Where Your Data Actually Goes When You Use Legal AI (2026)

Short answer: When you use legal AI, your document does not stay with the vendor you paid. It travels through the vendor's app, out to a foundation model provider (almost always OpenAI or Anthropic), across one of three clouds (Azure, AWS, or GCP), and sometimes through a handful of sub-processors for logging and storage. Whether any layer keeps a copy depends on the contract, not the marketing page. Legal AI is safe for confidential data when the vendor holds zero-data-retention agreements with every model provider, does not train on your content, carries SOC 2 Type II, and puts all of it in a signed DPA. It is not safe by default, and the consumer tiers of ChatGPT, Gemini, and Claude are not safe for privileged material at all.

If you upload a draft motion to Harvey, what server processes it? If you ask CoCounsel to summarize a privileged memo, which foundation model does it route to? When Lexis+ with Protege analyzes a client's contract, who else has access to that contract along the way?

TL;DR

Part of our in-house counsel guide series.

• Your document does not stop at the vendor you paid. It routes to a foundation model (OpenAI or Anthropic), on one of three clouds (Azure, AWS, or GCP), through a handful of sub-processors for storage and logging.
• The contract decides whether that is safe, not the marketing page. Legal AI is defensible for confidential material when the vendor holds zero-data-retention (ZDR) with every model provider, does not train on your content, carries SOC 2 Type II, and names all of it in a signed DPA.
• Consumer tiers are a different, more dangerous category. Free ChatGPT, Gemini, and Claude default to retention and training. A federal court has already read that default against attorney-client privilege.
• The real risk is internal retention and sub-processor sprawl, not the headline word "training." A vendor can hold ZDR with the model provider and still keep your content in its own logs, embeddings, and evaluation sets.

Harvey, CoCounsel (Thomson Reuters), and Lexis+ Protege have the clearest enterprise privacy posture; Legora is roughly comparable on paper but has at least one public retention complaint to address. Enterprise tiers and purpose-built legal AI are where the privacy guarantees live, and only if you confirm them in the contract. More on the Heppner ruling that put this in front of a court is below.

These are not paranoid questions. They are the questions every General Counsel and managing partner should be asking before signing a multi-year AI legal research contract, because the answer is almost never "just the vendor you wrote the check to."

Every major legal AI platform in 2026 is a layer on top of someone else's foundation model, sitting on someone else's cloud infrastructure. Your client's confidences pass through every layer.

This post walks through what each major vendor actually does with your data, based on their published terms, sub-processor lists, and product documentation. Where the documentation is silent, we say so. Where the documentation hedges, we flag the hedge.

The framing question across the board: if a client asked you in writing where their data goes when you use this tool, could you answer with specifics? If the answer is no, you have a competence problem before you have a privacy problem.

The path a privileged document takes, and the five guarantees worth checking are in the contract.

The base layer: foundation models and where they actually run

Almost every legal AI product in 2026 is built on one or both of the two leading foundation model providers:

• OpenAI (GPT-4, GPT-5 series). Hosted on Microsoft Azure plus OpenAI's own infrastructure. Available through the OpenAI API or Azure OpenAI Service.
• Anthropic (Claude Sonnet 4.5, Claude Opus 4 series). Hosted on AWS plus Google Cloud. Available through Anthropic's API, AWS Bedrock, or Google Vertex AI.

Both providers offer enterprise contracts with zero data retention (ZDR) commitments and no training on customer data clauses. Both also offer this only at the enterprise tier. Standard API access has default 30-day retention for abuse monitoring, with opt-out for enterprise customers under OpenAI's documented policy and similar terms from Anthropic.

The legal AI vendor sitting in between you and the foundation model is the one whose contract you actually have to read. Their terms tell you whether they have ZDR with the underlying provider, whether they retain anything themselves, and which sub-processors touch your data along the way.

Consumer AI and legal AI are not the same data path

The most expensive mistake here is treating ChatGPT, Gemini, or Claude.ai the way you treat an enterprise legal tool. They share the same foundation models, but the data terms are opposite.

On a consumer or personal tier, the default is that the provider can retain your prompts and may use them to train its models. On an enterprise tier (ChatGPT Enterprise, Claude Enterprise, Vertex AI, AWS Bedrock), the default flips: no training on your content, and zero data retention is available by contract. A legal AI vendor sits on the enterprise path and adds its own terms on top.

