Accountants are professionally obligated to be skeptical. When you are the custodian of a business's financial records, "where does this data go?" is not paranoia; it is due diligence. So as AI adoption in accounting accelerates, one fear keeps surfacing in firm partner meetings:
"If I connect a client's QuickBooks to an AI, the model will learn from the data, and the client's financials could leak into someone else's chat."
The fear points at something real (data handling deserves scrutiny), but it usually rests on a misunderstanding of how large language models work. Here is the actual mechanics, including the part most reassuring blog posts skip: the one place where the answer genuinely depends on your settings.
Training and Inference Are Different Events
Training is how a model is built. Anthropic, OpenAI, and Google adjust a model's weights over enormous datasets, long before you ever open a chat window. By the time you use Claude or ChatGPT, that process is finished; the model's knowledge is fixed.
Inference is what happens when you use the model. You provide context (a question, a document, a set of transactions) and the model reads that context to produce a response. Its weights do not change. Nothing about inference "teaches" the model your data.
So when an AI reads your client's April bank feed to categorize it, that data is inference-time context. It is not, by that act, added to the model.
What an MCP Connection Actually Shares
DeepLedger connects QuickBooks Online to Claude or ChatGPT through MCP, the Model Context Protocol. The connection does not upload your ledger to the AI provider, and it does not give the model standing access to your database. It works request by request:
- The request. You ask: "Review the uncategorized transactions for Smith Plumbing for April and categorize them based on vendor history."
- The fetch. The assistant calls a DeepLedger tool, which queries QuickBooks for that specific data: the April transactions and the vendor history, not the full client file.
- The reasoning. That data sits in the model's context window while it works: matching "Home Depot #442" to Job Supplies based on prior patterns.
- The action. The assistant sends categorization commands back through DeepLedger, which records the entries in QuickBooks Online.
The system of record stays QuickBooks. The AI saw the slice of data the task required, for the duration of the task.
Where Data Can Persist: the Honest Version
This is the part worth reading carefully, because "nothing is ever retained" would be an overclaim, and you should distrust vendors who make it.
Your chat history keeps the conversation. The transcript, including whatever data the AI fetched into it, lives in your Claude or ChatGPT account until you delete it. That is a feature, but it means access to your chat account is access to what the AI saw. Treat it like any other system that holds client data.
Providers retain operational logs. AI providers keep some data for abuse monitoring and reliability, on retention schedules published in their policies. This is standard for cloud services, including the ones already hosting your tax software and email.
Training use depends on your plan. This is the setting that matters. Under the API and business terms of Anthropic, OpenAI, and Google, customer content is not used to train models by default; that firewall is why enterprises in healthcare, legal, and finance use these APIs at all. Consumer plans are where you must pay attention: they include data controls governing whether conversations may be used to improve models, and the default varies by provider and plan. Before connecting client books, check the data settings on the specific plan you use, or move firm work to a business tier where training use is excluded by default.
That is the accurate picture: the model does not learn your ledger by reading it, and the training question is settled by plan terms and a settings page, not by hoping.
What DeepLedger Stores
DeepLedger's own footprint is deliberately narrow. The platform stores what the product is built around: the shared human/AI task list, close runs, and the per-client memory you can inspect and edit. QuickBooks OAuth tokens are encrypted with AES-256-GCM and never shared between team members. Tool-usage telemetry records metadata only (which tool ran, how long it took, whether it succeeded), not the financial contents of the call. And every AI action lands in a worklog, which is an accountability feature we consider the standard CPAs should demand.
The Due-Diligence Checklist
If you are evaluating any AI tool for client financials, four questions cover the real risk surface:
- Is data read on request through scoped, revocable access, or bulk-uploaded somewhere?
- Under the AI plan we use, is customer content excluded from model training, by terms or by a setting we control?
- What does the tool vendor itself store, and is any of it our clients' financial data?
- Is there a complete log of what the AI read and did?
A tool that answers those four clearly is not a data leak waiting to happen. It is a system you can defend (to a client, a partner, or a regulator), which is the actual standard.
DeepLedger connects QuickBooks Online to Claude or ChatGPT through scoped OAuth, stores no ledger data in its telemetry, and logs every AI action. The first month is free, no credit card required.
Try DeepLedger with your QuickBooks account or read what actually happens when you give an AI write access to your books.