Most AI legal tools skip a step. This one doesn’t.

I designed and built a legal-document AI pipeline for family-court, civil-rights, and criminal defense litigation work, and from the start it treats client PII as something that must never leave the local machine, not as a policy written in a privacy page somewhere, but as an architectural constraint enforced in code and process.

The problem most AI legal tools don’t think about

Sending client documents to a third-party cloud API is a real liability for any firm handling sensitive family-court, civil-rights, or criminal defense matters: names of minors, custody details, witness and informant references, client statements, allegations that are legitimate parts of a real case file but were never meant to leave the building. Most off-the-shelf AI legal tools route everything through the cloud by default and treat “we redact PII first” as sufficient. It isn’t.

Two separate questions, not one

The pipeline treats “is this PII-clean” and “is this safe to send to the cloud” as two independently-checked properties, not the same thing. A sanitizer strips PII first. A separate guardian stage then asks a different question entirely: even with PII gone, is what’s left still too sensitive to leave the building? A document can pass PII sanitization completely and still fail that second check. For example, quoted language or graphic allegations that are a legitimate, necessary part of a real case file, but would still trip a cloud provider’s content filters or simply shouldn’t be sent externally regardless.

Both stages run exclusively on local models. Raw, unredacted documents never touch a cloud API at any point in the pipeline.

The same design applies to criminal defense

Discovery in a criminal case routinely contains material that’s at least as sensitive as anything in a family-court file: witness names and addresses, confidential informant references, juvenile records, client statements made in confidence, victim information subject to its own separate protections. None of that belongs in a cloud AI provider’s logs any more than a custody filing does. The two-gate architecture, sanitize first, then separately check whether what’s left is still too sensitive to leave the building, doesn’t change based on which docket the document came from. The same local-only boundary applies whether the case is a custody dispute or a felony discovery packet.

Proof, not a policy statement

This was tested end-to-end on a real custody document. Sanitization succeeded: no PII leaked. The guardian check independently confirmed no PII remained. And it still correctly flagged the document as unsafe to send to a cloud model, for reasons that had nothing to do with PII. That’s the design working as intended: two separate checks, catching two separate risks, neither one assuming the other already handled it.

How this compares to what attorneys already use

Most attorneys already store client files in Dropbox, Box, or OneDrive, and most legal case management platforms (Clio, MyCase) run in the cloud too. That’s worth being precise about, because it’s not automatically the same risk as pasting a document into a public chatbot.

Dropbox’s business tier is independently audited to SOC 1, 2, and 3, HIPAA/HITECH, and multiple ISO standards, with encrypted sharing links and role-based access controls. Clio completes annual SOC 2 Type II and SOC 1 Type II examinations, is ISO 27001 certified, encrypts data at rest with AES-256, and processes AI-related data within the customer’s own region. MyCase uses 256-bit AES encryption, SOC 2 Type II reporting, and hosts on Amazon’s infrastructure. None of this is theoretical marketing language, these are audited, certified business-class services, and a large share of the profession is already relying on them daily.

What the compliance badges don’t tell you

SOC 2, HIPAA, and ISO certifications are real and they mean something. They also describe controls, not an exhaustive list of every party whose systems ever touch the data. Any real business, including a fully compliant one, has to detect viruses, watch for security threats, and run data loss prevention (DLP) tooling that inspects content moving in and out of the organization. That’s not optional, and it’s not a flaw, it’s baseline security operations. But it means data doesn’t just sit inside one company’s walls. It moves through a chain of internally trusted processes: antivirus and endpoint detection, DLP systems, threat monitoring, sometimes a security operations function the business has fully outsourced to another company’s cloud product entirely.

Reputable vendors actually disclose this, if you know where to look. Both Clio and Dropbox publish public subprocessor lists, a GDPR-driven transparency requirement naming the other companies with access to customer data as part of running the service. That’s a genuinely good practice. It’s also one almost no attorney, and essentially no client, ever reads. Most non-enterprise businesses don’t have a clear picture of their own vendor’s subprocessor chain, let alone a way to explain it to a client who asks where their information actually goes.

This is where a fully local pipeline is structurally different, not just more careful. It isn’t that the sanitizer and guardian stages have a shorter subprocessor list. They have none, because there’s no third party in that part of the pipeline at all. That’s not a claim about how trustworthy any particular vendor’s security team is. It’s a different question entirely: how many links are in the chain before anyone outside your own machine sees the data, and can you actually name every one of them.

Consumer AI and business-class AI are not the same product

This is the distinction that actually matters, and it gets flattened in most conversations about “AI and confidentiality.” The free or consumer tier of a general-purpose AI product and the business or API tier from the same company can have meaningfully different data handling, even though they share a brand name.

With OpenAI, the consumer ChatGPT product may use conversations to train future models unless the user opts out, and retains conversations for up to 30 days for abuse review regardless of that setting. The API does not use submitted data for training by default, and Zero Data Retention is available on Enterprise agreements. With Anthropic, consumer Claude accounts (Free, Pro, Max) can opt in to having their data used for model training, while commercial use, Team, Enterprise, and API, does not train on submitted data under commercial terms, and Zero Data Retention is available for Enterprise customers, meaning Anthropic does not store the data at rest after the response is returned, except where legally required.

Purpose-built legal AI products go further still. Thomson Reuters states that CoCounsel uses a zero-retention API architecture, that customer prompts and content are not used to train the underlying models, and that its contracts with third-party model providers prohibit those providers from training on Thomson Reuters customer data or storing it, including turning off standard abuse-monitoring review paths that would otherwise apply.

What this means for a flagged document

If the guardian stage flags a document as unsafe for the cloud, that isn’t necessarily the end of the road. It might be the right call to keep it local entirely. It might also be a reasonable, informed decision to route it to a business-class or purpose-built legal AI product, Westlaw’s tools, a Claude or OpenAI enterprise agreement with contractual data protections, rather than a consumer-facing product with different default terms. That’s a real choice an attorney can make, with the actual contract terms in front of them, instead of an assumption. The value of the two-gate design isn’t that it forbids the cloud. It’s that it forces that choice to be made on purpose, with the tradeoffs visible, instead of by default.

Why this matters if you’re evaluating AI tools for your practice

This is a compliance and malpractice-risk reducer, not a feature checkbox. It’s the difference between “we use AI” and “we thought through what using AI on your case file actually exposes, before we shipped anything.” That’s the kind of judgment call that doesn’t show up in a sales demo, and it’s the first thing I build in, not the last.