Yes, for most of what lands in a practice mailbox, and no for some of it. Safety here is a property of a pairing: this data, this task, this much freedom to act. Sort those three and you can answer the question for your own practice.
- Most firms sort the mailbox by how sensitive a field feels, and federal law draws the line somewhere else. For a return client, the name is already protected information.
- What raises the risk is what the model is allowed to do next: read, draft, or send.
- Under the Safeguards Rule, choosing the vendor is itself the compliance, and the rule says what shape that choice takes.
- The lines that actually get crossed run through households and entities as well as between clients. You’re the only one who can see them.
What are you actually protecting?
Two different harms wear the same word, and a practice needs both answered.
One is a duty. A client told you something in confidence and it reached someone else. The harm is the disclosure itself, whether or not anybody acts on it. The remedy is professional and contractual.
The other is a capability. A routing number, an EIN, a date of birth and a prior-year AGI are usable. Handed to the right stranger, they open an account, redirect a refund, or move money out of a client’s bank.
Most conversations about AI and client data answer the first and assume the second came with it. They’re two problems with two sets of controls. Confidentiality turns on who you disclose to and on what terms, which makes it a contract question. Fraud turns on what can be intercepted, impersonated or forwarded on, which makes it a security question. A vendor can answer one faultlessly and stay silent on the other. The rest of this page keeps splitting along that line.
Sorting by field does not work
The instinct is to grade the mailbox by how sensitive each thing feels. Social Security numbers at the top, bank statements under them, and at the bottom the ordinary traffic: a name, an address, a note confirming who you act for.
Federal law draws the line somewhere else, and this is the one place the gap is worth stopping over. The regulation under 26 U.S.C. §7216 defines the protected category as “any information, including, but not limited to, a taxpayer’s name, address, or identifying number, which is furnished in any form or manner for, or in connection with, the preparation of a tax return of the taxpayer” (26 CFR §301.7216-1, checked August 19, 2026). The name is in. The address is in. That this person is your client at all, furnished in connection with preparing their return, is in.
So the bottom of the list sits inside the category alongside everything above it. The tidy plan is to keep the sensitive threads away from the software and let it have the ordinary ones. That plan doesn’t survive the definition. Once you prepare a return for somebody, nearly everything in the thread belongs to the category.
Two things follow. The question attaches where you disclose: the moment you connect a mailbox, the tool can read what’s in it. And whether that particular disclosure needs a signed consent or falls inside one of the narrow service-provider exceptions is a real analysis for your own adviser, in either direction. The general duty, and the list to send a vendor before you connect, is a subject of its own.
Which leaves the sort that does work.
What the AI is allowed to do next
Three verbs, and they’re nothing like the same size.
Reading. Ranking a thread, summarizing it, pulling a total out of an attachment. Data goes to a model and an answer comes back to you. Everything stays inside your practice, so the whole exposure is the vendor’s chain: who processes it, where, for how long, and under what contract. A serious vendor answers all four in writing.
Drafting. Now the data comes back rearranged. A summary of one client’s position, a reply carrying a figure forward, a chase quoting what was agreed in June. It’s all still inside your practice. Something exists in a new shape now, though, and shapes travel.
Sending. The shape leaves. A reply goes out, a file attaches, an invite lists an address. Both harms become real at the same moment, and this is the one verb you can’t take back.
Risk is roughly the data multiplied by the verb, which is why the two ends of the range look so unalike. A model reading a K-1 so it can tell you the thread is about a partnership is a small event. The same model sending a reply that recaps that K-1 to six people on a chain is a large one. The verb opened that gap, and how sensitive the K-1 was barely moved it.
So the control that earns its keep in an AI email tool is a setting for how far the software may go. You hold it separately for each kind of work. Filing and ranking run at full speed, and anything that leaves the building waits for you.
Choosing the vendor is the compliance act
If you prepare returns, the FTC’s Safeguards Rule treats your practice as a financial institution, and the rule has a paragraph about precisely this decision. It requires you to take “reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue”. It also requires “your service providers by contract to implement and maintain such safeguards”. And it requires you to carry on “periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards” (16 CFR §314.4(f), checked August 19, 2026).
That paragraph is an instruction, and a usable one. It tells you the decision has a required shape: select on capability, put the safeguards in the contract rather than on a web page, and look again later. So “is it safe” is a question the rule expects you to answer on evidence, and to answer again later.
The same rule also tells you what standard you may hold a supplier to, because it holds you to it first: encrypt “all customer information held or transmitted by you both in transit over external networks and at rest”. Paragraph (f)(2) is how that reaches your vendor, by contract. A supplier whose security page is vaguer than your own obligation has told you something useful about itself.
The lines the software cannot see
Here’s the part specific to a practice, and it’s about people rather than models.
