AI in Finance: Data Protection from the Start
Account balances, credit data, transaction histories, contract details, few industries handle as much sensitive information as the financial sector. Banking secrecy and the DORA regulation for EU financial entities set a high bar for using external cloud services, especially language models like ChatGPT or Claude, leaving many banks, insurers, and fintechs unsure whether and how they can use AI at all.
We show where AI can already be used safely in finance today, and how InnoGE/deckname acts as an anonymization layer so customer and financial data never reaches someone else's cloud in the first place.
The topic in brief
Financial data is strictly confidential: banking secrecy, regulatory requirements, and the DORA regulation demand extra care when handling customer data.
Using AI is still possible: with an anonymization layer in front of the cloud language model, control over the data stays with your organization.
InnoGE/deckname handles exactly that: it detects and replaces sensitive data before a text ever leaves your own infrastructure.
Why banking secrecy and DORA make finance a special case
Unlike health data, financial data doesn't fall under the "special category" rules of GDPR Art. 9. It still sits under its own, tightly-woven protection regime: banking secrecy contractually obligates financial institutions to confidentiality toward third parties. The DORA regulation (Digital Operational Resilience Act) has, since 2025, additionally required financial entities to systematically assess and manage the risk of every IT third party, cloud AI services included.
For using language models, that means: a text containing account data, creditworthiness checks, or transaction details isn't just "a document", it touches contractual confidentiality obligations and regulatory requirements at the same time. That's exactly what keeps many financial companies from even considering AI.
The obvious response, avoiding AI entirely, is rarely the right one. The better solution sits one layer earlier: sensitive data gets detected and anonymized before a language model ever sees it.
Expert tip: DORA doesn't just ask which cloud provider runs a language model. It asks what data that provider actually gets to see.
Tim Geisendörfer
Founder & CEO
Where AI can already help in finance today
Four areas where we see the biggest leverage for banks, insurers, and fintechs, provided the confidentiality question is settled:
KYC & AML documentation: customer identification and anti-money-laundering review reports can be summarized without customer data ever leaving your infrastructure.
Risk analysis & credit checks: language models help evaluate documents while creditworthiness and personal data stay anonymized.
Regulatory reporting: supervisory reports and filings to regulators like BaFin or the ECB can be drafted and checked faster.
Customer communication: requests about accounts, contracts, or claims can be automatically triaged and answered without financial data being passed along unprotected.
The solution: anonymization before the data reaches the cloud
We built InnoGE/deckname for exactly this problem: our own AI model for text anonymization that detects personal and financial information and replaces it with consistent placeholders, before a text ever reaches a cloud language model like ChatGPT or Claude. Deckname runs entirely in your own infrastructure, no GPU needed, in milliseconds.
For banks, insurers, and fintechs, that means: the language model gets what it needs to do its job, never the account numbers, names, or contract details behind them. For more on how it works, benchmarks, and a live demo, see our in-depth article on InnoGE/deckname.
What InnoGE/deckname does, and what your compliance team decides
InnoGE/deckname detects and replaces personal and financial data, and can be positioned as a technical and organizational measure under GDPR Art. 25 and Art. 32 within your data protection and IT risk framework, including as part of DORA third-party risk assessment. Whether using a specific cloud service is permitted in a given case depends on your regulatory classification, your outsourcing management, and your internal risk assessment. Your compliance and data protection organization makes that call, no tool can make it for them.
InnoGE/deckname supports your anonymization and pseudonymization processes, it doesn't replace them. Especially given banking secrecy and regulatory requirements, we recommend reviewing the specific implementation together with your compliance and legal team.
Expert tip: when it comes to financial data, a tool that makes big promises with no evidence doesn't help. Ask for benchmarks, not claims.
Tim Geisendörfer
Founder & CEO
Not your industry? The same data protection questions come up in healthcare and banking.
Ready to roll out AI in your financial business, safely?
Let's talk through, in a free, no-obligation conversation, where AI can start safely in your business, including anonymization through InnoGE/deckname.
FAQ – AI in finance
Generally yes, as long as no personal or financial data reaches the language model in plain text. An anonymization layer like InnoGE/deckname removes that data beforehand, so the actual request can still be processed safely.
Banking secrecy contractually obligates financial institutions to confidentiality toward customers. Transmitting customer data unchanged to an external cloud service can touch that confidentiality obligation, regardless of where the service is operated.
InnoGE/deckname has been benchmarked on German text-anonymization datasets and outperforms Microsoft Presidio and open specialist models there. See our article on InnoGE/deckname for the measurements. As with any detection system, we also recommend testing it against a sample of your own documents.
No. InnoGE/deckname supports your anonymization and pseudonymization processes as a technical measure, but it doesn't replace the assessment your compliance and legal team has to make as part of DORA outsourcing management and banking secrecy obligations.
Deckname runs as a single container and speaks an OpenAI-compatible API. In many cases, pointing an existing application at a different API endpoint is enough to connect it, no major rework needed.