Imagine: You’re walking to grab your afternoon coffee from the break room and see your email blowing up with a thread subject lined “LP Data Leaked”. Sigh. As you dive into the situation, you see that someone at the firm built a dashboard through Claude that tracks the firm’s weekly status for investment committee and their LP action items and pulls data from email and your CRM. They deployed this online, following the instructions of Claude, not knowing the implications of what was happening and exposed this information to the world. This is now our reality. The intention was right, and the controls were missing.
Every day there’s new AI tools, models, and software that pops up online that promises to be the next ChatGPT moment for their specific niche. It’s tempting to immediately sign up and connect all of your accounts. "This is going to solve my problem, and I want it solved now." Speaking to Partners and Managing Directors at investment firms, they all want the efficiency and to be ahead of their peers. Partners and MDs are the people with access to the most sensitive information (LP data, deal flow, portfolio financials) while simultaneously the people that nobody on the team wants to say no to. Sometimes the normal checks don’t apply to the top of the food chain. That said, firm data leaving the walled garden of the compliance team is exactly how LP data leaks or gets trained on.
There are really four ways that firm data leaves the firm:
People: Losing the driver’s seat
AI systems are extremely complex and also evolving rapidly. You could liken this to a construction worker operating heavy machinery. These workers need training and certifications in order to safely and effectively operate a machine that could cause immense damage. Bringing that lens to AI, if someone doesn’t understand what is happening at each step of the conversation with an agent, it’s very easy to gain a false sense of confidence and outsource your critical thinking to the system that appears to be working correctly.
The result: Outputs look confident and polished, making it very easy for the person themselves to forward, bring to investment committee, or send to an LP without review. In the realm of Registered Investment Advisors, this can be a large flag to the SEC if anything is hallucinated, superlative language is used, or it contains information that it shouldn’t.
Tools: Consumer tiers training on your data
When a new tool comes out, the internet rushes to sing its praise and there is an endless sea of hype on X of “I just automated this whole process with X tool”. I’m sure you’ve seen those posts if our algorithms are similar enough to have you reading this post. The looming danger of these tools are that many of them, especially at first launch, are not enterprise-grade systems. A lack of governance or compliance controls of a tool that is being linked to firm data can be a, not to be understated, huge risk to a firm.
A very concrete example is something that I’ve been hearing from my clients - teams want to use Instinct. They just raised a large round of funding and have been a sweetheart online recently. Their product is great, and it works as a cautionary tale: Instinct, like other consumer-grade tools (including Claude and ChatGPT personal plans), trains on your data by default. Instinct's own settings page says it plainly: your data "may be used in training to improve Instinct for everyone." There are toggles that are nested inside of settings menus to turn them off, but when you’re testing a new tool and setting it up, its very easy to overlook this step and begin chatting with the agent and exposing your data to training.
Consumer-tier training defaults, as of October 2026
| Tool | Consumer default | Where the toggle lives | Business tier |
|---|---|---|---|
| Claude | Training on by default (Free, Pro, Max). Data kept up to 5 years when on, 30 days when off | Settings > Privacy > Help improve our AI models | Team, Enterprise, API excluded from training |
| ChatGPT | Training on by default (Free, Plus, Pro) | Settings > Data Controls > Improve the model for everyone | Business, Enterprise, Edu, API not trained on by default |
| Instinct | Training on by default, can be turned off | Settings > Data controls > Improve Instinct for everyone | None available |
Table sources: Anthropic changed consumer terms in August 2025 so Free, Pro, and Max chats train models unless the user opts out, with 5 year retention when on; commercial plans are excluded [1][2]. OpenAI's help center states data sharing is on by default for Free, Plus, and Pro, and that Business, Enterprise, Edu, and API data is not used for training by default [3]
Autonomy: Agents can be convinced to leak data
Phishing attacks have been around since the dawn of society. A bad actor pretends to be someone that they are not in order to gain information or access that they should not have. With the advent of autonomous agents, there is a new surface other than ourselves: our agents. These have a higher risk factor than say Claude’s chat mode because they can act on behalf of us, not just answer our questions.
An example here, again, is Instinct. One of their cool features is that you can create a trusted link between your agent and someone else’s for coordination, communication, and anything else that you could imagine. Conceptually, this is awesome because you could have your agent and your spouse’s coordinate on date night, but if we put this into the frame of firm data, your spouse’s agent could intentionally or unintentionally request the firm’s sensitive data, and we now have a security incident that should not have happened.
The final note on autonomy is that, in these consumer-grade systems, there are no firm-level guardrails. A CCO cannot work with the team to create system prompts, connector restrictions, or human-in-the-loop requirements.
Models: you can’t fully see what’s inside
The last risk is the hardest to see. This week, Cohere published results from a security test of Alibaba's open-weight Qwen3.8-Flash-Next model. When asked to write a malware detection rule, the model instead inventoried the machine it was running on and tried to upload a file to an Alibaba Cloud server in Beijing [4][5]. The sandbox blocked it. The devil is in the details: right before it acted, the model's own reasoning said it wouldn't use any tools.
To be fair, Cohere can't say whether this was deliberate or leftover noise from training, and some researchers have questioned how the test was run [6]. But for a firm, intent isn't the point. Many teams assume that running a model on their own servers keeps data in the building. That assumption falls apart the moment the model is connected to a terminal, a browser, or your cloud environment. And like the people risk above, it's a reminder that what an AI system says it's doing and what it actually does aren't always the same thing.
