Yes, for most of what lands in a practice mailbox, and no for some of it. Safety here is not a property of the tool. It is a property of a pairing: this data, this task, this much freedom to act. Sort those three and the question stops being unanswerable.
- The sort most firms reach for, by how sensitive a field feels, has no legal floor under it. For a return client, the name is already protected information.
- What raises the risk is not that a model read the mail. It is what the model is allowed to do next: read, draft, or send.
- Choosing the vendor is not the preliminary to compliance. Under the Safeguards Rule the choosing is the compliance, and the rule says what shape it takes.
- The lines that actually get crossed run through households and entities, not just between clients, and nothing you connect can see them.
What are you actually protecting?
Two different harms wear the same word, and a practice needs both answered.
One is a duty. A client told you something in confidence and it reached someone else. The harm is the disclosure itself, whether or not anybody acts on it, and the remedy is professional and contractual.
The other is a capability. A routing number, an EIN, a date of birth and a prior-year AGI are not embarrassing to anyone. They are usable. Handed to the right stranger they open an account, redirect a refund, or move money out of a client’s bank.
Most conversations about AI and client data answer the first and quietly assume the second came with it. They are separate problems with separate controls. Confidentiality is decided by who you disclose to and on what terms, which is a contract question. Fraud is decided by what can be intercepted, impersonated or forwarded on, which is a security question. A vendor can give a faultless answer to one and nothing at all to the other, and the rest of this page keeps splitting along that line.
Sorting by field does not work
The instinct is to grade the mailbox by how sensitive each thing feels. Social Security numbers at the top, bank statements under them, and at the bottom the harmless traffic: a name, an address, a note confirming who you act for.
Federal law does not grade it that way. The regulation under 26 U.S.C. §7216 defines the protected category as “any information, including, but not limited to, a taxpayer’s name, address, or identifying number, which is furnished in any form or manner for, or in connection with, the preparation of a tax return of the taxpayer” (26 CFR §301.7216-1, checked 19 August 2026). The name is in. The address is in. That this person is your client at all, furnished in connection with preparing their return, is in.
So the bottom of the list was never the bottom, and the tidy plan of keeping the sensitive threads away from the software while letting it have the ordinary ones does not survive contact with the definition. Once you prepare a return for somebody, nearly everything in the thread belongs to the category.
Two things follow. The question attaches where you disclose, not where the software does something interesting: the moment a mailbox is connected, the tool can read what is in it. And whether that particular disclosure needs a signed consent or falls inside one of the narrow service-provider exceptions is a real analysis for your own adviser rather than a thing to assume in either direction. The general duty, and the list to send a vendor before you connect, is a subject of its own.
Which leaves the sort that does work.
What the AI is allowed to do next
Three verbs, and they are nothing like the same size.
Reading. Ranking a thread, summarizing it, pulling a total out of an attachment. Data goes to a model and an answer comes back to you. Nothing has left your practice that was not already inside it, so the whole exposure is the vendor’s chain: who processes it, where, for how long, and under what contract. That is answerable in writing, and a serious vendor answers it.
Drafting. Now the data comes back rearranged. A summary of one client’s position, a reply carrying a figure forward, a chase quoting what was agreed in June. Still nothing has left. But something now exists in a new shape, and shapes travel.
Sending. The shape leaves. A reply goes out, a file attaches, an invite lists an address. Both harms become real at the same moment, and this is the only verb you cannot take back.
Risk is roughly the data multiplied by the verb, which is why the two ends of the range look so unalike. A model reading a K-1 so it can tell you the thread is about a partnership is a small event. The same model sending a reply that recaps that K-1 to six people on a chain is not, and the gap between them has almost nothing to do with how sensitive the K-1 was.
This is the reason the useful control in an AI email tool is not a switch marked private. It is a setting for how far the software may go, held separately for each kind of work, so filing and ranking can run at full speed while anything that leaves the building waits for you.
Choosing the vendor is the compliance act
If you prepare returns, the FTC’s Safeguards Rule treats your practice as a financial institution, and the rule has a paragraph about precisely this decision. It requires you to take “reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue”, to require “your service providers by contract to implement and maintain such safeguards”, and to carry on “periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards” (16 CFR §314.4(f), checked 19 August 2026).
Read that as an instruction rather than a warning. It tells you the decision has a required shape: select on capability, put the safeguards in the contract rather than on a web page, and look again later. “Is it safe” is not something you are permitted to answer once, by feel, on the evening you sign up.
The same rule also tells you what standard you may hold a supplier to, because it holds you to it first: encrypt “all customer information held or transmitted by you both in transit over external networks and at rest”. Paragraph (f)(2) is how that reaches your vendor, by contract. A supplier whose security page is vaguer than your own obligation has told you something useful about itself.
