Which AI is best for accountants — without the cloud?
For work touching client data, the best AI for an accounting firm is a private open-weight model on hardware the firm owns, indexed over its own engagement files. A smarter cloud model you cannot legally feed the actual workpapers is the weaker tool.
GLBA follows the data, not the tool
The Safeguards Rule makes the firm responsible for where client information goes. That includes an unlogged paste into a chatbot during busy season. Keeping inference inside the office removes the disclosure rather than documenting it.
Where it earns its place
Variance narratives, workpaper summaries, prior-year lookups, review notes and “where did this number come from” — answered with the workpaper reference so a reviewer can check it. That is billable hours returned, in the weeks you have least of them.
The on-premise answer
One appliance, your files, your chat window, no per-seat fee. One price to build it, one flat retainer to keep it running, and every prompt logged to your own systems.
Three ways to deploy, side by side
| The question | Consumer cloud AI | BAA / enterprise cloud | Handistack on-prem |
|---|---|---|---|
| Where client data goes | Bad: The vendor's cloud | Qualified: The vendor's cloud, contract-bound | Good: Stays on hardware you own |
| Trained on your content | Bad: Yes, unless you opt out | Qualified: No — by contract | Good: Never. No upstream to train |
| Retention of prompts & files | Bad: Vendor policy, human review possible | Qualified: Configurable, vendor-controlled | Good: Your policy, your disks |
| BAA / DPA in place | Bad: Not available | Good: Available | Good: Not needed — no third party |
| Audit trail you control | Bad: None | Qualified: Vendor console | Good: Your log store and SIEM |
| Cost shape | Qualified: $20–30 per seat / mo | Bad: $60+ per seat / mo | Good: One-time build, one flat retainer |
| Works with the internet down | Bad: No | Bad: No | Good: Yes |
You hold client NPI, and GLBA makes where it goes your responsibility.
We build, install and maintain the private system that makes this a non-question — inside your building, owned by you, with the control documentation for your file.