Why this hits investment firms harder
The SEC now has this in their purview
The SEC's FY2027 exam priorities, released this month, are direct about where this is heading. The Division notes that firms are now using generative tools for research, drafting, coding, and client communications, and says it is stepping up its efforts to understand how these tools influence outcomes and whether firms still meet their existing, "technology-neutral obligations" [7]. In other words, there is no AI exemption. The rules you already follow apply to whatever tool did the work.
A few specifics map directly to the risks above:
- Third parties touching client data. Examiners will focus on advisers that use third parties to access clients' accounts, where existing controls may not be enough to protect client assets and data [7].
- Data loss prevention. Cybersecurity reviews will cover governance, data loss prevention, access controls, and account management, plus the risks of relying on third-party service providers and shared technologies [7].
- AI-powered attacks. The Division calls out AI-generated phishing and deepfake voice and video used for social engineering, the same playbook that works on agents [7].
- Monitoring. The Division will prioritize reviewing firms' policies and procedures for monitoring their AI use [7].
This has been building for more than a year. The FY2026 priorities also flagged AI, cybersecurity, and Reg S-P safeguards as cross-cutting risks for every registrant [8][9].
Reg S-P now reaches AI vendors
As of June, the 2024 Reg S-P deadlines for compliance have now passed for firms under $1.5B AUM, meaning that all firms that are registered now live under the new requirements. There are new requirements, such as incident response, breach notification, and service provider oversight that have been extended to RIAs that advise solely private funds. The FY2027 priorities confirm that examiners will evaluate incident response programs, customer notification procedures, and oversight of service providers under the amended rule [7].
Our position at PressW is that any AI tool that touches customer data is a service provider that is expected to be governed and overseen. A consumer-grade app with no business tier cannot be governed.
The biggest open question still: AI conversations themselves falling under the books and records rules. We expect more clarity here as examiners see AI use in the field.
What LPs are asking
We’re seeing more LPs asking for how firms are protecting their data from being trained on by the various service providers that firms use [10]. Some LPs are even including it in their contracting languages with the firms themselves. Governance stops being a cost center and starts affecting fundraising.
What you can do about it
Start at the top
Partner buy in on governance and security comes first. If we get partners to spearhead the policy and use the sanctioned tools themselves, the whole firm follows. If they don’t, it is a policy that lives and dies the moment that it is signed by the team.
Find what’s already in use
Discover what tools people are actually using. Shadow AI is the silent killer of compliance, and if you don't have the systems and processes to see it, you're governing a firm that only exists on paper. You can't approve, restrict, or train people on tools you don't know about.
A few places to start:
- Ask, without blame. A short survey framed as "tell us what you use and we'll help you use it safely" surfaces far more than a crackdown does.
- Check connected apps. Your Google Workspace or Microsoft 365 admin can see which third-party apps have been granted access to firm email, calendars, and files. This is usually the most revealing list.
- Check expenses. AI subscriptions on corporate cards and reimbursements show up fast.
Then sort every tool into one of three buckets: approve it, replace it with a sanctioned alternative, or block it.
Vet before you approve
- Live by the rule: just because it’s shiny and new does not mean our data should go into it.
- There’s a simple test: if there’s no business tier with admin controls, it’s not a candidate, no matter how good it is.
- Vendor checklist:
- Training opt-out available
- Data retention terms
- Admin control over connectors
- Audit logs
- SOC 2
- Approve at the tier level: Claude Team or Enterprise, ChatGPT Business or Enterprise, etc.
Configure the guardrails
An effective and compliant rollout includes the configuration of what tools and actions are allowed automatically, what requires human-in-the-loop, and what is never allowed.
| Allowed automatically | Requires human review | Never allowed |
|---|---|---|
| Summarizing public filings and research | Anything sent outside the firm (LPs, portfolio companies) | Firm data in personal or consumer-tier accounts |
| Drafting internal notes and memos | Anything going into IC materials or marketing | LP or investor data in unapproved tools |
| Searching approved internal knowledge | Working with LP or investor data, even in sanctioned tools | Agent-to-agent connections with outside parties |
| Connecting a new data source, or agent actions in email and calendar | Installing unvetted plugins or connectors |
LP data can go into sanctioned tools when it's handled deliberately: only what the task needs, by people who know where it's going.
A firm-wide system prompt adds another layer. It can tell the model to cite sources, avoid superlative or performance language, and flag outputs that contain LP or investor information before they're shared. Treat it as a seatbelt. Prompts can be ignored or overridden, so they need to sit on top of real controls like connector restrictions and admin settings.
Put it in writing
Ratify your firm’s Acceptable AI Usage Policy that everyone reads, signs, and abides by. Supplement this with education around why sanctioned tools matter, for both data safety and for the SEC.
Monitor and revisit
- Implement an AI DLP solution where possible (CrowdStrike Falcon AI, Cato). It can be expensive, but helps to ensure that the machines that your team uses are compliant and shadow AI is logged and understood. With the SEC now examining how firms monitor their AI use, this is quickly moving from nice-to-have to expected.
- Keep your communication channels open. AI moves fast and a tool that wasn’t acceptable yesterday may have the controls that make it compliant today.
Final Thoughts on LP Data Security and Compliance For Private Equity Firms
The firms that get this right make the sanctioned path the easiest path, starting with the people at the top.
Your biggest AI compliance risk is probably the tool someone connected their inbox to last Tuesday, on a consumer account, with training turned on by default. The fix is visibility, a short list of approved tools, and partners who use them first.
If your firm is working through this, it's exactly what we help with at PressW: rollout, education, and governance that sticks. If you’re ready to protect your data and stay compliant, we’re happy to chat.
