Security questions every litigator should ask a legal AI

Uploading client material to an AI tool is not like uploading a spreadsheet to a cloud drive. The contents are privileged, confidential and often subject to strict professional duties. Before you connect your firm's data, ask these questions.

1. Is my data used to train the model?

If the provider trains on your prompts or documents, your client's strategy could reappear in another user's output. Confirm in writing that your data is excluded from model training.

2. Who can access my workspace?

Check that access is controlled by role, that owners can remove members instantly, and that activity is logged. Shared credentials or uncontrolled admin access are red flags.

3. Is encryption applied in transit and at rest?

Basic compliance now, but still worth confirming. Look for modern TLS (Transport Layer Security — the padlock in your browser) on every connection, so documents cannot be read while travelling between your device and the platform, and encrypted storage at rest, so files are unreadable if storage is ever accessed directly.

4. Where does the AI processing happen?

Understand which jurisdiction hosts the servers and whether your data leaves your region. This matters for client confidentiality rules and data-protection obligations.

5. Can I delete everything?

You should be able to delete a matter, a workspace and the account itself without a support ticket. Retention policies should be clear and short.

Zealia answers each of these with workspace isolation, role-based access, confidential matters (an ethical wall that even workspace owners and admins cannot see past unless added to the matter team), TLS encryption in transit and encryption at rest, multi-factor authentication (MFA — a one-time code from an authenticator app or email on top of your password, with backup codes) and a no-training policy. Security is not a feature bolted on later; it is the foundation the platform is built on.