Financial data can make AI narration more relevant, but relevance does not require sending every raw record to a hosted model. A narrower design can separate deterministic calculation from language generation.
Fain’s boundary starts with a simple rule: raw imported financial records and raw question history stay in browser storage. Hosted narration receives an approved, structured context rather than source rows.
Divide the work deliberately
| Work | Where it happens | What it uses | | --- | --- | --- | | File parsing | Browser | The file selected by the user | | Classification review | Browser | Local transaction fields and user corrections | | Cash, burn, and runway calculation | Browser | Local records, confirmed balances, and deterministic rules | | Intent routing | Browser | The current question, mapped to a supported decision family | | Narration | Hosted model or deterministic fallback | Normalized intent, approved aggregate results, assumptions, warnings, and provenance |
The hosted narration context should exclude source rows, transaction descriptions, merchant names, account or IBAN data, filenames, email addresses, and personal identifiers.
Keep calculation separate from prose
Language models are useful for explaining a structured result. They should not be the source of the financial number itself.
In a math-first system:
- a versioned engine calculates the answer in integer minor units;
- each metric carries its provenance and warnings;
- approved values become the only numeric chips shown to the user;
- narration receives those values and explains the tradeoff;
- a numeral guard rejects prose containing unsupported numbers;
- deterministic narration remains available if the model provider is unavailable.
This boundary reduces the model’s opportunity to invent a figure. It also makes an answer easier to inspect because the calculation exists independently of the wording.
Minimize measurement too
Privacy boundaries apply to analytics and operational logs as well as AI requests. A marketing event can record that a registered call to action was used without recording the person’s question, financial values, filename, email address, account identifier, full URL, or referrer.
Collect only fields needed to answer a defined product or marketing question. Reject arbitrary text at the event boundary.
Understand what browser-local means
Browser-local records remain on the device and browser profile where they were imported. Clearing site data, resetting the product, changing browsers, or losing the device can remove access to that local history unless the user exports it.
Browser-local storage is a data-boundary choice, not a claim that a device can never be compromised. Account security, browser security, dependency review, access controls, and careful operational practices still matter.
Questions to ask any financial AI product
- Which data is used for deterministic calculation?
- Which data leaves the device?
- Can a user inspect the assumptions behind a number?
- What happens when a required balance or reporting period is missing?
- Can the narration provider invent or alter displayed values?
- What do logs, analytics, and support tools retain?
- How can a user export or reset their data?
A credible answer should describe enforced behavior precisely. Broad security adjectives are less useful than a clear account of what is stored, transmitted, excluded, and retained.
Fain provides financial decision support, not accounting, tax, legal, investment, or regulated financial advice.