Keeping client files safe when your firm uses AI
No computer system is perfectly safe. The useful question is not whether AI can be made risk-free. It is whether the largest everyday risk can be removed. For law firms, the answer is yes.
Remote bulk theft
Files on an outside AI service can be attacked from anywhere, at scale, without anyone standing in your office.
Move the files and AI onto protected firm-owned hardware
The protected computer has no general-purpose internet connection and no open software path for client files to leave.
Smaller, slower, more visible risk
Nothing becomes perfect, but the easiest theft path is removed and every release can be checked and recorded.
Safety is not all-or-nothing. It is a matter of degree.
It is tempting to ask whether a system is "safe." But no honest security expert should promise complete safety, because no useful computer system has it. A better question is how hard the system makes the criminal's job, and how much they can take if something goes wrong.
Criminals usually prefer attacks that are remote, cheap, repeatable, and quiet. They want to break in once and take a lot. When client files sit with an outside AI service, that kind of attack has a clear target. When the files sit on a protected computer the firm owns, with no open internet path for those files, that attack stops being easy.
The goal is not perfect safety. The goal is the decision that removes the largest practical risk, then sensible controls that keep what remains small, contained, and on the record.
The best security move is not the fanciest one. It is the one that removes the criminal's cheapest path.
Most everyday AI risk disappears with one decision.
Spending on security does not buy safety in a straight line. The first right decision removes a large category of risk. Each later step helps, but usually removes less. The curve below shows the shape of it.
This is a judgment map, not a measurement chart. The largest drop comes from removing the open internet path to the client files. Later controls still matter, but they mostly reduce smaller and harder residual risks.
Each step helps. One matters far more than the rest.
The order matters. Start with the biggest exposure, then add controls that limit what can happen if something slips through. The bar beside each step shows how much exposure is still left after that choice. More filled means more risk remains. It is a visual ranking, not a measured percentage.
Client files sent to an outside AI service
The files are readable on computers the firm does not own. A stolen credential, breached vendor, or compromised middleware layer can expose data remotely and at scale.
Keep the files and the AI on protected firm-owned hardware
The files a thief wants now sit on a machine with no open internet path. Remote, automated, large-scale theft has no easy route to follow.
Check incoming files on the protected side
Before a file is used, it is opened in a controlled holding area and checked for harmful code. If something gets through, it still has no open internet path out.
Keep each client matter separate
Each matter stays in its own protected container, and only the active matter is open. A problem in one matter does not automatically expose the rest.
Let only finished, approved work leave
The outbound path is for finished drafts or other approved output, not the underlying client file store. The release is checked so confidential material is not hidden inside it.
Require a person to approve each release and keep a record
A person, not the software alone, approves anything leaving the protected computer. Every release is logged with the matter, time, and approving user.
Shielded rooms and similar measures
These address advanced physical spying methods. They are real, but they are usually for government or highly targeted environments, not ordinary law firm threat models.
The bars show remaining exposure after each design choice. The biggest visual change is the move from outside AI infrastructure to protected firm-owned hardware. Everything after that trims smaller residual risks.
Two computers, with controlled one-way movement between them.
The setup is easier to picture than it sounds. The lawyer keeps an ordinary computer for everyday work. The client files and the AI live on a separate protected computer. Information moves between them only in controlled steps.
The normal workstation
- Email, internet, legal research
- Receiving documents from clients
- Printing, filing, and sending
- No protected AI corpus lives here
Where the files and AI live
- Owned and controlled by the firm
- No general-purpose internet connection
- Incoming files checked on arrival
- Client matters separated
- The AI reads and drafts here
The finished document
- Only the finished draft or approved output leaves
- A person approves it first
- Every release is recorded
- Print, file, send, or serve
What this protects, and what it does not.
An honest security page has to draw the boundary. This setup is strong, but it is not a cure for every problem a law firm has.
It removes the easy theft path
A criminal can no longer expect one remote break-in to quietly drain the protected client files. To get them, they would need a harder route, such as physical access or tricking a person.
It does not make AI answers correct
File safety and legal accuracy are different problems. The AI can still make mistakes, miss context, or invent support. A lawyer must review the work before relying on it.
It keeps problems smaller
If harmful code reaches the protected computer, it still lacks an open internet path out. If matters are separated correctly, the exposure is limited to the active matter.
It does not fix your other systems
Email, laptops, document management systems, and cloud storage still need their own security. This protects the files moved into the protected AI environment.
Even isolated computers are not flawless.
If any setup were perfectly safe, it would be a computer with no network connection, sitting alone in a locked room. Yet government security authorities and researchers have long treated this as imperfect too. Computers can leak faint information through electromagnetic signals, sound, light, heat, or power behavior.
This is why TEMPEST and electromagnetic security exist. The point is not that a law firm should panic about exotic spying. The point is that perfect safety is not an honest claim. Even high-security environments manage residual risk with layers.
If even a computer with no network connection is not perfectly safe, then any company claiming its AI system is "100% secure" is making the wrong kind of promise.
The practical conclusion is reassuring. Exotic leakage attacks are targeted, difficult, and usually require proximity or prior compromise. They are not the cheap remote theft that threatens most firms. Your first dollars belong where the everyday risk lives.
How to check that the protection is real.
You do not have to take anyone's word for it. A serious provider should be able to show how the system is built, where the files live, what can leave, and who approves it.
Aim for the change that removes the largest everyday risk.
No system is perfectly safe, and anyone who claims otherwise should not be trusted. The honest goal is maximum practical protection: keep the client files and the AI that reads them on protected firm-owned hardware, remove the open internet path, and let only finished, approved work leave.
Before that change, a remote break-in can quietly become a bulk theft. After it, the attacker needs a slower, harder, more visible route.
That is not a promise of perfection. It is a serious security posture: the main theft path removed, the remaining risk bounded, and every release accountable.