"Private Model" Is Not the Same as Private Data

By Michael Nadalin, Founder, Market Lead · 21 September 2026 · 8 min read

A partner asks the question in a vendor demo: "Is our client data safe?" The sales engineer answers: "Absolutely, we use a private model. Your data is never used for training." Everyone nods. The procurement form gets ticked. Nobody asks the follow up, which is where the actual confidentiality risk lives.

"We use a private model" is a statement about one thing: whether your inputs are fed back into a vendor's training corpus. That is a real concern and it is worth confirming. But it says nothing about where the data physically sits, who at the vendor can read it, how long it is retained, whether it passes through a logging layer, which subprocessors touch it, or what happens when a foreign government serves the hosting provider with a production order.

Your obligations under the conduct rules do not turn on a vendor's marketing language. If a client's affairs end up somewhere they should not be, the answer "the vendor told us the model was private" is unlikely to impress a regulator or an opposing party. What follows is the set of questions that actually separate a confidential system from one that merely sounds like one.

What "private model" actually means, and what it does not

In vendor usage, "private model" usually means one of three quite different things. It might mean the vendor has a contractual no training commitment with a major model provider, so your prompts are sent to that provider but excluded from training runs. It might mean the vendor runs an open weights model on infrastructure it rents. Or it might mean the vendor hosts a model instance inside a cloud tenancy it controls. These have very different risk profiles and all three get described with the same two words.

None of the three tells you anything about the rest of the pipeline. Your document still has to travel from your desktop to a server, get parsed, get chunked, get embedded, get stored in a vector index, and have its text placed into a prompt with retrieved passages. Every one of those steps involves storage and most involve logging. The model is one component in a system, and it is rarely the component that leaks.

Ask the direct version: "Set the model aside. Trace one document from my upload to my answer, and tell me every system it is written to and every person who can read it." A vendor with a clean architecture will answer in about ninety seconds. A vendor that cannot answer has not thought about it.

The parts of the pipeline nobody demos

Most of the confidentiality exposure in a legal AI product sits in infrastructure that never appears in a sales demo. Application logs routinely capture request bodies for debugging, which means the full text of a prompt, which means the paragraph of the affidavit you pasted in. Error monitoring tools do the same thing and forward it to a third party service. Support tooling often gives staff the ability to view a user's session to reproduce a bug.

Retrieval systems create a second copy problem. When a platform indexes your matter documents so it can search them, it creates embeddings and usually keeps the source text alongside them so it can quote back accurately. That index is a searchable copy of your client files sitting in a database, and the question of who can query that database is a different question from who can query the model.

Then there is the human review loop. Many products route a sample of low confidence outputs to a human for quality review. That is a defensible engineering practice and a serious confidentiality problem if nobody told you it happens. Ask explicitly: does any human at your organisation or any contractor ever read the content of my queries or documents, and under what circumstances.

Where the data physically sits, and why it matters here

Data residency is not a box ticking exercise for Australian practices. If client material is processed or stored in the United States, it is within reach of US legal process directed at the hosting provider, and that process can come with a non disclosure obligation meaning the provider cannot tell you it happened. You may hold privilege over a document that has been produced to a foreign authority without your knowledge. That is a poor position to be in if it later surfaces in litigation.

The Australian Privacy Principles impose obligations on cross border disclosure, and APP 8 broadly leaves you accountable for what an overseas recipient does with personal information you disclose to them. Many firms sit under the small business exemption, though that exemption is narrower than people assume and the reform direction has been to narrow it further. Relying on an exemption is a weaker position than simply keeping the data onshore.

Ask for the region in writing. Not "we use AWS", which says nothing, but "primary processing and storage in ap southeast 2, with no replication outside Australia". Then ask where backups go, because backups are the step where onshore claims most often quietly fail.

Retention is the question that gets skipped

"We do not train on your data" and "we do not keep your data" are entirely different promises, and vendors often make the first while quietly doing the opposite of the second. Zero retention means the prompt and the response are discarded once the response is delivered. Anything else means there is a copy, and a copy has a location, an access control list, a retention period and a deletion process that either works or does not.

Thirty day retention is common because model providers use it for abuse monitoring. It is not unreasonable, but you should know it exists, because it means that for thirty days there is a readable copy of every matter detail your team has typed into the tool, sitting with a third party, subject to that party's jurisdiction and internal access controls.

Deletion deserves its own question. When a matter closes and you delete it, what actually happens. Is it a soft delete flag in a database that leaves the row intact. Does the vector index get rebuilt or does the embedding persist. Do backups get purged or do they age out over ninety days. Ask for the deletion SLA and ask whether the vendor will certify completion in writing.

The questions to put in writing before you sign

Verbal assurances in a demo are worth very little. What matters is what appears in the contract, the data processing agreement and the subprocessor list, because those are the documents you will be pointing to if something goes wrong. If a vendor will make a claim on a call but will not put it in the agreement, treat the claim as withdrawn.

A sensible structure is to run the assessment in three passes: the written questions before the trial, a technical verification during the trial, and a contractual lock in before rollout. Most firms do the first pass and skip the second and third, which is how a tool ends up in production with confidentiality terms nobody has read.

Also settle the supervision question internally. Which matters may go into the tool, which may not, whether client consent is required for particular engagements, and what the file note looks like when AI has been used in preparing advice. The technology assessment does not replace that policy work, it just tells you what the policy can safely permit.

What a straight answer sounds like

A vendor that has done the work will answer these questions quickly and specifically, and will volunteer the uncomfortable parts. They will name the model, name the region, tell you the log retention period even though it is not zero, tell you exactly when a human might see content and what consent gate sits in front of it, and give you the subprocessor list without being chased. Specificity is the signal. Reassurance is not.

The inverse is equally telling. Deflection to certifications, "military grade encryption", refusal to name subprocessors, or an inability to describe what happens to a deleted document all point the same direction. So does a demo where the confidentiality answer is one sentence long. The systems are complicated, so an honest answer has structure to it.

At Legal Brain we publish our architecture and retention position because we would rather be assessed on the specifics than on adjectives. Whatever tool you end up with, ask it the five questions above and keep the answers on file. When someone eventually asks how you satisfied yourself that client confidentiality was maintained, a dated email from the vendor answering a precise question is a far better record than a recollection of what the salesperson said.

Frequently asked questions

Does using AI breach my duty of confidentiality to clients?

Disclosing confidential information to a third party service provider is not automatically a breach, in the same way that using external IT support or a cloud document management system is not. What matters is whether you have taken reasonable steps to satisfy yourself the information is protected, and whether the arrangement is consistent with your retainer and your obligations. The risk arises from using a tool without assessing it, not from using AI as such.

What is the difference between a private model and zero data retention?

A private model means your data is not used to train the vendor's model. Zero data retention means no copy of your prompt or document is stored after the response is returned. They are independent commitments and a vendor can offer the first without the second. Ask for both, in writing, and ask separately about logs, which are often excluded from retention claims.

Does my client data need to be stored in Australia?

There is no blanket rule requiring it, but onshore storage substantially simplifies your position. Offshore data is exposed to foreign legal process that may compel production without notice to you, and cross border disclosure of personal information engages obligations under the Australian Privacy Principles. Some government and institutional clients will also require onshore storage as a contractual term.

Should I tell clients that I use AI tools on their matter?

That depends on the nature of the engagement, the sensitivity of the material and the terms of your costs agreement. Many firms now include a general clause covering technology assisted work, and seek specific consent for particularly sensitive matters. Courts in several Australian jurisdictions have issued practice notes and directions about the use of generative AI in preparing material, so check the requirements of the relevant court as well.