Here is the same distinction as a table. The defaults below are provider-published policies and shift over time, so confirm the current terms before you rely on any row:

The two middle rows are why "we use OpenAI" tells you almost nothing on its own. The standard OpenAI API keeps inputs for roughly 30 days for abuse monitoring before deletion under its published policy; enterprise ZDR removes even that. Which of those two the vendor negotiated is a contract fact, not a logo.

That difference is not theoretical. In United States v. Heppner (covered by DLA Piper, February 2026, and by GC AI), a federal court treated a party's use of Anthropic's Claude as a factor cutting against attorney-client privilege, in part because the privacy policy in play permitted retention, training, and disclosure to third parties. Norton Rose Fulbright published similar court guidance (April 2026, nortonrosefulbright.com) warning that putting privileged material into open or consumer AI can waive confidentiality and legal professional privilege.

This also maps onto the ABA Model Rules. Rule 1.6 (confidentiality) and Rule 1.1 (competence) raise the bar past "do not leak." ABA Formal Opinion 512, issued July 2024, ties that competence duty directly to generative AI: lawyers must understand a tool's data-handling practices well enough to make an informed decision, which the opinion frames as "meaningful due diligence" before deployment. The duty is to know where the data goes and be able to explain it. A vendor you cannot diligence is a vendor you cannot defend.

Harvey

Foundation model: Primarily OpenAI (GPT family), with Harvey being one of OpenAI's earliest partner customers and having privileged access to internal models. Anthropic Claude has been added to certain workflows in 2025.

Cloud infrastructure: Microsoft Azure, including Azure OpenAI Service for the foundation model layer.

What Harvey's published documentation says:

• Harvey's trust page commits to SOC 2 Type II and states that customer data is not used to train Harvey's models or the underlying OpenAI models.
• Harvey holds zero-data-retention status with OpenAI, meaning queries are processed and discarded rather than retained on OpenAI's infrastructure.
• Customer data is stored in Azure within Harvey's tenant, with logical separation between firms.
• Sub-processors include Microsoft (Azure), OpenAI, Anthropic, and (per public references) Datadog, Snowflake, and a few standard SaaS infrastructure providers.

What is less clear:

• The exact retention window for Harvey-internal logs and embeddings. The public docs commit to no training but are less specific about how long uploaded documents and prompts persist in Harvey's own systems before deletion.
• Whether the new Claude-based workflows route through AWS Bedrock or Anthropic's direct API, and whether the ZDR commitment extends to both paths.

The honest assessment. Harvey has the best public privacy posture among the AI-native legal vendors. The SOC 2 Type II, the OpenAI ZDR relationship, and the enterprise-tier Azure setup are credible.

The remaining ambiguity is the typical "internal retention" question that every enterprise SaaS vendor handles via DPAs rather than public docs. Before signing, ask for the Data Processing Addendum in writing and confirm the deletion timeline for embeddings and logs.

Legora

Foundation model: Multi-model. Per Legora's documentation, the platform routes across Claude (Anthropic) and GPT (OpenAI) depending on the workflow, with "Best Fit" model selection inside their agentic layer.

Cloud infrastructure: Microsoft Azure (primary), with AWS Bedrock in some regions for Claude access.

What Legora's published documentation says:

• Legora's trust page commits to SOC 2 Type II and ISO 27001 certification.
• Customer data is not used to train Legora's models or the underlying foundation models.
• Sub-processors include Microsoft (Azure), OpenAI, Anthropic, and standard SaaS infrastructure (Auth0, Sentry, Stripe).

What was less clear, per the public Reddit discussion:

The top-voted comment in the r/legaltech pricing thread included a sharp jab:

"The same Legora that does not fulfill their legal obligations on data retention? Ask me how I know."

That comment was 21 upvotes and unrebutted by Legora-affiliated users in the thread. We have no way to verify the specific claim, but the existence of the perception is worth noting: this is what at least one customer is publicly saying.

The follow-up to ask in your DPA conversation: what is the documented data retention timeline, who has audit rights, and what is the contractual remedy if retention obligations are not met?

The honest assessment. Legora's published posture is comparable to Harvey's. The Reddit critique is one customer's voice and may be a misunderstanding, a contract dispute, or an outlier.

It is also the kind of thing that should be addressed publicly by a vendor whose customers include Hogan Lovells and Goodwin Procter. Before signing, get the retention timeline in writing, confirm audit rights, and ask whether prior customer disputes about data retention exist.

