Using LLMs on Customer Financial Data Without Exposing It to AI Providers

#fintech #privacy #python #security

If you're building fintech, you've already run into this wall: your compliance team won't let you send customer transaction data, account numbers, or income details to OpenAI or Anthropic. But the product your customers want requires AI.

Here's how to build the bridge — legally and technically.

The Regulatory Landscape

Three frameworks govern financial PII in the US:

GLBA (Gramm-Leach-Bliley Act) — requires financial institutions to protect "nonpublic personal information" (NPI). Sending raw NPI to a third-party AI provider without proper safeguards likely violates this.
PCI-DSS — governs cardholder data. Sending card numbers, CVVs, or PANs to any third party (including AI providers) without explicit scoping is a compliance violation.
CCPA/CPRA — California residents have rights over how their data is processed.

None of this means you can't use AI on financial data. It means you need a de-identification layer.

The Pattern: Scrub → Infer → Restore

Customer Data (with PII)
  → Scrub PII
  → Send anonymized data to LLM
  → Get response
  → Restore PII in context if needed

The AI never sees the real data. Only your system does.

Example: Transaction Categorization

curl -X POST https://tiamat.live/api/scrub \
  -H "Content-Type: application/json" \
  -d '{
    "text": "John Chen - Account #4521-8872\n2026-02-01: PAYPAL *NETFLIX $15.99\n2026-02-03: VENMO PAYMENT Sarah Mitchell $120.00"
  }'

Response:

{
  "scrubbed": "[NAME_1] - Account #[ACCOUNT_1]\n[DATE_1]: PAYPAL *NETFLIX $15.99\n[DATE_2]: VENMO PAYMENT [NAME_2] $120.00",
  "entities": {
    "NAME_1": "John Chen",
    "ACCOUNT_1": "4521-8872",
    "NAME_2": "Sarah Mitchell"
  }
}

Transaction amounts and merchant names remain (needed for categorization). Customer identity is gone.

Example: Loan Application Analysis

import requests

loan_data = """
Applicant: Maria Rodriguez
SSN: 456-78-9012
Annual Income: $87,000
Credit Score: 742
Loan Amount: $35,000
Purpose: Home renovation
"""

response = requests.post('https://tiamat.live/api/proxy', json={
    'provider': 'groq',
    'model': 'llama-3.3-70b-versatile',
    'messages': [{
        'role': 'user',
        'content': f'Assess this loan application risk (LOW/MEDIUM/HIGH):\n{loan_data}'
    }],
    'scrub': True  # SSN, name stripped before hitting Groq
})

print(response.json()['content'])
# Risk Level: LOW — strong credit score, healthy income-to-loan ratio

The SSN and applicant name never touched Groq's infrastructure.

What TIAMAT Scrubs from Financial Data

Account/card numbers — checking, savings, credit card
SSNs and EINs
Names — customers, guarantors, co-signers
Routing numbers — ABA routing numbers
Dates — preserved as placeholders
Phone/email/addresses
IP addresses

Transaction amounts and merchant names are preserved by default.

Why Not Just Use Azure OpenAI?

Enterprise contracts start at $10K+/year before token costs. You're locked to one provider. Model access lags. Still requires legal review.

TIAMAT's scrub layer lets you use ANY provider while keeping PII out of the pipeline. Switch from GPT-4 to Groq (10x faster) in one line.

Pricing

/api/scrub — $0.001 per request
/api/proxy — provider cost + 20%
Free tier: 50 scrubs/day, 10 proxy requests/day

AWS Comprehend PII: $0.01/unit. Azure Cognitive Services PII: $1/1000 transactions. TIAMAT is 10-1000x cheaper.

Try It

curl -X POST https://tiamat.live/api/scrub \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Wire transfer from account 8821-4432 to routing 021000021. Sender: James Park. Amount: $15,000."
  }'