The lines the software cannot see
Here is the part specific to a practice, and it is not about models at all.
Confidentiality inside an accounting firm does not run in a neat ring around each client. It runs through households: a couple who filed jointly last year and will not this year, each entitled to that return and neither entitled to what the other has told you since. It runs through entities: a partner who may see the partnership return and may not see another partner’s capital account correspondence. It runs around a client’s own people: the bookkeeper who has been on every thread for four years and is also, separately, a client of yours.
None of that is written down anywhere a machine can read. To any tool, and to the inbox you have today, those are contacts on threads. A person holds the line by remembering it, which is why the failure a firm actually has is a message to the wrong recipient rather than a breach, and why it happens on a Tuesday in March.
An AI email tool moves that number in both directions at once. Drafting for you means more messages composed by something that does not know the couple separated, and a draft that reads well is easier to send without looking hard. Ranking for you means the message you would have missed at position ninety is sitting at the top instead, which is the other half of the same duty. Which way it nets out in your practice is decided by where you set the verb, and that is the only lever that reliably moves it.
So the instruction is narrower than the fear. Let reading and ranking run. Keep drafting supervised on any thread that touches a line only you know about. Treat sending to a client the way you treat signing something.
Where does Point fit?
Point is an AI email client, so everything above applies to Point as much as to anything else you would connect a practice mailbox to.
- The verb is a dial, and it is set per kind of work. Suggest only, prepare and wait for your approval, or handle it. Out of the box every kind sits on review, and pushing one to the top means Point stops checking in and gets on with the job, which is the whole point of pushing it up. The split this page argues for is therefore one you can actually configure: filing and ranking loose, client replies held back.
- Every action Point takes lands in a log you can read, and most of them can be reversed. The exception is the one that matters here. A message already delivered is sitting on somebody else’s server, and no product pulls it back.
- The separation runs between the businesses you operate, not between the clients inside one. A practice and a rental company stay apart. Every client you act for shares the one practice mailbox, which is what makes it possible to notice the same name arriving three times in a week.
- One thread that must stay between two people only can be locked end to end, and Point cannot read that one either. It is a lane rather than a mode for the whole mailbox, because a locked message gets no summary, no ranking, and no task lifted out of it.
On the chain behind all of that, subprocessors names the other companies rather than describing them, and the terms carry the training position and the regulated-data carve-out, which is the paragraph to read before you connect rather than after. Everything Point does is the full inventory, and the accountants page puts the same ground in a practice’s terms.
Common questions
Is it safer to take the numbers out before letting AI near a thread?
Less than you would hope, because the category you are protecting is wider than the numbers. Once you are preparing a return, the regulation counts the client’s name and address as return information alongside the identifying number, so a thread stripped of figures is still inside it. Redaction is a decent habit against the fraud half of the problem and does very little about the confidentiality half.
Does it matter that the tool only reads my mail and never sends anything?
It matters more than any other single fact about the tool. Reading keeps the data inside your practice, so the whole exposure is the vendor’s chain and the whole answer is available in writing. The moment software may draft and send, a mistake stops being a question about a supplier’s storage and becomes a message a client has already received.
Do I need to tell clients before I connect the mailbox?
Settle it at connection rather than at first use, because connection is when the disclosure happens. Whether it needs a signed consent or falls inside a service-provider exception depends on the work you do and on terms your own adviser should read. Most firms deal with it in the engagement letter, which is a cheaper conversation than the one that follows a surprise.
Two clients on one return have separated. Will the software know?
No, and neither does the inbox you use now. That line lives in your head and in a note somewhere, not in anything a tool reads off the thread. It is the clearest case for keeping the sending verb low: let ranking and summarizing work on those threads all they like, and keep the drafts in front of you.
Which setting should I raise first?
The work that never leaves the building. Filing, ranking, summarizing, answering a question about an attachment: those are all reading, and a mistake there costs you a second look. Leave replies to clients on review until you have watched the drafts through a season, and raise scheduling well before you raise anything that carries a number out of the door.
The short version
- Two harms hide behind one word. A duty breached is a contract problem, an identifier loose is a fraud problem, and a vendor can answer one and be silent about the other.
- Grading your mailbox by how sensitive a field feels has no legal floor under it. For a return client, the name and the address are already inside the protected category.
- The verb decides the risk. Reading keeps the data in your practice, drafting makes a new shape, and sending is the one you cannot take back.
- Under the Safeguards Rule, choosing the vendor is itself the regulated act: select on capability, put the safeguards in the contract, and assess again later.
- The lines that actually get crossed run through households, entities and a client’s own staff, and no software can see them. Keep the verb low wherever you are the only one who knows.
What an AI email client is defines the category, the client data guide has the general duty and the questions to put to a vendor, and AI email for accountants covers which of the five kinds of product you are actually choosing between. The calm version of all of it is Point.