Try Vaquill AI on your matterBook a demo

CoCounsel Legal (Thomson Reuters / Westlaw)

Foundation model: Primarily OpenAI (GPT family), with Thomson Reuters's own fine-tuning and grounding pipeline on top.

Cloud infrastructure: Thomson Reuters operates its own cloud infrastructure plus AWS / Azure for the AI layer. Westlaw editorial content sits on Thomson Reuters's proprietary stack.

What Thomson Reuters's published documentation says:

• The CoCounsel Legal product page states that customer queries and uploaded documents are not used to train the underlying foundation models or Westlaw's content.
• Thomson Reuters has a multi-decade enterprise customer base and corresponding compliance posture (SOC 2, ISO 27001, GDPR DPAs).
• Sub-processors for AI workloads include OpenAI and the underlying cloud providers.

What is less clear:

• The exact ZDR posture with OpenAI for CoCounsel queries. Thomson Reuters has the enterprise scale to negotiate ZDR but has not publicly published the terms.
• Whether Westlaw editorial data (KeyCite, etc.) is augmented with customer query patterns. This is a separate question from "training foundation models" and is where most non-AI legal software actually leaks customer signal into product improvements.

The honest assessment. Thomson Reuters's overall compliance posture is the strongest in the legal AI market because of the scale and the regulated-industry customer base they have serviced for decades. The CoCounsel layer specifically is newer and has less public detail.

The Stanford HAI study that found Westlaw AI hallucinated on a meaningful share of queries is an accuracy question, not a privacy question, but it sits in the back of any privacy conversation: an AI that hallucinates is also an AI whose internal data flows are hard to fully audit.

Lexis+ with Protege (LexisNexis / RELX)

Foundation model: Multi-model "Best Fit" routing across Claude Sonnet 4.5 and GPT-5.1, per LexisNexis's 2025 Protege launch coverage. Hosted on AWS Bedrock.

Cloud infrastructure: AWS (primary), with LexisNexis's own infrastructure for the content layer.

What LexisNexis's published documentation says:

• The Protege product page commits to customer data not being used to train foundation models.
• LexisNexis is part of RELX, a multibillion-pound revenue conglomerate with 36,000+ employees. The compliance posture (SOC 2, ISO 27001, GDPR) is enterprise-grade.
• Sub-processors include AWS, OpenAI, and Anthropic.

What is less clear:

• The specific terms of the AWS Bedrock relationship for Claude and GPT routing. AWS Bedrock has a documented ZDR posture, but whether LexisNexis layers additional retention on top is not publicly specified.
• The interaction between Protege's agentic workflows and LexisNexis's broader data product offerings. LexisNexis is also a data broker; the firewall between AI customer queries and the broader RELX data businesses is a question worth asking in any DPA conversation.

The BBB has multiple recorded complaints about LexisNexis contract auto-renewal and price escalation. These are not directly privacy issues, but they are signal about how the contract is structured and how customer-friendly the standard terms are.

The honest assessment. LexisNexis's privacy posture for Protege is credible at the enterprise tier. The standard contract is auto-renewing with documented friction in cancellation. Before signing, push for a non-auto-renewing term and a clean data deletion clause with a specific timeline.

What a smaller AI-native suite looks like on the same checklist

For completeness, the AI-native suites built after the foundation-model market matured tend to share a recognizable posture: multi-model routing across Claude and GPT, AWS US-region hosting, Cloudflare and Vercel in the perimeter, and ZDR with both foundation model providers.

The trade-off is usually SOC 2 timing: most of these vendors are mid-audit rather than certified, and enterprise buyers should request current security documentation directly instead of relying on a public badge.

One nuance worth flagging in this segment: most public statute and legislation APIs in the market are codified-law surfaces (U.S. Code, CFR, 50 state codes). Case-law research, AI question answering, and citation tools tend to live as in-product features (sometimes with an MCP server option for AI clients) rather than as public REST endpoints.

If a vendor's public API page lists case-law search or "ask a legal question" as a REST endpoint, treat that as a marketing claim and verify with the technical team before procurement.

"We do not train on your data" is two different promises

Watch the wording on every trust page. "We do not train the foundation model on your data" and "we do not use your data to improve our product" are separate commitments, and a vendor can keep the first while quietly doing the second.

