AI tools and client data

Is Zocks safe for client data?

Short answer: Whether Zocks is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Essentials and on Professional and Ultimate, we did not find a statement about model training in the pages we read. Every fact on this page is Zocks's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in Zocks’s own words

A meeting assistant for financial advisers that produces notes and structured client data without recording the meeting. It captures the same conversation a recorder would — what it keeps afterwards is a transcript and a set of fields in your CRM.

What you are askingEssentialsProfessional and Ultimate
Trains the vendor's models by defaultNot found in the pages we read.Not found in the pages we read.
How to turn training offNot found in the pages we read.Not found in the pages we read.
How long data is keptNo period is published. Zocks says procedures exist and makes the capture and retention configurable, so what applies is what your firm set.“The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data.” source, read No period is published. Zocks says procedures exist and makes the capture and retention configurable, so what applies is what your firm set.“The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data.” source, read
What an admin can see or controlRoles, visibility and access controls, and Zocks says they are there for a solo adviser as well as a large firm.“Zocks gives teams of all sizes full control with customizable user roles, visibility settings, and access controls…” source, read Roles, visibility and access controls, and Zocks says they are there for a solo adviser as well as a large firm.“Zocks gives teams of all sizes full control with customizable user roles, visibility settings, and access controls…” source, read
Single sign-onNot found in the pages we read.Not found in the pages we read.
Business Associate AgreementNot found in the pages we read.Not found in the pages we read.
Where the data is processedNot found in the pages we read.Not found in the pages we read.

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Zocks pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Zocks before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. We didn't find a BAA statement in the pages listed below; ask Zocks before any patient data goes in. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From Zocks’s own documentation. Each one is a change somebody can make this afternoon.

  • Turn on PII redaction and choose the categories. It is the setting that decides how much of a client's detail the transcript keeps at all.“Zocks allows redaction of PII (Personally Identifiable Information) to automatically remove sensitive details from transcripts, with configurable categories.” source, read
  • Configure the consent workflow rather than relying on anybody remembering to mention it, and keep the per-client history it produces.“Firms can configure consent workflows to match their compliance model, with full contact-level consent history, optional evidence and comments…” source, read
  • Point the archiving at whatever your firm already uses for books and records, on a schedule, before an examiner asks.“Zocks supports archiving and supervision of transcripts and summaries on demand or on a scheduled basis, supporting Smarsh, Global Relay and other integrations.” source, read
  • Know that the drafted emails sit and wait. Zocks says it never sends to a client, which puts the send on a person.“Zocks automatically drafts AI-generated emails, but never sends them to clients.” source, read

Worth knowing

  • There is a transcript even though there is no recording, which is the distinction to explain to a client who asks whether the meeting was taped.“When you need to reference exactly what was said, a complete transcript is available on demand — generated without ever recording the meeting.” source, read
  • Leaving the service is published as a deletion event.“The company purges or removes customer data containing confidential information from the application environment, in accordance with best practices, when customers leave the service.” source, read

Questions we get asked

Is Zocks safe for client data?

Whether Zocks is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Essentials and on Professional and Ultimate, we did not find a statement about model training in the pages we read.

Every fact on this page is Zocks's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does Zocks train its models on what we put into Zocks?

On Essentials and on Professional and Ultimate, we did not find a statement about model training in the pages we read. On Essentials, Professional and Ultimate: Not found in the pages we read.

How long does Zocks keep what we put into Zocks?

On Essentials, Professional and Ultimate: No period is published. Zocks says procedures exist and makes the capture and retention configurable, so what applies is what your firm set.

Zocks's own words: "The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data." (read 2026-11-03).

Can an administrator read what we put into Zocks?

On Essentials, Professional and Ultimate: Roles, visibility and access controls, and Zocks says they are there for a solo adviser as well as a large firm.

Zocks's own words: "Zocks gives teams of all sizes full control with customizable user roles, visibility settings, and access controls…" (read 2026-11-03).

Will Zocks sign a Business Associate Agreement for Zocks?

We didn't find a BAA statement in the pages listed below; ask Zocks before any patient data goes in.

How do we find out which version of Zocks our staff are using?

Zocks sells this to practices rather than to individuals, so there is no personal account to find.

What decides the answers above is which plan your practice is on and what your own administrator has switched on, both of which are in your subscription and your admin console rather than on anybody's laptop.

Obsidian Ridge's free 30-day AI security assessment covers the tools nobody approved, which is the other half of the picture.

Sources

Zocks’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 35 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.