Private AI for Accounting Firms: Your Cloud or SaaS?

Key takeaways

• “Private” is not a complete deployment specification. Ask who administers every place that handles the document.
• Your cloud, your model account and a self-hosted model are three separate decisions.
• Check processing geography, retained copies and support access independently of storage location.
• Keep professional judgment and consequential-action approvals with your firm in every option.

What are you trying to keep private?

Start with one recurring job, such as preparing a monthly-review exception summary from an authorized workpaper. Identify the document, the people allowed to see it and the actions the agent may take. A promise about where a file is stored does not answer where its extracted text will be processed.

Susan is our product, provided and operated by Fixed Labs. We can run it inside your firm’s Azure subscription, with identity, network, keys, logs, connected-app access and monitoring under your administrators’ rules. Fixed Labs still performs setup, monitoring, fixes and updates through access your firm grants and can revoke.

That option addresses control of the working environment. The managed AI service for CPA firms addresses who runs the recurring work. Neither replaces the firm’s decisions about permitted data, professional review or model-provider terms.

Follow one workpaper from source to model

Take a sample monthly-review task: staff want a draft explanation of a difference between a bank-statement line and the books. We recommend mapping the following path before enabling it. The example is a proposed design to evaluate with your IT lead, not a customer result.

1. Source document. The authorized document system holds the statement and workpaper. Its administrator grants access to the named folder and period. Identify whether that service is outside your Azure environment; do not assume it moved with the agent.
2. Susan’s working environment. In the own-cloud option, Susan reads the permitted material from its firm-controlled environment. Agree whether downloads, extracted text or screenshots are needed, where they are stored and when temporary copies are removed.
3. Request to the model. The proposed request includes only the relevant statement line, matching book entry and task instructions. Those contents leave the agent environment for the chosen model endpoint. The firm approves that disclosure path; using its own account changes the account terms and billing relationship, not the fact of processing.
4. Model response. The service returns a proposed explanation. Provider-side history, uploaded files and monitoring must be checked separately. A response returning to Susan does not show that every provider-side copy has been deleted.
5. Review and saved output. Save a draft with links to the relevant source versions in the permitted review location. An accountant checks it and decides any correction or sign-off. A proposed explanation is not authority to post a journal or send client advice.
6. Logs and support. Inventory copies in agent logs, source audit history, model features and support records. Name each administrator, access location, retention rule and deletion process. Prefer references and necessary action evidence over copying whole documents into routine logs.

Copy this record for each step: input → recipient/service → account owner → processing location → retained copies → support access → revocation owner. An unknown entry is a question to resolve before that step receives confidential material.

For the earlier document handoff, use the client document collection guide. For the later consequential action, use the approval withdrawal and stop requirements.

Your model account is not an encryption-key promise

Susan can use your own OpenAI, Anthropic or Azure OpenAI model account. Your firm keeps its provider terms, retention settings and direct model bill. This is sometimes called bring your own key, but here it means model-provider credentials. Customer-managed encryption keys are a separate control; do not accept one as an answer to a question about the other.

Microsoft’s privacy documentation for models sold by Azure distinguishes model training from service processing. Its stated restrictions on foundation-model training do not mean that prompts are never processed or retained. Stateful features and abuse monitoring have their own conditions. Those statements apply to the covered Azure service, not to every SaaS product or direct provider account.

Microsoft also distinguishes processing by deployment type from storage at rest. Check the actual model, deployment type and supported geography. A Canadian storage location, an Azure subscription or a provider name alone is not proof of Canadian inference processing.

When is vendor-hosted SaaS enough?

Stay with vendor-hosted software when its documented data path meets your obligations, staff can review the work and the supplier has an acceptable support and recovery arrangement. That may be the simpler choice for a firm whose existing practice platform already completes the job. The label “private AI” is not a reason to duplicate a working process.

Ask the supplier to identify the exact features enabled for your account, where they send data and how access can be withdrawn. Review those answers against the job, rather than assuming every SaaS trains on client records or every firm-owned environment is well controlled. The practice AI versus managed employee comparison helps decide whether another operator is needed at all.

When own-cloud control is worth the responsibility

Own-cloud deployment fits firms whose IT team needs administrative control of the agent’s identity, network, logs and operator access. It also requires the firm to make and maintain those decisions. Before choosing it, name who approves access changes, reviews retained logs, owns the model account and handles an incident with Fixed Labs.

Managed operations still matter: Fixed Labs runs Susan, while your administrators govern the environment. Agree monitoring coverage, change approval, support access and recovery responsibilities in the scope. Do not assume a cloud bill or a copied security policy supplies an operating owner. Azure is the named example; ask us about AWS or Google Cloud rather than assuming support.

If the requirement is that inference itself runs in your environment, separately scope an open-weight model. Fixed Labs can help with that arrangement. It needs compute, model maintenance and quality checks on the actual workflow. Do not assume equivalent output quality or lower total cost; compare staff review, support and recovery as well as hosting.

Make revocation an operating procedure

Agree how to stop the job before confidential documents flow through it. Revoking Fixed Labs’ support access, removing an app grant and disabling a model credential affect different parts of the path. Name who can do each, how queued work is held and how staff learn that an action’s result is uncertain.

For a proposed acceptance exercise, withdraw approval before an invoice send, stop new work and inspect the destination for any action already in flight. Preserve evidence, reconcile uncertain results and require current authorization before resuming. Access revocation does not undo a completed send or delete copies already retained by another service. The operational stop checklist spells out the handoff.

Deployment does not decide compliance

The FTC’s Safeguards Rule guide lists tax preparation firms among its covered examples. Covered institutions need an appropriate written information-security program and service-provider oversight. Applicability depends on the business and jurisdiction; certain provisions have exemptions for institutions holding information on fewer than 5,000 consumers.

Our recommendation is to use the document path to support that review: it identifies access, retained copies and the parties handling information. Owning the cloud does not certify compliance or replace the firm’s responsibilities. This is operational education, not legal advice. Confirm applicability, tax-data disclosure requirements and any cross-border obligations with counsel before approving the deployment.

Bring one workflow and its data requirements

Start with the task, the source systems, the intended model account and the locations your firm permits. We will discuss which parts Susan would operate, which your administrators control and which questions need an answer before connecting confidential data.

Bring system names and requirements, not client documents or credentials. Scope and pricing depend on the workflows.