Short answer: When you use a legal AI tool, your document does not stay with the vendor you paid. It goes to the vendor's application, usually on to one or more foundation model providers, and sometimes through other sub-processors for storage, logging or monitoring. Whether any layer keeps a copy depends on the contract and the plan, not on the marketing page. A tool is easier to defend for confidential material when the vendor can show, in writing, what each layer retains, that it does not train on your content, and what its own security audits cover. A free consumer chatbot is a different category, and the provider pages quoted below say why.
Reviewed and corrected on 12 October 2026. Vendor statements below come from the vendor pages named under Sources, as read on 12 October 2026. Vendors change their terms, so check those pages before relying on this. This is general information, not legal advice.
If you upload a draft motion to a legal AI product, what server processes it? If you ask it to summarize a privileged memo, which model does it route to? Who else can see that memo on the way? These are the questions a general counsel or managing partner should be able to answer in writing before signing a multi-year contract.
TL;DR
Part of our in-house counsel guide series.
- Your document does not stop at the vendor you paid. It can reach a foundation model provider, a cloud platform and other sub-processors. Each has its own retention rules.
- The contract decides, not the marketing page. Ask each vendor what its model providers retain, what it retains itself, and whether it uses your content for anything beyond answering you.
- Consumer tiers run on different terms. OpenAI's help center says data sharing for training is on by default for ChatGPT Free, Plus and Pro. Google's Gemini Apps page asks users not to enter confidential information they would not want a reviewer to see. A federal court has already read a chatbot's privacy policy against a user's claim of privilege.
- "Zero data retention" is narrower than it sounds. Both OpenAI and Anthropic describe it as an approved arrangement for eligible API endpoints or products, with limits. It says nothing about what the legal AI vendor keeps in its own systems.
A legal AI vendor tells you it has zero data retention with its model provider. You ask what happens to the contract you upload inside the vendor's own product. What is the right way to read the vendor's answer?
Every major legal AI platform is a layer on top of someone else's foundation model and someone else's cloud. Your client's confidences pass through each layer, so the question is what each one keeps. This post walks through what the providers and four legal AI vendors say on their own pages, where those pages stop, and the questions to put in writing. Where a page is silent, it is silent, and we say so.
The framing question: if a client asked you in writing where their data goes when you use this tool, could you answer with specifics? If not, you have a competence question under ABA Formal Opinion 512 before you have a privacy question.
The base layer: model providers and the clouds that offer them
Legal AI products call foundation models, sometimes through a cloud platform. Thomson Reuters's CoCounsel page, for example, names OpenAI and Google, and Anthropic's announcement refers to Claude API use "via third parties such as Amazon Bedrock and Google Cloud's Vertex AI." Which route a legal AI vendor uses changes whose retention terms apply. Here is what each provider's own page says.
| Provider and route | Training | Retention and monitoring |
|---|---|---|
| OpenAI API Platform | Not used for training by default (Enterprise privacy page, updated 8 January 2026) | Abuse monitoring logs kept for up to 30 days by default, unless longer retention is required by law or is reasonably necessary to protect its services or a third party. Zero Data Retention or Modified Abuse Monitoring need OpenAI's prior approval (Your Data page) |
| Anthropic API | Not used for training by default; feedback you submit or data you choose to allow can be used (commercial privacy article, 18 August 2026) | Inputs and outputs deleted within 30 days of receipt or generation, with exceptions (for example agreed zero data retention, Usage Policy enforcement, the law). Zero data retention is "subject to Anthropic's approval" for eligible APIs and Claude Code on Enterprise plans, and Anthropic still keeps safety classifier results |
| Microsoft, Models sold by Azure (includes Azure OpenAI models) | Not used to train foundation models without your permission or instruction; prompts and completions are "NOT available to OpenAI or other providers of Models sold by Azure" (page last updated 19 May 2026) | Abuse monitoring can store a sample of prompts and completions for human review in the Azure geography of your resource. Customers approved for modified abuse monitoring do not have that storage and human review |
| Google Cloud, Gemini Enterprise Agent Platform | Google "won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction" (page last updated 9 October 2026) | Prompts may be logged for abuse monitoring under the Cloud terms, and a customer can request an exception. Zero data retention needs specific steps, such as not enabling request-response logging. Grounding with Google Search stores some data for up to three days |
| Amazon Bedrock | AWS's Bedrock FAQ says AWS and third-party model providers will not use Bedrock inputs or outputs to train Amazon Nova, Amazon Titan or any third-party models | Bedrock's abuse detection page says that by default it does not store model inputs or outputs, but for models it lists, flagged or all traffic is retained for up to 30 days |
Three points follow from that table:
- "We use OpenAI" tells you almost nothing on its own. Calling OpenAI's API directly and calling an OpenAI model through Azure are different data paths with different pages. Microsoft's page says its Azure deployment does not interact with services operated by OpenAI, such as ChatGPT or the OpenAI API.
