Where your matter text goes when you hit send

By Michael Nadalin, Founder, Market Lead · 9 September 2026 · 7 min read

You paste four paragraphs of a client's affidavit into a chat window to get a plain English summary. The reply comes back in nine seconds. In those nine seconds that text has been packaged into a request, sent across a network, held in memory on a machine you cannot name, possibly written to a log, possibly retained for a fixed window, and possibly read by a human doing abuse review. None of that is visible to you. The interface shows a typing indicator.

Most discussion of AI and confidentiality stops at the wrong question: will my data be used for training. That is the easy one, and vendors now answer it clearly because it costs them nothing to say no. The harder questions are where the text physically sits, who can lawfully compel access to it, and how long it survives after your session closes. Those are the ones that matter if a client asks you to certify that their commercially sensitive material never left the country.

This is a walk through each hop between your keyboard and the model, what is actually happening at each one, and the specific questions that force a vendor into a straight answer instead of a marketing page.

The nine seconds, hop by hop

A single prompt is not one journey. It is a chain, and each link is a different company, a different jurisdiction and a different retention policy. Firms tend to assess the one they have a contract with and assume the rest inherit its terms. They do not.

The hop that surprises people is the gap between the tool you bought and the model it calls. A great many Australian legal AI products are a well designed interface sitting on top of a model hosted by someone else. Your agreement is with the interface. The model provider has its own terms, its own regions and its own retention window, and you may never have read them.

What data residency actually means, and what it does not

Residency is a statement about where bytes are stored at rest. It is not a statement about who can reach them. A dataset can sit in a Sydney data centre and still be accessible to an engineer in another country holding valid credentials, and still be subject to a foreign production order if the parent company is incorporated overseas. Storage location and legal control are separate axes, and vendors routinely answer the first when you asked the second.

Under the Australian Privacy Principles, sending personal information to an overseas recipient is a disclosure, and APP 8 makes you responsible for reasonable steps to ensure that recipient handles it consistently with the APPs. That obligation does not disappear because a subcontractor made the actual transfer. If your practice management system calls a US model provider, your firm is the one that disclosed.

Then there is the professional obligation, which sits above the privacy one and is stricter. The duty of confidentiality in the solicitors' conduct rules is not a data protection standard with a reasonableness carve out. It is a duty to the client, and it is not satisfied by pointing at a vendor's compliance page.

Rank your matters before you rank your tools

Not all matter text carries the same risk, and treating it as though it does produces a policy nobody follows. A blanket ban on AI tools is broken within a fortnight by someone under deadline pressure with a laptop and a personal account. That is worse than a graded rule, because now you have no visibility at all.

The workable approach is to sort your work by what an unwanted disclosure would actually cost the client, then match the tier to the tool. Most firms find the top tier is smaller than they feared, which frees up the rest for sensible use.

The questions that get a straight answer

Vendor security pages are written to survive procurement, not to answer a solicitor. The way through is to ask questions that cannot be satisfied with an adjective. Put them in writing, ask for the answers in writing, and keep the reply on file. If a supplier will not commit in writing to something they say on a call, that is your answer.

Pay attention to what happens when you cancel. Deletion on termination is frequently promised for the application database and silently excluded for backups, which may roll for months. A firm that closes an account believing its matter text is gone, when a restorable copy persists offshore, has a problem it does not know about.

The de-identification trap

The common workaround is to strip the names and proceed. It is a reasonable instinct and it works for a lot of routine work, but it fails in a specific and predictable way: legal facts are identifying even without names. A dispute over a particular development site in a particular council area, with a particular date and a particular sum, identifies the parties to anyone who follows that sector, and often to anyone who reads the local paper.

The test is not whether you removed the proper nouns. It is whether an informed reader in that industry could work out who this is. For most commercial and property matters the answer is yes, from three or four facts, well before you have said anything you would recognise as a name.

There is also a workflow problem. De-identification only holds if it happens every time under time pressure, and it does not. The paste that goes wrong is the one at 6pm on a Friday before a Monday hearing. Any policy that depends on manual redaction discipline should be treated as a policy that will be breached, and designed around accordingly.

A position you can put in an engagement letter

The end point of this is not a ban and not a shrug. It is a written position your firm can state to a client without hedging: these categories of work never leave Australian infrastructure, these categories may be processed by named suppliers under contractual retention limits, and here is the list of those suppliers. A client who asks is entitled to that answer, and increasingly they will ask, particularly government and institutional clients who have their own residency obligations flowing down to you.

Practically, that means picking tools where residency is a documented architectural fact rather than a support ticket answer, keeping the subprocessor list current because it changes without fanfare, and reviewing the position when a vendor changes model providers, which they do. It also means logging which tool was used on which matter, so that if a question arises two years later you can answer it from records rather than memory.

Legal Brain runs on Australian infrastructure for exactly this reason, and publishes where matter text sits and how long it is kept, but the point holds whichever tool you choose: if you cannot describe the path your client's text takes, in writing, you are not in a position to give the assurance your conduct rules already require of you.

Frequently asked questions

Does putting client information into an AI tool breach legal professional privilege?

Privilege attaches to confidential communications made for the dominant purpose of legal advice or litigation, so the risk is loss of the confidentiality that underpins it rather than an automatic breach. Disclosure to a supplier who processes material under confidentiality obligations, purely to assist you in giving advice, is generally treated differently from disclosure to the world. The exposure grows where the supplier retains the content, where staff can read it, and where a foreign authority could compel production. Document the arrangement so you can describe it if it is ever challenged.

Is it enough that my AI vendor stores data in Sydney?

No. Storage at rest in Australia is one control among several. Ask separately about where processing happens, where backups and failover copies go, which countries support staff access from, and which corporate entity holds the data, because that entity's jurisdiction determines who can lawfully compel it. A Sydney region operated by an overseas parent still sits inside that parent's legal system.

What do the Australian Privacy Principles require before sending client data overseas?

APP 8 requires you to take reasonable steps to ensure an overseas recipient does not breach the APPs, and under section 16C of the Privacy Act you can remain accountable for their acts. In practice that means contractual commitments about handling, retention and onward disclosure, plus a record of the assessment you made. Note that your professional duty of confidentiality is separate and stricter, and satisfying APP 8 does not discharge it.

Can I just remove the names before pasting a matter into an AI tool?

It helps but it is not sufficient on its own. Dates, amounts, locations, industry detail and procedural history frequently identify the parties to anyone familiar with the sector, even with every proper noun removed. Ask whether an informed reader could work out who this is, and treat manual redaction as something that will eventually be skipped under deadline pressure.