A vendor can hold zero-data-retention with OpenAI and Anthropic (so the model providers see nothing persistent) and still fine-tune its own reranker, tune retrieval, or build evaluation datasets from your queries. None of that is "training the LLM," and all of it touches your content. The fix is to ask which of the two promises the vendor is actually making, in writing. We break down how to verify the claim in our guide to checking the "we do not train on your data" pledge.

The retention window nobody diagrams: discovery and litigation holds

Retention is usually framed as a leak risk. There is a second edge to it that in-house teams miss: data a vendor keeps is data that can be discoverable, and data a vendor deletes can become a spoliation problem.

Once a client's document, your prompt, and the model's output sit on a sub-processor's servers, that material is electronically stored information. If it is within your custody or control, it can fall inside a litigation hold and inside an opposing party's discovery request. A retention window you never negotiated can put privileged analysis and work product on a third-party server exactly when a matter goes hot.

The mirror image is worse. Federal Rule of Civil Procedure 37(e) governs the loss of ESI that should have been preserved. If a vendor's automatic deletion cycle purges content that was subject to a preservation duty, the party, not the vendor, wears the consequences. So "the vendor deletes everything in 30 days" is reassuring for confidentiality and alarming for preservation, and both can be true of the same tool at the same time.

The questions to actually ask any vendor before signing

Across all six vendors above, the public documentation rarely answers everything you need. Here is the short list of questions to put in writing during your DPA negotiation, with the same vendor representative who quoted you the price:

1. Foundation model ZDR. "Do you have zero-data-retention status with OpenAI and Anthropic for queries flowing through your platform? If yes, please provide the contractual reference. If no, please explain the retention window and abuse-monitoring posture."

2. Internal retention. "What is the retention timeline for customer-uploaded documents, embeddings, and query content within your own infrastructure? When are these deleted, and on what trigger?"

3. Sub-processor list and changes. "What is your current sub-processor list? What is the notice period before you add or change a sub-processor? Do customers have approval rights or only opt-out rights?"

4. Training-data scope. "Customer query content is not used to train foundation models. But is it used to improve your own product (model fine-tuning, retrieval optimization, ranking, evaluation datasets)? If yes, please describe."

5. Audit rights. "What audit rights does the customer have over your data handling? SOC 2 reports, penetration test reports, customer audit rights, third-party assessments?"

6. Contract structure. "Is the contract auto-renewing? What is the cancellation notice period? Is there a clean data deletion clause with a specified timeline post-termination?"

7. Geographic data residency. "Where physically is customer data stored and processed? Is data residency configurable, and at what tier?"

8. Breach notification. "What is your breach notification SLA? Within how many hours of detection are customers notified, and through what channel?"

A vendor that can answer these eight questions in writing is a vendor you can sign with. A vendor that hedges, slow-walks, or routes you to a generic privacy page is a vendor whose data handling you should not assume is well-defined.

What an actually privacy-paranoid stack looks like in 2026

If your client portfolio includes regulated industries (healthcare, finance, government, critical infrastructure) and you need to be able to answer "where does our data go" with specifics, here is the stack we have seen work at sophisticated in-house teams:

• Frontend AI layer: Claude Enterprise or ChatGPT Enterprise with ZDR confirmed in the contract. ~$60 to $100 per seat per month.
• Research and statute grounding: A neutral statutes API (U.S. Code, CFR, all 50 state statute codes) for the publicly-codified layer, paired with an in-app case-law research surface covering millions of US court opinions when court opinions are in scope. Keep statute lookups on the API tier and let the case-law side run through a tool you have audited.
• Document storage: Your existing iManage, NetDocuments, or SharePoint setup. Do not introduce a new document store unless you absolutely need to.
• Citator: Keep one Westlaw seat for KeyCite or one Lexis seat for Shepard's. Cite-checking is not a privacy-sensitive workflow and can live on the existing enterprise contract.

This stack puts the privacy-sensitive document handling on infrastructure your firm already has audited (iManage, your existing Westlaw or Lexis seat) and uses the AI layer only for analysis, with the AI layer running on enterprise tiers of foundation model providers whose data handling is the best-documented in the market.

Total per-seat cost: roughly $250 to $300 per month, with a clean audit trail for every data flow.

This is the actual answer to "how do I use AI without compromising client confidentiality." It is "buy enterprise-tier foundation models and bring your own research grounding layer," not "buy the most expensive seat."