Confidentiality inside an accounting firm runs through households. A couple filed jointly last year and will file apart this year, each entitled to that return and neither entitled to what the other has told you since. It runs through entities: a partner who may see the partnership return, where another partner’s capital account correspondence stays closed to them. It runs around a client’s own people: the bookkeeper who has been on every thread for four years and is also, separately, a client of yours.
All of that lives in a person’s memory. To any tool, and to the inbox you have today, those are contacts on threads. A person holds the line by remembering it. That’s why the failure a firm actually has is a message to the wrong recipient rather than a breach, and why it happens on a Tuesday in March.
An AI email tool moves that number in both directions at once. Drafting for you means more messages composed by something that has only the thread to go on, and a draft that reads well is easy to send with a glance. Ranking for you means the message you’d have missed at position ninety sits at the top instead, which is the other half of the same duty. Where you set the verb decides which way it nets out in your practice, and it’s the one lever that reliably moves it.
So the instruction is smaller than the fear. Let reading and ranking run. Keep drafting supervised on any thread that touches a line only you know about. Treat sending to a client the way you treat signing something.
Where does Point fit?
Point is an AI email client, so every line above applies to Point as much as to anything else you’d connect a practice mailbox to.
- The verb is a dial, and you set it per kind of work. Suggest only, prepare and wait for your approval, or handle it. Out of the box every kind sits on review. Push one to the top and Point gets on with the job by itself, which is the whole point of pushing it up. So the split this page argues for is one you can actually configure: filing and ranking loose, client replies held back.
- Every action Point takes lands in a log you can read, and most of them can be reversed. Sending is the exception, and it’s the one that matters here. A message already delivered is sitting on somebody else’s server, and no product pulls it back.
- The separation runs between the businesses you operate. A practice and a rental company stay apart. Every client you act for shares the one practice mailbox, which is what lets you notice the same name arriving three times in a week.
- One thread that has to stay between two people only can be locked end to end, and that one stays closed to Point as well. It’s a lane for a single thread rather than a mode for the whole mailbox. A locked message gets no summary, no ranking, and no task lifted out of it.
On the chain behind all of that, subprocessors names the other companies rather than describing them, and the terms carry the training position and the regulated-data carve-out. That’s the paragraph to read before you connect. Everything Point does is the full inventory, and the accountants page puts the same ground in a practice’s terms.
Common questions
Is it safer to take the numbers out before letting AI near a thread?
It helps less than you’d hope, because the category you’re protecting is wider than the numbers. Once you’re preparing a return, the regulation counts the client’s name and address as return information alongside the identifying number. A thread stripped of figures is still inside the category. Redaction is a decent habit against the fraud half of the problem, and the confidentiality half stays exactly where it was.
Does it matter that the tool only reads my mail and never sends anything?
It matters more than any other single fact about the tool. Reading keeps the data inside your practice, so the whole exposure is the vendor’s chain and the whole answer is available in writing. The moment software may draft and send, a mistake turns into a message a client has already received.
Do I need to tell clients before I connect the mailbox?
Settle it at connection, because connection is when the disclosure happens. Whether it needs a signed consent or falls inside a service-provider exception depends on the work you do and on terms your own adviser should read. Most firms handle it in the engagement letter, and that’s a cheaper conversation than the one that follows a surprise.
Two clients on one return have separated. Will the software know?
No, and the inbox you use today is in the same position. That line lives in your head and in a note somewhere, out of reach of anything a tool reads off the thread. It’s the clearest case for keeping the sending verb low. Let ranking and summarizing work on those threads all they like, and keep the drafts in front of you.
Which setting should I raise first?
The work that stays inside the building. Filing, ranking, summarizing, answering a question about an attachment: those are all reading, and a mistake there costs you a second look. Leave replies to clients on review until you’ve watched the drafts through a season. Raise scheduling well before you raise anything that carries a number out of the door.
The short version
- Two harms hide behind one word. A duty breached is a contract problem, an identifier loose is a fraud problem, and a vendor can answer one and stay silent on the other.
- Federal law draws the protected category wider than a sense of what feels sensitive. For a return client, the name and the address are already inside it.
- The verb decides the risk. Reading keeps the data in your practice, drafting makes a new shape, and sending is the one you can’t take back.
- Under the Safeguards Rule, choosing the vendor is itself the regulated act: select on capability, put the safeguards in the contract, and assess again later.
- The lines that actually get crossed run through households, entities and a client’s own staff, and you’re the only one who can see them. Keep the verb low wherever that’s true.
What an AI email client is defines the category. The client data guide has the general duty and the questions to put to a vendor. AI email for accountants covers which of the five kinds of product you’re actually choosing between. The calm version of all of it is Point.