- Zero data retention is approved, scoped and conditional. OpenAI says its controls "are subject to prior approval." Anthropic's zero data retention article lists the products it applies to. Anthropic's covered models article says that, for models it designates as covered, prompts and outputs are retained for 30 days, including for zero-retention organizations.
- The provider page is only part of the answer. The legal AI vendor in the middle decides which route, which plan and which settings apply to your documents.
Consumer AI and business AI are not the same data path
The most expensive mistake is treating a personal chatbot account like an enterprise legal tool. The providers' own pages show different defaults:
| Product | What the provider says |
|---|---|
| ChatGPT Free, Plus, Pro | OpenAI's help center: data sharing is enabled by default for those plans on a personal workspace, and you can opt out of training in settings |
| ChatGPT Business, Enterprise | By default OpenAI does not use business data for training. Workspace admins control retention, and deleted conversations are removed from its systems within 30 days unless longer retention is legally required (for Business, also if reasonably necessary to protect its services). The Enterprise privacy page describes zero data retention for the API, not for ChatGPT Enterprise |
| Claude Free, Pro, Max | Consumer Terms allow training on your Materials unless you opt out in settings, and feedback and safety-flagged content can still be used. If you allow training, Anthropic may keep de-identified data for up to five years |
| Claude Team, Enterprise | Commercial Terms: Anthropic "may not train models on Customer Content from Services." Chats stay in the product until deleted, and Enterprise owners can set custom retention |
| Gemini Apps (personal) | Google says human reviewers review some data and asks users not to enter confidential information they would not want a reviewer to see or Google to use to improve its services. The default auto-delete period is 18 months, and reviewed chats are retained for up to three years |
Our companion guides walk each product in detail: is ChatGPT confidential for legal work, is Claude private for legal work, is Copilot private for legal work and is Gemini private for legal work.
That difference is not theoretical. In United States v. Heppner (S.D.N.Y., 17 February 2026), Judge Jed Rakoff held, in a ruling framed around communications with a "publicly available AI platform," that a defendant's written exchanges with Claude were not protected by attorney-client privilege or the work product doctrine. On confidentiality, the court relied on the platform's privacy policy as of February 2025, which it said provided that Anthropic collects users' inputs and Claude's outputs, uses such data to train Claude, and reserves the right to disclose it to third parties. In footnote 3 the court said that even if some input was privileged, the defendant waived the privilege "by sharing that information with Claude and Anthropic, just as if he had shared it with any other third party" (memorandum, ECF No. 27). The opinion does not say what a business plan or a training opt-out would change. The same opinion says the defendant's lawyers had not directed him to use the tool.
A separate English decision points in a similar direction. Norton Rose Fulbright's April 2026 blog describes UK v Secretary of State for the Home Department [2026] UKUT 81 (Hamid), in which the Upper Tribunal said uploading confidential documents to an open-source AI tool such as ChatGPT can waive privilege, while closed tools that do not place information in the public domain are different (Norton Rose Fulbright, "Court guidance that use of open-source AI waives confidentiality and legal professional privilege"). It is an English tribunal, so it does not bind a US court.
This also maps onto the ABA Model Rules. ABA Formal Opinion 512 (29 July 2024) says lawyers "should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool." It adds that "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool" because many self-learning tools are designed so that their output could lead to disclosure, and that "merely adding general, boiler-plate provisions to engagement letters" is not sufficient. It also says consent is not necessary where the lawyer inputs nothing relating to the representation, as with idea generation. The duty is to know where the data goes and be able to explain it.
What four legal AI vendors say on their own pages
These are each vendor's own statements, as read on 12 October 2026. They are marketing and trust pages, not contracts, so treat them as the starting point for a diligence request.
Harvey (security page). Harvey says it "hosts its cloud environment in Microsoft Azure," with processing available in the EU and Switzerland, the US or Australia. It says it contractually prohibits model providers from training on customer data and "requires Zero Data Retention (ZDR) by model providers." It says customers set retention policies and can delete data at any time, and that it undergoes annual SOC 2 Type II and ISO 27001 audits. The page points to a Security Portal for details. The page itself does not list sub-processors or model providers by name, so ask for the current list.
Legora (security page). Legora says it will not use customer data "to train or fine tune any AI models," and lists ISO 27001, ISO 42001 and SOC 2 Type 2. It says customers can set retention periods, offers bring-your-own-key encryption, and says that when a contract ends all data is permanently deleted after an export opportunity. The page does not name model providers or sub-processors, so ask which providers sit behind each workflow and what they retain.
