PRIVATE AI FOR CA FIRMS: COMPLIANT AI THAT KEEPS CLIENT DATA OFF PUBLIC SERVERS
Your articled assistants and managers are using ChatGPT with client financials today. Every balance sheet, every tax return, every audit working paper — sent to OpenAI servers in the United States. Here's why that's a problem, and how to fix it in under an hour.
THE ICAI CONFIDENTIALITY OBLIGATION
The ICAI Code of Ethics imposes one of the strictest confidentiality obligations in any Indian profession. Section 140 of the Companies Act reinforces this. The duty extends to all client information obtained during the engagement — financial statements, tax positions, correspondence, and anything in between.
When your staff uploads a client's trial balance to ChatGPT, they are disclosing that information to a third party. That third party is OpenAI — a US company, subject to US law, with data centres outside India. ICAI has not issued a formal AI guidance note yet, but the existing framework leaves little ambiguity: disclosure to an AI provider is still disclosure.
The legal exposure
A client complaint to ICAI citing data breach through an AI tool could trigger disciplinary proceedings. The fact that it was "just ChatGPT" is not a defence under the Code of Ethics.
WHAT YOUR TEAM IS ACTUALLY DOING
Walk through any CA firm and you'll find AI use scattered across the practice — mostly informal, mostly unsupervised:
- ✗Pasting client P&L statements into ChatGPT to identify anomalies
- ✗Uploading audit working papers to Copilot for summarisation
- ✗Asking Gemini to draft management representation letters with client-specific figures
- ✗Using AI to analyse client GST data for discrepancies
- ✗Feeding client tax computation into AI to check for deduction eligibility
Each of these sends client financial data to servers outside India, under terms your firm never agreed to and cannot audit. The engagement letter your client signed almost certainly does not permit this.
THE DPDP ACT DIMENSION
India's Digital Personal Data Protection Act 2023 classifies financial information as sensitive personal data. Cross-border transfer of such data requires explicit consent and compliance with central government restrictions — restrictions that have not been lifted for ad hoc AI tool usage.
For CA firms that handle data of individual clients — not just corporates — each use of a public AI tool is a potential DPDP violation. The penalties under the Act are significant: up to ₹250 crore per breach.
No data processing agreement
OpenAI's Terms of Service are not a data processing agreement under Indian law. You cannot demonstrate lawful basis for the transfer.
No purpose limitation
Client data shared with ChatGPT may be used to improve OpenAI's models. This is outside the scope of your engagement with the client.
No audit rights
If a regulator asks how client data was processed, you cannot produce an audit trail from OpenAI. A private server gives you complete logs.
HOW A PRIVATE AI SERVER WORKS FOR A CA FIRM
A private AI server is a dedicated virtual machine running open-source language models on infrastructure you control. Your staff access it through a familiar chat interface — identical to ChatGPT — but no data ever leaves your server.
For a CA firm, the practical workflow looks like this: your articled assistant wants to check whether a client's depreciation calculation is correct. They open the firm's AI portal, paste in the figures, and get an analysis. That data touches your server and nothing else. There is no OpenAI. There is no third party.
Document analysis
Upload financial statements, audit reports, or tax orders directly to the AI for summarisation and query.
Drafting
Generate audit observations, management letters, and tax opinions without any data leaving the firm.
Research
Run AI queries against Income Tax Act provisions, ICAI standards, or company law — all within your server.
Client-by-client isolation
Separate conversation threads per client. No cross-contamination of financial data across engagements.
Audit trail
All conversations logged on your server. Full visibility for the firm's partners.
IMPLEMENTATION FOR CA FIRMS
We recommend the following setup for a typical CA practice:
- 01.One server for the entire firm. All staff — partners, managers, articled assistants — get accounts on the same private server. No per-seat fees.
- 02.Write a firm AI policy. Document what may and may not be entered into the AI. Even on a private server, certain privileged legal communications should stay out of AI tools.
- 03.One thread per client engagement. Open WebUI maintains conversation history per thread. Use naming conventions: "Sharma Industries — FY26 Audit".
- 04.Include in your data register. Under DPDP Act 2023, document the AI tool in your firm's personal data processing register. Note: private server, no third-party disclosure, data stored in India.
- 05.Inform clients if required. If your engagement letter covers data processing, add a clause noting the firm uses a private AI server. No client data is shared with third parties.
THE COST REALITY
ChatGPT Team for a 15-person CA firm — partners, managers, seniors, and articles — costs $450/month (~₹37,500) in USD. That's before accounting for currency risk as the rupee fluctuates.
NestAI's team server costs ₹11,999/month for unlimited users. For the same 15-person firm, that's a saving of over ₹25,000 every month — with stronger compliance guarantees, not weaker ones.
For CA Firms
ICAI-COMPLIANT AI FOR YOUR PRACTICE
Private server. Client data stays in India. Entire firm on one plan.
₹11,999/month · UPI payment · Deploy in 33 minutes
Deploy Now →