FAQ

Where does my data go when I use legal AI? Your input leaves your screen, hits the legal AI vendor's application, and is sent to a foundation model provider (usually OpenAI or Anthropic) running on Azure, AWS, or GCP. Along the way it may pass through sub-processors the vendor uses for storage, logging, and authentication. Each of those layers has its own retention rules, which is why the contract matters more than any single trust badge.

Is legal AI safe for confidential and privileged data? It can be, on enterprise or purpose-built legal tools where the vendor has zero-data-retention with the model providers, does not train on your content, holds SOC 2 Type II, and signs a DPA. It is not safe on the consumer tiers of ChatGPT, Gemini, or Claude, because those default to retention and training, which a court has already treated as cutting against privilege.

Does legal AI train on my documents? A reputable legal AI vendor does not train the foundation model on your documents and contractually blocks the model provider from doing so. The gap to watch is product improvement: some vendors still use query content to tune their own retrieval or build evaluation sets. Ask the vendor to confirm in writing that neither the model nor its own product is trained on your data.

Can using AI waive attorney-client privilege? It can. In United States v. Heppner (DLA Piper, February 2026), a court treated consumer AI use as a factor against privilege, partly because the tool's terms allowed retention and disclosure. Norton Rose Fulbright issued comparable court guidance in April 2026. Keep privileged material on enterprise or legal-specific tools with retention terms confirmed.

What is zero data retention (ZDR) and does it cover everything? ZDR is a contractual commitment that the model provider processes your prompt and discards it rather than storing it. It covers the model provider's layer. It does not automatically cover the legal AI vendor's own internal retention of uploads, embeddings, and logs, which is a separate question you have to ask the vendor directly.

What should I ask a legal AI vendor before signing? Ask for the DPA, the current sub-processor list, the ZDR references with each model provider, the internal retention and deletion timeline, audit rights, breach-notification SLA, data residency, and whether the contract auto-renews. A vendor that answers all of these in writing is one you can defend to a client. The eight-question list above is the full version.

Is enterprise ChatGPT or Claude safe for legal work? The enterprise tiers (ChatGPT Enterprise, Claude Enterprise) offer no-training and ZDR by contract, which is a real upgrade over the consumer tiers. They still lack legal-specific grounding and matter isolation, so many teams pair an enterprise model seat with an audited research and document layer rather than relying on the chatbot alone.

How long does a legal AI tool keep my data? It depends on the layer. The standard OpenAI and Anthropic API keeps inputs for roughly 30 days for abuse monitoring before deletion, and enterprise ZDR removes even that. Consumer tiers keep more: Google's personal Gemini retains activity up to 18 months by default. The legal AI vendor then sets its own retention for uploads, embeddings, and logs on top, which is a separate number you have to get in writing. Treat every published default as a starting point and confirm the current terms.

Can data in a legal AI tool be pulled into discovery? Yes. Once your prompt, the client document, and the output sit on a vendor or sub-processor server within your custody or control, that material is ESI and can fall inside a litigation hold or a discovery request. The flip side matters too: if a vendor's automatic deletion purges content that was under a preservation duty, Federal Rule of Civil Procedure 37(e) puts the consequence on your party, not the vendor. Ask whether the tool supports matter-level legal holds that pause automatic deletion.

Bringing it back to your stack

You do not need the most expensive seat to answer "where does our data go." You need every layer documented. That is the whole game: enterprise-tier models with ZDR, a research grounding layer you have audited, document handling on infrastructure you already trust, and a DPA that names it all.

Vaquill AI is one of the AI-native suites built on that posture (multi-model routing across Claude and GPT, US-region hosting, ZDR with both model providers, matter-level isolation), and like the smaller vendors above we tell buyers to request current security documentation directly rather than trust a badge. If you are mapping your own data flows, start with the eight questions in this post and put the answers in writing.

For related operational playbooks, see Which Legal AI Vendors Offer Signed DPAs, the DPA review field guide for in-house counsel, and the vendor security questionnaire. For a worked sub-processor map, see Harvey's sub-processors. For how data is scoped and isolated inside a workspace, see What Is Matter Management in Legal AI and matter workspaces.

Vaquill AI

Product & Content

Legal AI suite for US working lawyers: research, drafting, document comparison, document matrix, matters, and citation-verified answers, in one tool.