ChatGPT for financial advisors: the plan decides the compliance answer

Disclosure: I co-founded Mitosis Labs, which runs Private SuperIntelligence. This is an adaptation of the original guide written for registered investment advisers. General information, not legal advice.

ChatGPT is safe for financial advisors only on a business plan your firm has approved, set up and put under its compliance program. Under the hood, that is a data-flow question with three parts: does the plan train on the input, where does the record go, and who else now holds customer information.

Training and retention by plan

• Free, Plus, Pro: trains by default unless you turn off "Improve the model for everyone". Deleted chats are removed within 30 days, with security and legal exceptions.
• Temporary Chat: no training, but a copy may be kept up to 30 days.
• Business and Enterprise: no training by default; workspace admins set retention.
• API: no training by default; abuse logs up to 30 days by default, Zero Data Retention for approved customers.

Edge cases: a thumbs up or down can send the whole conversation for training, even after you opt out. And in the New York Times copyright case, a federal court ordered OpenAI in May 2025 to preserve ChatGPT output logs that would otherwise have been deleted, an obligation that ended on September 26, 2025.

The record and the vendor

SEC Rule 204-2(a)(7) covers copies of written communications sent relating to any recommendation made or advice given. It says nothing about who, or what, drafted the message, so an AI-drafted client email is still an email you sent. Required records are kept for at least five years.

Amended Regulation S-P defines a service provider as any person or entity that receives, maintains, processes or otherwise is permitted access to customer information through its services to the firm. Pipe client data into a model and the vendor joins your oversight program, including notice within 72 hours of a breach affecting a customer information system it maintains.

For builders, the records row matters most: OpenAI's Compliance Platform for Enterprise and Edu feeds eDiscovery, DLP and SIEM tools; Copilot interactions are searchable with retention set in Microsoft Purview; for Claude for Work, ask Anthropic which archiving routes your plan supports.

Private SuperIntelligence from Mitosis Labs works across a firm's own email, documents and data, answers with citations, and acts only within the permissions the firm sets. Each deployment is built for one client, and the provider keeps no copy of the work, trains nothing on it and cannot see the outputs.

Speak with the founders

Private SuperIntelligence takes a limited number of families at a time so every one gets the same standard of service. Book a private call (ref CFA1-DEV) to talk through your office with Alex Morris.

Prakshal Jain (PJ), Co-founder and CTO, Private SuperIntelligence (by Mitosis Labs)

Alexander Morris, Co-founder and CEO, Private SuperIntelligence (by Mitosis Labs)

Originally published at privatesuperintelligence.si.

Sources: Charles Schwab, 2026-01-22, https://pressroom.aboutschwab.com/press-releases/press-release/2026/Schwab-Study-Reveals-RIA-AI-Adoption-More-Than-Doubles---But-Most-Firms-Still-in-Early-Stages/default.aspx ; Kitces, Weekend Reading for Financial Planners, September 26-27, 2026 (reporting an AssetMark survey), https://www.kitces.com/blog/weekend-reading-for-financial-planners-september-26-27-2026/ ; OpenAI Help Center, Data controls in ChatGPT, https://help.openai.com/en/articles/7730893-data-controls-faq ; OpenAI, Enterprise privacy, https://openai.com/enterprise-privacy/ ; OpenAI, How we're responding to The New York Times' data demands, https://openai.com/index/response-to-nyt-data-demands/ ; Anthropic Privacy Center, Is my data used for model training?, https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training ; Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot, https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy ; 17 CFR 275.204-2 (Legal Information Institute), https://www.law.cornell.edu/cfr/text/17/275.204-2 ; SEC, Enhancements to Regulation S-P, Release No. 34-100155, 2024-05-16, https://www.sec.gov/files/rules/final/2024/34-100155.pdf ; SEC Division of Examinations, Fiscal Year 2026 Examination Priorities, 2025-11-17, https://www.sec.gov/files/2026-exam-priorities.pdf ; SEC press release 2024-36, 2024-03-18, https://www.sec.gov/newsroom/press-releases/2024-36