CoCounsel (Thomson Reuters product page). Thomson Reuters says user content and prompts "are not used to train or improve CoCounsel and associated products or LLMs, used in Thomson Reuters or third-party output, or stored by OpenAI or Google." It says its AI partners such as OpenAI and Google are contractually prohibited from training on customer data, and that, "where applicable," it has controls to turn off third parties' abuse-monitoring solutions. It also says: "All interactions with GenAI LLM providers use zero-retention API calls." Retention of user content is set at the organization account level. A second CoCounsel page lists SOC 2 and ISO 42001 certification.
Lexis+ with Protégé (LexisNexis product page). The same page makes two statements: "We never use customer data to train AI models" and, in the FAQ, "Customer data is not used to train public AI models." It also says "Identifiable information is removed from AI interactions so that we can improve performance without compromising privacy." Because the wording differs between the two statements, ask LexisNexis in writing exactly what is and is not used, including for product improvement. The page does not name model providers.
Across all four, the useful follow-ups are the same: the data processing addendum, the sub-processor list, the vendor's own retention timeline, and the audit reports behind each certification.
"We do not train on your data" can mean two different promises
Watch the wording on every trust page. "We do not train the foundation model on your data" and "we do not use your data to improve our product" are separate commitments, and a vendor can make the first without the second. A vendor can have no retention at its model provider and still tune its own retrieval, ranking or evaluation sets from your queries. None of that is training the large language model, and all of it touches your content. Ask which of the two promises the vendor is making, in writing. We break down how to verify the claim in our guide to checking the "we do not train on your data" pledge.
The retention window nobody diagrams: discovery and litigation holds
Retention is usually framed as a leak risk. There is a second edge: data a vendor keeps can be discoverable, and data a vendor deletes can become a preservation problem.
Federal Rule of Civil Procedure 34(a)(1) reaches electronically stored information in "the responding party's possession, custody, or control." Whether material held by an AI vendor is within your control is a fact question for your e-discovery counsel, but a retention window you never negotiated can put prompts, outputs and uploads somewhere you have to account for.
The mirror image is the duty to preserve. Rule 37(e) applies "[i]f electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery." So a 30-day automatic deletion cycle can be reassuring for confidentiality and a problem for preservation, in the same tool.
The questions to put in writing before signing
Public documentation rarely answers everything you need. Put these questions to the vendor's representative as part of the DPA negotiation:
1. Model provider retention. "Which model providers and cloud platforms process our content? For each, what do you have agreed about retention and abuse monitoring, and can you provide the contractual reference?"
2. Internal retention. "What is the retention timeline for customer-uploaded documents, embeddings, logs and query content in your own systems? When are these deleted, and on what trigger?"
3. Sub-processor list and changes. "What is your current sub-processor list? What is the notice period before you add or change one? Do customers have approval rights or only opt-out rights?"
4. Training-data scope. "Customer content is not used to train foundation models. Is it used to improve your own product, including fine-tuning, retrieval, ranking or evaluation datasets? If yes, describe it."
5. Audit rights. "What audit rights does the customer have? Can we see SOC 2 reports, penetration test reports and third-party assessments?"
6. Contract structure. "Is the contract auto-renewing? What is the cancellation notice period? Is there a data deletion clause with a specified timeline after termination?"
7. Data residency. "Where is customer data stored and processed? Is residency configurable, and at what tier?"
8. Breach notification. "What is your breach notification commitment? Within how many hours of detection are customers told, and through what channel?"
A vendor that can answer these eight questions in writing is a vendor you can defend to a client. A vendor that routes you to a generic privacy page has not yet answered.
FAQ
Where does my data go when I use legal AI? Your input goes to the vendor's application and, usually, on to one or more model providers, sometimes through a cloud platform. Along the way it may pass through sub-processors for storage, logging and authentication. Each layer has its own retention rules, which is why the contract matters more than any single trust badge.
Is legal AI safe for confidential and privileged data? It can be defensible when you have read the vendor's terms, confirmed in writing what each layer retains, confirmed it does not train on your content, and decided about client consent under ABA Formal Opinion 512. Provider pages show that consumer chatbot plans run on different defaults, and Heppner shows a court reading a chatbot's privacy policy against a user.
Does legal AI train on my documents? Each vendor page above says it does not train on customer data, in wording that varies. The gap to ask about is product improvement: some vendors' statements cover model training but say less about tuning their own retrieval or evaluation sets. Get the answer for both in writing.
