Every solicitor evaluating an AI tool asks the same question, usually a little too late: when I put this matter into the box, where does it actually go?

It is the right question. Most tools answer it badly, or not at all.

Two architectures, one that matters

Broadly, an AI product for a law firm is built one of two ways.

In the first, the document leaves your machine. It is uploaded to the vendor's servers, processed there, and stored there: often to "improve the service". Your control ends the moment you click send.

In the second, the case file stays under your control. It lives in an encrypted vault your firm controls, not on the vendor's servers. When you ask the AI to draft or analyse, only the text needed for that one step is sent. Uploading a document sends its text for an automatic summary, after the privilege check. Reading and editing send nothing. It may pass through the vendor's AI service on the way to the model, but it is not stored there.

The difference is not a feature. It is the whole question of whether you can put a privileged file into the thing.

Where the privilege line actually sits

Legal professional privilege in England and Wales is a duty you cannot casually delegate to a supplier, and in some jurisdictions the professional-secrecy duty is stricter still, closer to an absolute prohibition than a best-efforts promise. "We take security seriously" is not a lawful basis for putting a privileged communication onto a third party's servers.

So the test is simple, and it is architectural, not contractual: does the privileged material have to leave your machine for the tool to work? If the answer is yes, no amount of encryption changes what you have done: you have disclosed it to a processor.

What "customer-controlled" means in practice

A customer-controlled tool keeps the case file in an encrypted vault the firm controls: on the solicitor's own computer, or on a server the firm runs. There is no vendor database of your files to breach, subpoena, or forget to delete. On the attended UK AI path, protected or unknown material triggers a per-request warning. The attending solicitor can explicitly override it for that request; no answer or a decline refuses the request. That record is a product decision only: it does not establish client authority or decide whether privilege is waived. Other market routes can hard-block.

The key question behind the key

There is a second question hiding inside the first: whose AI key is it?

On a managed key, the vendor mediates every call: convenient, but it means the vendor sits in the path. Bring-your-own-key (BYOK) puts your own provider credentials in play, so your usage is billed to you directly, at your provider's rates, and the path is yours. For a firm that wants the shortest possible line between its desk and the model, that shortness is the point.

A short checklist for any AI tool

Before you put a real matter into anything, ask:

  • Where is matter data stored at rest: in a store I control, or on your servers?
  • What exactly leaves on each AI call, which servers does it pass through, and does anyone keep it?
  • Can privileged documents be hard-blocked from leaving, not merely flagged?
  • Who can read the logs, and can I export a record of what the AI did?

The blunt version: if a tool cannot tell you precisely what leaves your machine and when, assume everything does, and treat it accordingly.

That is the standard we built to, because it is the only one a careful firm can actually defend.

← All posts