It can be. Three things decide it: how much the tool does on its own, whether you can see and correct what it did, and whether the vendor will tell you in writing where your data goes and who else touches it. Judge a product on those three.
- The duty stays with you. No vendor takes it off you, and their contract almost certainly caps what they owe you if it goes wrong.
- The questions worth asking are about data handling: training, storage, retention, access, the other companies in the chain, and which country it all sits in.
- Some inboxes shouldn’t be connected to any AI tool on standard terms. Tax return information is the clearest case, and it’s usually carved out in the vendor’s own contract.
Does the duty transfer to the vendor?
No. Buying a tool moves the work. The responsibility stays with you, and the rest of this page hangs off that. Writing for US practitioners in April 2026, The Tax Adviser put it in a line: “The CPA firm can outsource a task or function, but its responsibility cannot be outsourced.”
In the United States, three things stack on a small accounting or tax practice. The AICPA’s Confidential Client Information Rule (ET §1.700.001) sits behind the profession’s confidentiality obligations. Putting client information into a third-party tool counts as a disclosure.
If you prepare federal returns, it’s also criminal law. 26 U.S.C. §7216 covers a preparer who knowingly or recklessly discloses return information, or uses it for anything other than preparing the return. That preparer “shall be guilty of a misdemeanor, and, upon conviction thereof, shall be fined not more than $1,000 … or imprisoned not more than 1 year, or both.”
And the FTC Safeguards Rule (16 CFR Part 314) requires a “comprehensive information security program that is written in one or more readily accessible parts.” Tax preparers are squarely inside it. The rule’s own examples state that “an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution.” Being small still leaves you the written program. Firms holding information on fewer than five thousand consumers are exempt from four specific requirements, and the written program is one they keep.
If you practice elsewhere, your own rule book applies and the problem is the same. Look up your institute’s confidentiality rule, and what your data protection law says about processors.
Then the part vendors rarely volunteer. Every software contract caps what the vendor owes you if they lose your clients’ data. Point’s own terms cap it at the greater of twelve months of fees or US $100, with carve-outs for fraud, willful misconduct and gross negligence. That’s an ordinary cap, which is why it’s worth reading. Whatever a security page says, the contract has already decided that the consequences of a breach are mostly yours.
Good software still clears all of this. Plenty of firms use cloud tools daily and meet these duties. The vendor has to earn a place inside your obligation, and one that’s vague about control or data handling hasn’t earned it, however clever it is.
What are the real risks?
Four, and the last two are the ones that get left out.
The first is where your data goes. Connecting your email to any tool means that tool can read your mail. What matters is what happens next: whether it’s stored, how long, who can see it, and whether it trains models. Some vendors are clear about this and some are vague, and the difference matters more than any feature.
The second is a breach at the vendor. Anything you connect to becomes part of your security surface. A serious vendor guards your credentials and your mail closely; a careless one is a liability no matter how good the product looks.
The third is specific to AI email rather than to software generally, and it gets underweighted: the tool acts on your behalf, and it can get it wrong. These systems are probabilistic and will be wrong some of the time. A wrong action that reaches a client is a confidentiality problem of its own: the reply that quotes one client’s numbers to another. Nobody can honestly promise accuracy. The mitigation is how much you let it do unsupervised, and how much of that you can see and reverse.
The fourth is left out of the calculation entirely: email is already the way most attacks arrive, whether or not you buy anything. In Verizon’s 2024 Data Breach Investigations Report, drawn from incidents worldwide, “the human element was a component of 68% of breaches.” Elsewhere the report puts “the median time for users to fall for phishing emails” at less than 60 seconds. An AI client adds a twist, because mail can be written to manipulate whatever reads it rather than the person. So the honest question covers two things: whether a tool adds exposure, and what it does about the exposure your inbox already carries.
Is this the same as pasting client data into a chatbot?
Most of the fear here comes from one picture: someone copying a client’s numbers into a public chatbot, where the input may be retained and used to train a model. That fear is well founded. A general-purpose AI tool isn’t built to hold confidential work.
