost is the actual dollar magnitude, which is what makes the data identifiable if leaked.

The 3-line prep script (Python):

import pandas as pd
df = pd.read_csv("weekly_pl.csv")
SCALE = 0.37
for col in ["Actual", "Budget", "Prior_Week"]:
    df[col] = (df[col] * SCALE).round(0)
df.to_csv("weekly_pl_scaled.csv", index=False)

Excel version, for CFOs who do not have Python installed: add a new column with formula =A2*0.37 for the scaling column, copy down, copy the scaled block, paste into the LLM.

Covers 80% of the weekly analysis workflow. Variance narratives, forecast tables, budget-to-actual walks, all work fine on scaled data because they operate on relative movements.

Redaction Technique 2: Named-Entity Substitution

For any dataset with customer, vendor, employee, or counterparty names, replace the real names with generic labels before pasting. “Acme Corp” becomes “Customer_A”. “Bank of America MSA” becomes “Bank_B MSA”. Keep a small mapping file locally so you can un-substitute when the analysis comes back.

The 3-line prep script:

import pandas as pd
df = pd.read_csv("ar_aging.csv")
name_map = {name: f"Customer_{chr(65+i)}" for i, name in enumerate(df["Customer"].unique())}
df["Customer"] = df["Customer"].map(name_map)
df.to_csv("ar_aging_redacted.csv", index=False)
# save name_map to a local JSON file so you can un-substitute later

Combined with scaled dollars, this technique makes an AR aging effectively non-identifiable. The LLM sees “Customer_A owes 41,000 in the 31-60 bucket.” Meaningless to anyone who does not have your mapping file.

Failure mode to avoid. Do not use “Customer_1”, “Customer_2”, “Customer_3” if the numeric suffix corresponds to rank order in the input. Anyone who knows your customer base could re-identify the top 3 or top 5 customers by ranking. Randomize the letter assignment before substituting.

Redaction Technique 3: Synthetic Data for Prompt Iteration

Use this for the prompt-engineering phase, not for the final analysis. When you are iterating on a prompt template (adjusting rules, testing edge cases), do it against synthetic data that looks like your real data in structure but contains no real information.

Generate a synthetic dataset once per major workflow. Match the structure (same columns, same row counts, same value distributions), then never touch real data until the prompt is dialed in. When you switch to real data, you already know the prompt works; the only variables are the numbers.

Simple Python for synthetic P&L:

import pandas as pd, numpy as np
np.random.seed(42)
lines = ["Revenue", "COGS", "Gross Profit", "Sales", "G&A", "R&D", "EBITDA"]
df = pd.DataFrame({
    "Line": lines,
    "Actual": np.random.randint(50000, 500000, 7),
    "Budget": np.random.randint(50000, 500000, 7),
    "Prior_Month": np.random.randint(50000, 500000, 7),
})
df.to_csv("synthetic_pl.csv", index=False)

This is the technique that has saved me the most heartburn. Iterating on a prompt against real data is where accidental leaks happen. Iterating on synthetic data eliminates that class of mistake entirely.

Enterprise LLM Tiers That Meet CFO Data-Handling Requirements

If your organization is willing to sign an enterprise contract, most of the redaction workflow becomes optional. The four tiers that qualify as of 2026:

Claude for Work (Team or Enterprise). Anthropic contractually commits that customer inputs and outputs are not used to train Claude by default. SOC 2 Type II report available under NDA. HIPAA-eligible with BAA at the Enterprise tier. DPA available. Standard 30-day zero-retention available at Enterprise for customers with strong data-handling requirements.

ChatGPT Enterprise (or Business with the enterprise privacy setting on). OpenAI contractually commits inputs are not used for training. SOC 2 Type II. Signed DPA. Admin console with SSO, audit logs, and data-retention controls. Business tier requires explicitly toggling the enterprise privacy setting; do that before you consider it CFO-ready.

Microsoft 365 Copilot with Commercial Data Protection. Prompts and responses stay within the M365 compliance boundary. Same tenant, same DLP, same eDiscovery, same retention as the rest of your M365 estate. If your company is already on M365 with an established data-handling posture, Copilot inherits it. This is the path of least resistance for most CFOs already inside the Microsoft ecosystem.

Gemini for Google Workspace (Business or Enterprise). No training on Workspace data. Data stays within the Workspace tenant. Data Loss Prevention rules apply. Same admin controls as the rest of Workspace.

None of these tiers absolves you from the SSN, bank routing, and NDA-covered material considerations. Those still get stripped or excluded, always.

The 10 Questions to Ask Any AI Vendor

This is the checklist to hand your general counsel and IT security team when you are evaluating a tool. If the vendor cannot answer all ten satisfactorily, they are not ready for CFO data.

