Clean Room
Swap client identifiers for reversible tokens before you paste into an outside AI tool, then restore the real values when the work comes back. How it works and what it will not do
What to look for
Twenty-five detector patterns across five classes. Open a class to see every pattern in it and how each one decides. Where an identifier carries a checksum, the checksum is validated before it is reported, so an ordinary nine digit number is not called a Social Security number.
Firm dictionaryempty
Client and entity names no pattern can find on its own. One per line, always redacted, held in this browser on this device only. Paste your whole client list. A column copied out of practice software works: blank lines, duplicates and surrounding quotes are dropped.
Detection is probabilistic. A pattern can miss a value written in a form it does not cover, which is what the firm dictionary is for. Read the sanitized copy before you send it.
The sanitized copy appears here as you type, with every identifier replaced by a reversible token.
The map pairs each token with the value it replaced. It lives in this tab and is never written to disk unless you download it.
Restored text appears here.
Why this exists
Under IRC Section 7216, disclosing tax return information to a party that did not previously hold it is a disclosure, regardless of whether that vendor trains on your data, retains it, or deletes the prompt. The disclosure occurred when the information left your control.
Consent is available. It is its own signed document, per client, naming the specific provider, before the disclosure. Most firms do not obtain it.
Tokenising before you paste is the other path. That is what this tool does. What that achieves legally is a question for your counsel, and nothing here is legal advice.
What this does and does not do
The Clean Room tokenises what it recognises: Social Security and tax IDs, account, card and routing numbers, dates of birth, addresses, email addresses, phone numbers, and credentials, plus anything you add to the firm dictionary.
It is not a guarantee that a document is clean. Read the result before you send it.
It exists because the safest place for client data is inside a tenant you control. If your firm is pasting client work into tools it does not govern, that is worth a conversation, and the free AI Readiness Check is a good place to start.
What the swap looks like
Margaret Hollis, SSN 123-45-6789, EIN 12-3456789, refund to acct 4111 1111 1111 1111.Margaret Hollis, SSN [SSN_1], EIN [EIN_1], refund to acct [CARD_1].The name is still in the second line. Names are only swapped once they are in the firm dictionary, because no pattern finds a name reliably. Everything with a fixed shape went on its own.
Questions about the Clean Room
Using it
What is a clean room for client data?
A step between your document and an outside AI tool. It finds the values that identify a person or an account, replaces each one with a numbered token such as [SSN_1], and keeps the mapping so the real values can be put back when the reply comes. The assistant sees the structure of the problem and not the client.
Do I need an account?
No. There is no account, no sign-in, no email gate and no download. The page is free to use and free to keep using.
Are the tokens reversible?
Yes. Every token maps back to the value it replaced, and the mapping lives in the tab for as long as it is open. Paste the assistant's reply into the Restore tab and the real values come back. The restore step also reports how many tokens returned, so a reply that dropped one is visible rather than silent.
What it finds
What identifiers does it find?
Twenty-five patterns across five classes: Government ID, Financial, Health, Personal and Credentials. That covers Social Security numbers, ITINs, EINs, PTINs, passport and licence numbers, card, routing, account, IBAN and SWIFT values, NPI, Medicare and medical record numbers, dates of birth, addresses, emails and phone numbers, and credentials such as passwords and API keys. Where an identifier carries a checksum, the checksum is validated before it is reported, so an ordinary nine digit number is not called a Social Security number. Open Scope in the toolbar to see every pattern by name, with its severity and how it decides.
Why are client names not detected automatically?
Because no pattern finds a name reliably. A Social Security number has a fixed shape and a card number has a checksum, but a name is only a name in context, and a detector aggressive enough to catch every client name would flag ordinary words throughout a document. Add your clients to the firm dictionary once and they are tokenized from then on.
Rules and limits
Can I put client tax data into ChatGPT or Claude?
That is a disclosure question, not a settings question. Under IRC Section 7216, giving tax return information to a party that did not already hold it is a disclosure whether or not the provider trains on it, retains it, or deletes the prompt. Consent is available and it is its own signed document, per client, naming the specific provider, before the disclosure. Tokenizing the identifiers before you paste is the other path, and it is what this tool does. What either path achieves for your firm is a question for your counsel.
Does anything I paste get uploaded?
No. The Clean Room runs entirely in your browser tab. A scan makes no network call, nothing you paste is sent to Claremont or to any other party, and the token map is held in the tab only. Close the tab and the map is gone. The firm dictionary is the one thing that persists, saved in this browser on this device.
Does using the Clean Room make an outside AI tool approved for client work?
No. Swapping identifiers reduces what leaves the firm. It does not decide whether a tool is allowed, and it does not stand in for your firm's own policy on which tools staff may use. It also does not read meaning: a sentence that describes a client without naming them goes out as written, and that judgement stays with you.
General reference, not legal or tax advice. Claremont Security does not perform audits, issue certifications, or attest to any examination.