Can using AI waive attorney-client privilege? In United States v. Heppner (S.D.N.Y., 17 February 2026) the court held a defendant's chats with a publicly available AI platform were not privileged, relying in part on the platform's privacy policy, and said he waived any privilege in what he input by sharing it with the provider. It is one district court's ruling in a criminal case and it did not decide what a business plan would change.
What is zero data retention (ZDR) and does it cover everything? It is an arrangement under which a provider does not store a customer's inputs or outputs, with limits. OpenAI says its controls are subject to prior approval and to endpoint limits. Anthropic says its arrangements are for eligible APIs, products using a commercial API key and Claude Code on Enterprise plans, subject to approval, and that it still keeps safety classifier results. None of that covers what a legal AI vendor keeps in its own systems.
What should I ask a legal AI vendor before signing? Ask for the DPA, the current sub-processor list, the agreements with each model provider, the internal retention and deletion timeline, audit rights, breach-notification terms, data residency, and whether the contract auto-renews. The eight-question list above is the full version.
Are enterprise ChatGPT and Claude safe for legal work? OpenAI and Anthropic each say they do not train on business data by default, and each offers admin controls. Neither page promises zero data retention for everyday enterprise chat: OpenAI describes it for API endpoints, and Anthropic for eligible API use and Claude Code on Enterprise plans. Read the agreement you would sign and decide on consent under Opinion 512.
How long does a legal AI tool keep my data? It depends on the layer. OpenAI's API keeps abuse monitoring logs for up to 30 days by default. Anthropic deletes API inputs and outputs within 30 days, with exceptions. Google's personal Gemini default auto-delete period is 18 months. The legal AI vendor then sets its own retention for uploads, embeddings and logs, which is a separate number you have to get in writing.
Can data in a legal AI tool be pulled into discovery? It can be, depending on the facts. Rule 34(a)(1) reaches ESI in a party's possession, custody, or control, and whether a vendor's copy counts is a question for your e-discovery counsel. The flip side matters too: Rule 37(e) addresses ESI that should have been preserved and is lost because a party did not take reasonable steps. Ask whether the tool can pause automatic deletion for a legal hold.
For related operational playbooks, see which legal AI vendors offer signed DPAs, the DPA review field guide for in-house counsel and the vendor security questionnaire. For a worked sub-processor map, see Harvey's sub-processors, and for how data is scoped inside a workspace, what is matter management in legal AI.
For the US statutes, regulations and court rules these laws sit in, see the US primary law API.
Sources
All pages read on 12 October 2026.
- OpenAI: Enterprise privacy at OpenAI (updated 8 January 2026), Your data (API Platform) and help center: keep history on but disable model training
- Anthropic: Updates to Consumer Terms and Privacy Policy (28 August 2025), Consumer Terms, Commercial Terms, and the Privacy Center articles consumer retention (1 July 2026), commercial training (18 August 2026), commercial retention (1 July 2026), zero data retention and covered models (5 September 2026)
- Microsoft: Data, privacy, and security for Models sold by Azure in Microsoft Foundry (last updated 19 May 2026)
- Google: Gemini Enterprise Agent Platform and zero data retention (last updated 9 October 2026) and Gemini Apps Privacy Hub (last updated 24 September 2026)
- AWS: Amazon Bedrock abuse detection and Amazon Bedrock FAQs
- Legal AI vendors: Harvey security, Legora security, Thomson Reuters CoCounsel and CoCounsel Core, Lexis+ with Protégé
- United States v. Heppner, No. 25 Cr. 503 (JSR), ECF No. 27 (S.D.N.Y. 17 February 2026)
- Norton Rose Fulbright, "Court guidance that use of open-source AI waives confidentiality and legal professional privilege"
- ABA Formal Opinion 512 (29 July 2024)
- Federal Rules of Civil Procedure: Rule 34 and Rule 37 (Cornell Legal Information Institute)
Last updated: 12 October 2026.
New legal AI guides, weekly.
Further Reading
Legal AI DPA, GDPR, and EU vs US Data Hosting: Vendor Guide
Read postWhat Is Matter Management in Legal AI, and Why Segregation Beats One Chatbot
Read postLegal Research Platforms: Why Matter & Folder Organization Wins
Read postLaw Firm-Client Collaboration With AI: Shared Matter Workspaces
Read postAI Compliance Check: CCPA, GDPR, and SOX for In-House Teams (2026)
Read postHarvey AI Pricing 2026: Per-Seat Cost and the Renewal Increase
Read post
Product & Content
The US primary law data API: statutes, regulations, constitutions, court rules, executive orders and agency guidance across 53 US jurisdictions, each section cited and linked to its official source, via REST, MCP or SQL.