How does Serra protect your data when it uses AI?
Serra does not, as a rule, put live client data into public or consumer AI tools. Client data touches AI only inside contracted, security-assessed environments, on a lawful basis, with a data-protection impact assessment and human review. The boundary is a firm rule enforced by the system, not a preference we hope our people remember.
Our companion article asks whether an adviser can put client data into ChatGPT. The honest answer there is no, not the public version. This article answers the next question a client actually asks: given that Serra uses AI across its operations, what specifically protects my information? Here is the protocol. It sits within our AI for Wealth resource and extends how Serra governs AI to the specific question of client data.
Does Serra put my data into ChatGPT or other public AI tools?
No. As a rule, Serra does not place live client data into public or consumer AI tools such as the public version of ChatGPT. Those tools offer no data-processing contract, no control over retention, and no lawful basis for their onward use of what you type. Serra treats that boundary as non-negotiable, which is why client data is handled only in controlled environments.
The reasoning is the same one we set out for advisers generally: a public tool is not a private workspace. It can retain, log, or reuse an input, and once a client's details enter it, control is gone. Serra's rule removes the possibility rather than relying on care in the moment.
Where does Serra actually process client data with AI?
Serra processes client data with AI only inside contracted, security-assessed environments, never a consumer tool. That means a provider under a data-processing agreement, an environment that has passed a security assessment, a documented lawful basis for the processing, a data-protection impact assessment where required, and human review of the output. Each of those is a condition that must be met before client data and AI meet.
Think of it as five locks on the same door. A contract governs the provider. An assessment tests the environment. A lawful basis authorises the processing. A DPIA weighs the risk. Human review checks the result. Client data moves only when all five are in place.
What is a DPIA and why does Serra run one?
A data-protection impact assessment is a structured evaluation of the privacy risks of a processing activity and the measures that reduce them. Under the EU GDPR, a DPIA is required where processing is likely to result in a high risk to individuals (Article 35). Serra runs one before client data is processed with AI in a way that warrants it, so the risk is assessed in advance, not discovered later.
The value of a DPIA is that it forces the question "what could go wrong, and what have we done about it?" before processing begins. It is a documented, defensible record, exactly what a regulator, or a careful client, expects a firm to be able to produce.
Does a human check what the AI produces with my data?
Yes. Human review is a required step, not an optional one. Where AI touches client data inside Serra's controlled environments, a person reviews the output before it is used or acted on. The AI prepares; a human owns the result. This mirrors the wider governance rule across Serra's fleet: a human owns every decision, and a hard gate stands in front of every irreversible action.
Human review is what keeps AI in the role of instrument rather than decision-maker. It catches error, applies judgment the model cannot, and preserves accountability, so there is always a named person who checked, and who answers for, what was done with your information.
How does identity protect client data at Serra?
Identity is the root of every access control. Each AI agent authenticates as itself and holds least-privilege access, it can reach only the data its role requires, and every action is attributable and logged. So access to client data is scoped, named, and recorded, producing an audit trail of who touched what and why.
Least privilege matters most where data is sensitive. An agent scoped to, say, content has no route to client financial records. Combined with logging and attribution, it means data access is not a diffuse risk but a set of named, recorded, minimum-necessary permissions.
FAQ
Will my personal or financial details ever be typed into a public AI tool?
No. As a rule, Serra does not put live client data into public or consumer AI tools. When AI is involved, your data is handled only inside contracted, security-assessed environments with a lawful basis, a DPIA where required, and human review of the output.
What lawful basis does Serra rely on to process my data with AI?
Serra processes client data only where there is a documented lawful basis under applicable data-protection law, assessed as part of the client relationship and, where the risk warrants it, a data-protection impact assessment. Processing does not proceed without that basis in place.
Does Serra use my data to train AI models?
Serra's protocol keeps client data out of public and consumer tools, which is where uncontrolled retention and training risk live. Client data is processed only in contracted environments governed by a data-processing agreement that defines, and constrains, how a provider may use it.
Can I ask Serra how my data is handled?
Yes. Serra's approach is designed to be explainable and documented, the contract, the security assessment, the lawful basis, the DPIA, and the human-review step are each recordable. If you want to understand how your information is handled, that is a question Serra can answer specifically.
Is this the same standard Serra recommends to other advisers?
Yes. The rule Serra applies to itself, no live client data in public tools; AI only in contracted, assessed, lawful, DPIA'd, human-reviewed environments, is the same standard our companion article sets out for advisers across the EU, UK, and US. Serra holds itself to the boundary it describes.
This article describes how Serra Wealth protects client data in its use of AI (Serra Education: process and tooling). It is not investment advice. Serra Wealth uses AI tools in its operations under human oversight and in line with applicable data-protection law.