AI in Banking: Data Protection from the Start
Customer service, credit checks, wealth management, banking generates a constant stream of correspondence containing highly sensitive account details. Banking secrecy contractually obligates financial institutions to confidentiality toward their customers, which turns careless use of cloud language models like ChatGPT or Claude into a real risk.
We show where AI can already be used safely in banking today, and how InnoGE/deckname acts as an anonymization layer so account data and customer information never reaches someone else's cloud in the first place.
The topic in brief
Account data is strictly confidential: banking secrecy and regulatory requirements demand extra care when handling customer data.
Using AI is still possible: with an anonymization layer in front of the cloud language model, control over the data stays with the institution.
InnoGE/deckname handles exactly that: it detects and replaces sensitive data before a text ever leaves your own infrastructure.
Why banking secrecy makes banking a special case
The banking relationship creates a contractual duty of confidentiality for financial institutions covering all customer-related facts, banking secrecy. Unlike health data, this isn't legally a "special category" under GDPR Art. 9, but the confidentiality obligation carries similar weight in the customer relationship, reinforced by regulatory requirements from bodies like BaFin and the DORA regulation governing IT third parties.
For customer service, that means: a support request containing an account number, balance, or contract details isn't neutral text, it touches the contractual confidentiality obligation owed to the customer. That's exactly what keeps many institutions from using AI in customer contact at all.
The obvious response, avoiding AI in customer service entirely, is rarely the right one. The better solution sits one layer earlier: account data gets detected and anonymized before a language model ever sees it.
Expert tip: the question isn't whether a language model is especially trustworthy. The question is whether it ever gets to see the account data at all.
Tim Geisendörfer
Founder & CEO
Where AI can already help in banking today
Four areas where we see the biggest leverage for financial institutions, provided the confidentiality question is settled:
Customer service & support chats: requests about accounts, cards, or transfers can be automatically triaged and answered without account data being passed along unprotected.
Credit checks & creditworthiness documents: language models help evaluate application documents while creditworthiness and personal data stay anonymized.
Private banking correspondence: wealth overviews and advisory notes can be summarized without allowing conclusions about individual customers.
Fraud detection & case reports: suspicious activity reports and internal reports can be evaluated in a structured way while personal details stay protected.
The solution: anonymization before the data reaches the cloud
We built InnoGE/deckname for exactly this problem: our own AI model for text anonymization that detects personal and account-related information and replaces it with consistent placeholders, before a text ever reaches a cloud language model like ChatGPT or Claude. Deckname runs entirely in your own infrastructure, no GPU needed, in milliseconds.
For financial institutions, that means: the language model gets what it needs to do its job, never the account numbers, names, or balances behind them. For more on how it works, benchmarks, and a live demo, see our in-depth article on InnoGE/deckname.
What InnoGE/deckname does, and what your compliance team decides
InnoGE/deckname detects and replaces personal and account-related data, and can be positioned as a technical and organizational measure under GDPR Art. 25 and Art. 32 within your data protection and IT risk framework. Whether using a specific cloud service is compatible with banking secrecy and your outsourcing management in a given case depends on that case. Your compliance and legal team makes that call, no tool can make it for them.
InnoGE/deckname supports your anonymization and pseudonymization processes, it doesn't replace them. Especially given banking secrecy, we recommend reviewing the specific implementation together with your compliance and legal team.
Expert tip: when it comes to account data, a tool that makes big promises with no evidence doesn't help. Ask for benchmarks, not claims.
Tim Geisendörfer
Founder & CEO
Not your industry? The same data protection questions come up in healthcare and finance.
Ready to roll out AI in your institution, safely?
Let's talk through, in a free, no-obligation conversation, where AI can start safely in your institution, including anonymization through InnoGE/deckname.
FAQ – AI in banking
Generally yes, as long as no personal or account-related data reaches the language model in plain text. An anonymization layer like InnoGE/deckname removes that data beforehand, so the actual request can still be processed safely.
Banking secrecy is a contractual duty of confidentiality a financial institution owes its customers. Transmitting account data unchanged to an external cloud service can touch that obligation, regardless of where the service is operated.
InnoGE/deckname has been benchmarked on German text-anonymization datasets and outperforms Microsoft Presidio and open specialist models there. See our article on InnoGE/deckname for the measurements. As with any detection system, we also recommend testing it against a sample of your own documents.
No. InnoGE/deckname supports your anonymization and pseudonymization processes as a technical measure, but it doesn't replace the assessment your compliance and legal team has to make.
Deckname runs as a single container and speaks an OpenAI-compatible API. In many cases, pointing an existing application at a different API endpoint is enough to connect it, no major rework needed.