The easiest way to leak client data into an AI system is also the most ordinary one: someone copies a contract, email thread, medical note, due-diligence file, HR document, or litigation memo into a consumer chat tool because the result is useful. The security problem is not “AI” in the abstract. It is an unmanaged workflow.

01 The real risk is an uncontrolled handoff

When a team uses a public chatbot as a work surface, it loses control over three practical questions: what sensitive data left the organization, how long it may be retained, and whether the provider can use it to improve models. For regulated or confidential work, those questions must be answered before the first document is processed.

Build the workflow so the LLM receives only the minimum useful context, not the whole file.

An internal workflow creates a controlled handoff. It can authenticate the user, read documents from approved sources, redact personal and confidential details, call the right API configuration, log what happened, and require review before anything is sent to a client or saved back to the matter system.

02 A practical redaction pipeline

The pipeline should run before the LLM call. First, classify the task: summarize, extract dates, draft questions, compare clauses, or prepare a reply. Then detect and replace sensitive entities such as client names, opposing parties, addresses, phone numbers, email addresses, bank details, ID numbers, matter references, case numbers, health data, employee data, commercial terms, and privileged strategy.

INGESTApproved files
→
REDACTPII + secrets
→
LLMMinimal context
→
REVIEWHuman approval

The safest version keeps a mapping table inside your own system: “CLIENT_001” maps to the real client name, “DATE_003” maps to the original deadline, and so on. The LLM works on placeholders. After the response comes back, your workflow can rehydrate only the fields that are needed, or leave the output pseudonymized for internal review.

Useful guardrails include allow-lists for document sources, deny-lists for fields that never leave the system, deterministic redaction for repeated entities, confidence thresholds, manual approval for low-confidence redaction, encrypted logs, and a retention policy for intermediate files.

03 Provider controls matter more than brand preference

Mistral is a strong option for European teams because it is a French company, says data is hosted in the European Union by default, provides a Data Processing Addendum, and states that paid API data is not used to train models. Mistral also distinguishes training opt-out from Zero Data Retention: ZDR is available on the Scale plan for stateless API calls, and when enabled, API inputs and outputs are not retained beyond what is required to return the response.

That does not mean every Mistral product has the same privacy posture. Free or chat-style products can have different training and retention behavior than paid API usage, and stateful products such as agents, files, conversations, libraries, or chat experiences must store data to function. The architecture has to choose the right endpoint and plan, not just the right logo.

OpenAI makes a similar distinction worth understanding: its API documentation says data sent to the API is not used to train models unless the customer opts in, while standard abuse-monitoring retention varies by endpoint and Zero Data Retention eligibility is endpoint-specific. Consumer ChatGPT has separate data controls, including the ability to turn off “Improve the model for everyone.”

04 Why this matters even more for law firms

Yes, law firms should be stricter. They handle client confidentiality, professional secrecy, sensitive personal data, adversarial strategy, evidence, deadlines, and privileged communications. A weak AI workflow can create several harms at once: data breach risk, loss of confidentiality, poor auditability, hallucinated legal content, and unclear responsibility for a client-facing answer.

For a law firm, the right pattern is usually a secure legal intake or document-triage workflow: collect documents, remove or pseudonymize sensitive data, ask the LLM for a structured brief, highlight missing evidence, surface risks and deadlines, and force a lawyer review before any matter update, email, or calendar deadline is created.

WORKING RULE

Do not send raw sensitive data to an LLM unless the provider contract, endpoint, retention setting, access model, and human review process have all been chosen intentionally.

05 Sources worth checking