Legal AI and professional secrecy
Data security: where your clients’ documents end up
It is the first question a partner asks when the firm evaluates an AI, and the right one. A case file is not just a file: it is material covered by professional secrecy, and whoever handles it is accountable. This page explains data security point by point, with no referral to a privacy notice to read later.
Frequently asked questions about data security
Where is the data of a legal AI stored?
It depends on the provider, and it should be checked before uploading any case file. Data processed by Lidia is stored on AWS infrastructure in the European Union, encrypted at rest and in transit. EU data residency is the minimum requirement for an Italian firm to use an AI system on material covered by professional secrecy.
Does using artificial intelligence breach professional secrecy?
No, provided three conditions are met: the data does not leave the European Union; no third party, including language model providers, can access it; and the relationship with the provider is governed by a data processing agreement. With Lidia, the first two are properties of the architecture; the third is the Data Processing Agreement, which we provide before signing.
Are my documents used to train the AI?
No. No firm document is transmitted to or retained by LLM providers, or used to train their models. It is a property of the architecture, not a setting to switch off.
Which certifications should AI software for law firms have?
The two that matter are ISO/IEC 27001, which certifies the information security management system, and an independent cloud security assessment such as CSA STAR. Lidia holds both, plus ISO 9001 for its processes. Compliance statements that are not certified by a third party are not equivalent.
Do the due diligence first, not afterwards
Roles, sub-processors, processing terms and timescales are set out in the Data Processing Agreement, which we provide together with the contract proposal, before signing.