Are customer inputs and outputs used to train your models? At which tier is opt-out available, and is it opt-out by default or does the customer have to configure it?
Where is data physically stored (US, EU, other), and can the customer specify region?
What is the data retention policy? Is zero-retention available?
Do you provide a signed DPA? Can we review the standard one before signing?
Do you provide a SOC 2 Type II report? What is the audit period covered?
Do you offer HIPAA BAA if we handle regulated healthcare data?
Who has employee access to customer data at your company? What are the access controls, and can we get an audit report?
How do you handle a data breach notification? What is the SLA for notifying us?
What happens to customer data if the vendor relationship ends? Certificate of destruction available?
Can we get a list of your subprocessors (upstream cloud providers, third-party services)? How do we get notified when the list changes?

Anthropic, OpenAI, Microsoft, and Google can answer all ten for their enterprise tiers. Most smaller AI startups can answer maybe six. That is not a knock; it is a maturity gate. Save the smaller vendors for lower-sensitivity workflows until they mature.

What I Would Never Upload

Even at the enterprise tier, there are a small number of things that never go into an LLM prompt in my workflow. Not because the vendor is untrustworthy, but because the risk-reward is asymmetric: near zero analytical value, catastrophic tail risk if something goes wrong.

Social Security Numbers. There is no LLM prompt that improves with an SSN in it. Strip them from any payroll or 1099 file before pasting, always.
Bank routing and account numbers. Same reasoning. If you need to analyze cash flow by account, use redacted account labels (“Operating”, “MMDA”, “Restricted”) and never the actual numbers.
Individual health-plan enrollment data. Even inside a payroll register, the health-plan election column has HIPAA implications. Drop the column.
Signed deal terms of active M&A transactions. Until the deal is public, the LOI, MSA drafts, and DD folder do not go into an LLM. Move that workflow to whatever secure deal-room tool you use, or wait until close.
Customer PII outside of what is needed for the analysis. A collection call list needs customer name and amount. It does not need the customer contact’s home address, phone number, or birthday. Strip those columns.

Building a Privacy-Safe Workflow

Three practical steps to move from “not using AI because of privacy fear” to “using AI on real data every week.”

Step 1: Get one enterprise seat. Buy one Claude for Work seat or one ChatGPT Enterprise seat for the CFO office. This month. Do not wait for a broader company rollout. One seat unlocks the majority of the workflows and gives you a defensible answer to “how do we handle CFO data in AI?” (answer: on the enterprise tier with a DPA).

Step 2: Write a one-page internal AI usage policy for finance. Cover: what tiers are approved (name the tier), what data types are approved at each tier (use the table above), the ten vendor questions as the standard for any new tool, and a “when in doubt, strip it” default. Have your GC review. This document is what makes the workflow scalable across your team; without it, everyone makes ad-hoc decisions.

Step 3: Run one workflow end-to-end on real data. Pick the weekly variance narrative. Redact using the scaled-dollars technique. Run it through your enterprise-tier LLM. Compare the output to what your team would have written manually. Do this three weeks in a row. By week three you will have proved the workflow is safe and useful, and you will have concrete evidence to expand.

Push back on this.

Every operator’s situation is a little different. If you run this differently, disagree with the methodology, or think we got something wrong, tell us. We publish the best counter-approaches on our Reader Contributions page, credited or anonymous, your call. Email hello@thepragmaticcfo.com.

Frequently Asked Questions

My general counsel says no AI on any client data. What do I do?

Ask your GC to specify which of the following they are worried about: training data reuse, breach notification exposure, subprocessor chain, or contractual obligation to specific clients. Then map their answer to the ten questions above and share the vendor’s responses. In my experience, most “no” positions are actually “not without answers to specific questions.” Get those answers and revisit. If the “no” is grounded in a specific client contract, that is a different (harder) conversation.

Is scaling dollars really enough redaction?

For Category 1 and 2 data (aggregated numbers, line-item detail without outside names), yes. For Category 3 data (customer names, employee data), no; you need named-entity substitution as well or an enterprise tier. The privacy value comes from combining techniques, not from any single one being bulletproof.

What about local LLMs I run on my own laptop?

Available in 2026 (Llama 4, DeepSeek, Mistral variants), and they solve the training-data-leak concern completely. Downsides: quality gap to frontier models on the actual analytical tasks CFOs do, and the operational overhead of maintenance. For most CFOs, the enterprise tier of a frontier model is a better trade-off. For CFOs handling extremely sensitive material regularly, local models are worth the investment.

If I paste real data into the free ChatGPT tier by accident, what should I do?

Delete the conversation immediately. OpenAI’s policy is that deleted conversations are purged from their systems within 30 days. Report the incident internally to whoever owns your data-handling policy. Then move that workflow to the enterprise tier. Do not compound one mistake by pretending it did not happen; the reporting is what makes the incident learnable and prevents the next one.

Can I use AI on my client’s data with their permission?

Yes, and this is increasingly the norm in accounting and advisory. Get the permission in writing, name the specific tool and tier you are using, describe the data types covered, and reference your internal AI usage policy. Some clients will decline; respect that and use manual analysis for those engagements. Most clients in 2026 are already using AI themselves and are relieved to see their advisors doing the same.

Sources

Written by The Pragmatic CFO. 15+ years running P&Ls and AI-native finance experiments across portfolio companies.