An AI email client is a different arrangement, and the contract is what changes. The AI in an AI email client usually belongs to a model provider. Your mail, or excerpts of it, goes to that provider under the vendor’s commercial terms. That’s materially better than a consumer chatbot. Your mail still leaves the building, so the questions stay the same ones, asked of a proper vendor and answerable in writing.
What should you ask before you connect an account?
There’s a separate list for working out whether a product’s triage is real rather than a relabeled filter, and stop triaging email by hand has it. This is the other list, the data one. Send it as an email, because the answer you want is one you can keep.
- Do you train on my mail, and whose models are they? “We do not train on your data” can mean several things. Ask whether it covers the vendor’s own models, the third-party models underneath, and whether improving the service is carved out. A precise answer is a better sign than a sweeping one.
- Which other companies process my mail? Hosting, AI providers, mail delivery, support tooling. A vendor with a published subprocessor list has already answered; one who has to go and find out hasn’t thought about it.
- Where is it stored, in which country, for how long, and who at your company can read it? The last is the one people forget. Support access, abuse investigation and troubleshooting are normal reasons for a human to see your mail, so ask for the list of reasons.
- What is encrypted, and where is it not? “Bank-level encryption” is marketing. “In transit and at rest where supported” is an answer, and the follow-up is which parts are left out.
- How much can it do without asking, and what can it not take back? The second half matters more. Most tools let you set how far it goes; far fewer say plainly which actions are one-way.
- Are the businesses I run kept apart? Ask where that boundary runs. Separating two businesses you operate is a different thing from separating two clients inside one of them.
- What happens to my data if I stop paying? Deletion or return, on what timescale, and what stays in backups until overwritten. Ask in week one, while you still have their attention.
- Will you sign something for regulated data? If your mailbox carries data your own rules ring-fence, the standard terms probably exclude it. Ask it early, before you get attached to the product.
Treat a vague answer as an answer. And keep one thing in proportion. Even a clear no on training is a policy commitment, and the system doesn’t physically prevent it. It’s a real promise. Weigh it against how the vendor stores and separates data, and against whether it goes in the contract or on a web page.
Does an AI email client make you safer, or riskier?
Both are possible. The vendor’s design decides which one you get.
Handled badly (a tool that trains on your mail, stores it carelessly, or acts without oversight) an AI email client raises your exposure, and no feature makes up for that. Handled well, it can genuinely lower your risk. A client that holds suspicious mail back before it reaches you is working against the most common attack path there is. One that keeps a plain log of everything done on your behalf, and lets you reverse most of it, gives you an audit trail your old inbox never had. That’s the kind of record a written security program is supposed to produce. And when the message that needed you stays in front of you, the quiet everyday risk of the missed email drops too: the deadline or the request that slipped, which for a small firm is its own kind of harm.
Safety here comes down to three things: whether the product hands you control, shows its work, and is straight with you about your data.
Who should not connect their inbox?
A few firms should hold off on this category, or stay off standard terms, and it’s better to know now.
If your mailbox routinely carries data your own rules ring-fence. Most vendors keep regulated data out of the standard service unless they’ve expressly agreed to handle it. That holds for tools built for professionals as much as for anything else. Read the terms for the carve-out. If it covers what lands in your inbox, ask what the vendor will sign before you connect.
If you can’t get the answers in writing. A vendor who won’t put storage, retention, training and subprocessors in a document is asking you to carry a duty on their behalf without terms.
If your engagement letters don’t cover it. Where your obligations require client consent to disclose their information to a third party, the consent comes first.
If you want software that doesn’t need checking. These systems are probabilistic and will be wrong sometimes, and no serious vendor’s terms say otherwise. If the plan is to hand over the inbox and stop looking, the category can’t give you that safely.
Where does Point fit?
Point is an AI email client, so every question above applies. The answers as they stand:
- How much Point does on its own is a dial you set, one kind of action at a time, from staying out of the way, through preparing and waiting for your approval, to handling the work. Out of the box every kind of action sits on review. Raise one to the top and Point handles it alone, which is the point of raising it. Point runs a scheduling back-and-forth end to end if you let it.
