Security & confidentiality

Work is set up in your firm’s own ChatGPT or Claude account and the email, document and storage tools agreed for the workflow, using the firm’s paid AI plan. Processing locations depend on those providers, your plan and your account settings. We record the selected services and relevant processing locations before live client material is used.

OpenAI processes the prompts, files and other content sent to ChatGPT. Anthropic processes the content sent to Claude. Connected email, storage or other tools process the content the agreed workflow passes to them. We agree what may be sent, which accounts are used and who can access them before connecting live data. Provider terms and account settings govern their handling and model-training use. The approved AI sub-processor is the provider your firm chooses on its own paid account. No other sub-processor is authorised by default.

JurisLab does not keep client documents by default. The workflow uses your firm’s agreed accounts and tools. Any JurisLab-held copy must be specifically agreed in writing, with its purpose, permitted access, retention and deletion arrangements.

Do not send client documents in the first conversation. Describe the task and use sanitised samples only, with client names, identifying details and confidential content removed. Live client material is used only after the handling and access arrangements are agreed.

Documents and conversations in your firm’s tools follow the relevant provider’s terms and your account’s retention settings. Client files held by JurisLab are deleted within 30 days after the engagement ends, including working copies and backups under our control. Your firm controls its original records and accounts; provider-held copies follow the provider’s terms and settings.

Read the current ChatGPT retention guidance and Claude retention guidance for the products your firm uses.

Yes. Each engagement gets a written data-processing agreement before client data is handled. We use one standard engagement agreement for every firm. The service provider is Ansh Khandelwal, trading as JurisLab, a sole proprietor. Your firm is the data fiduciary/controller. JurisLab acts as the firm’s processor and follows the firm’s documented instructions. The agreement records the purpose, approved tools and providers, access, retention, deletion and how data requests or incidents are handled.

Your firm controls its accounts. We agree the access needed for setup and support, check the chosen provider settings with your team and record who may use the workflow. Access is reviewed at handover and removed when it is no longer needed.

A lawyer at your firm reviews every output before it is sent or filed. The workflow’s review and approval steps are agreed and tested on sanitised samples. Your firm authorises the final communication or filing.