Blog

Private AI: Keeping Your Data Off Public Platforms

Image: Pavel Danilyuk via Pexels

AI tools have quietly become part of everyday work life for many professionals — drafting emails, summarising documents, researching topics, generating first-cut advice. For most industries, that’s a welcome productivity boost. For law firms, though, there’s a line that’s easy to cross without realising it, and crossing it can have serious consequences.

That line is putting client information into a public AI platform.

The problem with public AI tools

Tools like the consumer versions of ChatGPT, Google Gemini, and similar platforms are remarkable — but they’re designed for general use, not confidential professional work. When you type a query into a public AI tool, that data is typically sent to servers overseas, processed by the provider, and in many cases used to improve the underlying model. Even if a provider offers an opt-out, the data has still left your environment.

For a law firm, that’s a fundamental problem. Client communications, case details, contract terms, and legal strategy are all protected by professional obligations around confidentiality. Feeding that information into a public AI tool — even with good intentions and in a rush to meet a deadline — could constitute a breach of those obligations. It may also trigger obligations under the Privacy Act 2020, depending on what personal information is involved.

The risk isn’t hypothetical. Staff under time pressure make pragmatic decisions, and “just paste it in quickly” becomes a habit before anyone realises the exposure.

Public vs private: three ways to deploy AI

“AI” covers a wide range of products, and they handle your data very differently. In practice there are three approaches.

1. Public, consumer AI. Free and personal versions of ChatGPT, Gemini and similar tools. Anyone can sign up with a personal account, and the firm has no visibility or control over what goes in. Depending on the product and its settings, your conversations may be kept and used to improve the provider’s models. These tools are convenient, and for client work they’re the riskiest option.

2. Enterprise AI in a shared cloud. This is where most firms should start.

• Microsoft 365 Copilot runs inside your existing Microsoft 365 tenancy. It respects the permissions you already have on mail, Teams, SharePoint and OneDrive, and falls under your existing compliance and retention settings. Microsoft doesn’t use your prompts or documents to train its foundation models. Its strength is everyday productivity: summarising meetings, drafting emails and finding things across your 365 data. Because it can see everything a user can see, tidy permissions matter before you switch it on.
• OpenAI’s business offerings (ChatGPT Team and Enterprise, and the OpenAI API) don’t train on your business data by default. They also give the firm admin control, single sign-on and a proper agreement, unlike the free consumer accounts.
• Azure OpenAI Service provides OpenAI’s models through your firm’s Azure subscription. You choose the hosting region (including Australia) and get Microsoft’s enterprise data commitments.

The common thread is that the provider is contractually committed to protecting your data, and you manage access through your own identity system. It’s still a shared, multi-tenant service on the provider’s infrastructure, and these are general-purpose tools rather than specialist ones.

3. Private, dedicated deployments. The application runs on infrastructure dedicated to your organisation, and the documents, indexes and history live on your own server. Only the AI analysis is sent to a model provider, under commercial terms. This gives the most control, and it means the tool can be built around a specific job rather than being a general assistant.

None of these is right for every task. Many firms will use Copilot for day-to-day productivity and a dedicated tool for confidential legal analysis. What matters is deciding deliberately rather than letting staff choose for you.

Introducing Cato

We’ve spent the last few months building our own version of the third approach, made specifically for legal work. Cato is a private AI document review assistant for New Zealand law firms, built on Anthropic’s Claude models and already deployed for several of the firms we look after. It’s named after Cato the Censor, who read everything and said exactly what was wrong with it — which is more or less the job description.

Each firm gets its own dedicated Cato server. It isn’t a shared platform, and your data never sits alongside anyone else’s.

Cato is part of Practix, our practice management suite for law firms, and works alongside the rest of the suite. It also runs on its own, so firms can use Cato with the practice management system they already have.

What Cato does

• Reviews documents the way a careful senior would. Upload an agreement, a pleading, an expert report or a whole matter bundle, tell Cato whose side you’re on and what to look for, and it identifies defects, inconsistencies, missing or one-sided clauses, and New Zealand law points.
• Checks the law it relies on. Every statute and case a document cites is checked against the primary source — legislation.govt.nz and New Zealand case law. If an authority can’t be verified, Cato says so plainly and flags the review for a lawyer’s attention rather than glossing over it.
• Confirms who the parties are. Companies, charities and individuals can be checked against the NZ Companies, Charities, Insolvency and Disqualified Directors registers.
• Answers questions about your matter. Ask Cato about the documents in front of it and you get grounded answers that point back to the passage they came from.
• Works in Word, not around it. For Word documents, you get your own file back with a margin comment on every passage at issue. Cato never rewrites the client’s document.
• Writes in your firm’s voice. Your style guide is loaded once, and Cato checks every document against it and follows it in everything it produces.
• Fits your practice. Workflows are set up for the work each firm actually does — agreement review, conveyancing, wills and trusts, employment, court documents, insurance coverage and more.

How Cato keeps your data under control

• Your firm’s Microsoft 365 sign-in. Staff sign in with their existing work accounts, so your Conditional Access and MFA policies apply. Cato holds no standing access to your mailboxes, SharePoint or file shares — it only sees what a lawyer chooses to give it.
• Your documents stay on your server. The documents themselves, search indexes, chat history, review findings and the audit trail all live on the firm’s dedicated Cato server.
• No training on your data. Cato uses Anthropic’s commercial API, under terms that mean your content is not used to train AI models. Each firm has its own API account.

Practical steps for law firms

If your team is already using AI tools — and statistically, they probably are, whether officially sanctioned or not — it’s worth taking stock. A clear AI use policy, staff awareness, and a supported alternative that people actually want to use will go much further than an outright ban. That supported alternative is exactly what Cato is designed to be.

The NCSC’s guidance on protecting your organisation is a useful starting point for thinking about governance and risk in this space.

Getting AI right for a law firm isn’t about avoiding the technology — it’s about deploying it in a way that respects your obligations. If you’d like to see Cato working on your own documents, get in touch with our team and we’ll arrange a walkthrough.

Chris Drowley
General Manager, Resolve Technology
Outside the office, Chris runs a highly organised empire of model trains — where the schedules are always on time, unlike the real thing.