- Everything Point does is written down in plain language, and most of it can be reversed in a click. A message that has already left stays gone, and Point’s terms say so plainly.
- Each business you run is sealed off from every other. That boundary runs between the businesses you operate, not between the clients inside one of them. Your clients’ mail sits together in your practice’s account, exactly as it does today.
- Hostile mail is held at the door, unread and unprocessed, in a quarantine you release from. And a thread that has to stay between two people can be locked end to end, so not even Point can read it. That lock covers the thread you put it on. A locked message gets no summary, no ranking and no task pulled out of it.
On the data questions, the terms say Point won’t use your content to train generalized third-party models unless you authorize it, and that Point may process your content to provide, secure, support and improve the service for you. The other companies involved are named in subprocessors:
- AWS for hosting
- Anthropic and OpenAI for the AI processing
- Google for text embeddings and mobile push
- Resend for transactional mail
- Stripe for billing
- Cloudflare for this website
The AI providers sit under business terms carrying no-training controls where those exist.
Data sits in the United States and wherever those providers operate. For a UK or EU firm that’s an international transfer, and the privacy policy sets out a mechanism for it. Encryption is in transit and at rest where supported. The terms stop short of promising absolute security, as every honest vendor’s contract does. The regulated-data carve-out in the section above is Point’s own, so read that first.
Common questions
Is using an AI email client like pasting client data into ChatGPT?
No, though the underlying question is the same. A public chatbot is a general-purpose tool that may retain and train on what you paste. An AI email client is a service you connect under a specific agreement, built for confidential mail. That’s a better arrangement, and the same checks still apply: training, storage, access, and whether the vendor will answer in writing.
Will it train AI on my clients’ data?
That depends on the product, and it’s the most important question to ask. A useful answer is specific about whose models and about what counts as improving the service, so treat a missing one as a red flag. Point’s position is in the terms: Point won’t use your content to train generalized third-party models unless you authorize it, and may process your content to provide and improve the service for you.
Which other companies can see my mail?
More than one, in any AI email product, and a vendor should be able to name them. The work is usually spread across a hosting provider, one or more AI model providers, and smaller services for things like mail delivery and billing. Ask for the list. Point publishes its subprocessors, including the AI providers.
Can I really undo everything it does?
No, and be wary of any product that says otherwise. A good client logs every action and lets you reverse most of them, so a thread it filed or a draft it prepared comes straight back. No software recalls a sent message from someone else’s server. That’s why the autonomy setting on replies deserves more thought than the one on filing.
Does using an AI email client breach client confidentiality?
Not by itself. The duty stays with you all the same. Handing client data to an outside supplier counts as disclosing it. So the job is to choose a vendor whose data practices fit your obligations and, where those obligations require it (as under US federal law for tax return information), to obtain the client’s consent. Many firms build that consent into their engagement terms.
Do I need a written security plan or client consent?
If you prepare US federal tax returns, quite possibly both. The FTC Safeguards Rule requires a comprehensive, written information security program and treats tax preparers as financial institutions. And 26 U.S.C. §7216 makes it a misdemeanor to disclose or use return information beyond preparing the return without consent. The specifics are for your own judgment and adviser. Most firms document their safeguards and build consent into their engagement terms.
The short version
- Safety comes down to control, transparency, and a straight written answer on where your data goes, who else touches it, and whether it trains anything.
- The duty stays with you, and so does most of the cost of a breach, because the vendor’s contract caps their liability. In the US that duty is ethical and, for tax preparers, legal.
- Done well an AI email client can lower your risk; done badly it raises it. The questions above are how you tell before you connect.
- If your mailbox carries regulated data, check the vendor’s terms for the carve-out first. It’s usually there, and usually unread.
For the bigger picture, start with what an AI email client is and how it differs from an AI email assistant. If you run a firm, see AI email for accountants, and how to switch for what the first week involves. Read Point’s privacy policy, terms and subprocessors for the specifics, or everything Point does. The calm version of all this is the idea behind Point.
The duty weighs heaviest where the correspondence is itself the record, which is the case made on the page for law practices, and it shapes the account written for accountants and tax firms too.