AI for Lawyers and Confidentiality: On-Device Document AI for Law Firms

Can you use AI on privileged documents without sending them to the cloud?

Yes. If the AI processes documents locally on your own device, the privileged material never has to leave your machine. This is the core of AI for lawyers confidentiality: the analysis runs on your computer instead of on a vendor's servers. Apioni is an on-device document AI desktop app built on exactly this principle. Document content is processed only by a local engine on your machine (localhost), and the single outbound connection it makes is a launch-time version check to apioni.com that carries no document content and no usage telemetry. For lawyers evaluating document AI for law firms, this changes the confidentiality question from "do I trust the vendor's security?" to "can I verify the data never left?"

The confidentiality problem with cloud AI

A lawyer's duty of confidentiality is broad. Under ABA Model Rule 1.6, an attorney must not reveal information relating to the representation of a client without informed consent, and must make reasonable efforts to prevent unauthorized disclosure. ABA Formal Opinion 512 (2024) applies this directly to generative AI, addressing competence, confidentiality, informed client consent, supervision, and fees when lawyers use these tools.

The practical collision is simple. When you paste a client's contract or a privileged case file into ChatGPT or a similar consumer service, the document content travels to a third-party server you do not control. You are relying on that vendor's policies, retention settings, and access controls to protect material you are professionally bound to keep confidential. For many matters, that transfer is the exact event a lawyer needs to avoid, or at minimum disclose and obtain consent for.

Why a signed DPA and enterprise security do not fully resolve the duty

The common answer is to sign a data processing agreement, enable an enterprise tier, and rely on encryption. These steps matter, but they manage risk by contract rather than removing it. Several issues remain:

• A third-party data flow still exists. The document content leaves your office and lands on infrastructure operated by others. Encryption in transit and at rest reduces exposure, but it does not eliminate the fact that a copy now sits outside your control.
• A subprocessor chain you must supervise. Cloud vendors rely on hosting providers, model providers, and other subprocessors. Your supervisory duty extends to that chain, and you are trusting each link.
• Breach and subpoena surface. Data held by a third party can be reached by a breach of that party, or by legal process directed at them. That is an additional surface that would not exist if the content never left your machine.

What on-device actually means

On-device means the AI model runs on your own computer rather than on a remote server, so the documents it reads stay on local storage and memory. Apioni runs an on-device large language model (Ollama with a Qwen3-family model) and a local embedding model (bge-m3) directly on your machine.

Here is the precise network behavior, because the precision is the point:

• All document processing goes only to the local engine on your machine, addressed as localhost.
• Your document content never leaves your computer.
• The one connection Apioni makes to the internet is a version check to apioni.com at launch. It only checks whether a newer version exists. It carries no document content, and there is no usage telemetry.

This is close to air-gapped operation for the document data itself. An air-gapped network is one with no connection to outside networks at all. Apioni is not strictly air-gapped because of the version check, but the privileged content path is local-only, and you can confirm that the only outbound call carries no document content.

How a lawyer verifies the claim

Vendor due diligence usually means reading a security whitepaper and trusting it. On-device processing lets you replace trust with observation. Apioni's network behavior is independently verifiable in two ways:

1. In-app network self-check. The app includes a self-check that shows its network activity, so you can confirm document content stays local.
2. Standard OS tools such as lsof. On macOS, lsof lists open files and network connections for a process. You can watch which connections the app actually opens while you run a document through it, and confirm that the only outbound connection is the version check to apioni.com.

For a law firm, this turns vendor diligence into an observable fact rather than a paperwork exercise. You are not asking whether the data stays local; you are watching that it does.

Use case: reviewing case files and discovery sets locally

Point Apioni at a folder of case files or a discovery set. It indexes the documents locally, then answers questions and surfaces relevant passages while citing the source passages it used. Because indexing and retrieval happen on your machine, a large set of sensitive files can be reviewed without any of it being uploaded. The citations let you jump back to the underlying document rather than taking a generated summary at face value.

Use case: contract review without uploading the agreement

For local AI contract review without the cloud, you can ask Apioni to summarize key terms, locate specific clauses, and surface obligations or unusual provisions across one agreement or a folder of them. The agreement is never uploaded anywhere. Retrieval uses a hybrid of keyword search (BM25) and semantic search, fused with reciprocal rank fusion (RRF), so a search for a concept like "indemnification" finds both the exact term and clauses that express the idea in other words.

Hybrid search combines literal keyword matching with meaning-based semantic matching, so results are accurate both when you know the exact wording and when you only know the concept.

Use case: drafting and summarizing with citations

Apioni can draft and summarize based on your own documents while citing back to the source passages it relied on. For attorney-client privilege concerns in AI document review, the value is twofold: the source material stays local, and every output points back to where it came from, so you can check the work against the actual text rather than trusting an unsourced paragraph.

Cloud legal AI vs on-device Apioni

Fit and limits

This tool is for people who handle confidential documents they cannot upload to the cloud: lawyers, accountants and tax professionals, finance, public sector, healthcare and research, and corporate security teams.

On-device processing changes where the data goes. It does not, by itself, discharge your other professional duties:

• Competence. You remain responsible for understanding the tool's capabilities and limits, and for reviewing its output. Treat AI output as a draft to verify against the source, never as a final answer.
• Supervision. Firms still need policies governing how and when staff use any AI tool.
• Client consent and judgment. On-device processing strengthens your confidentiality position, but whether to use AI on a given matter, and whether to disclose it, remains a professional judgment under Rule 1.6 and applicable guidance.

Frequently asked questions

Is ChatGPT confidential enough for privileged legal documents?

When you paste a privileged document into a consumer cloud service, the content is transmitted to a third-party server outside your control, which is the disclosure event a lawyer's duty of confidentiality is meant to prevent. Enterprise tiers and DPAs reduce exposure but still involve sending the content off your machine. An on-device tool avoids the transfer entirely by processing the document locally.

Does on-device AI satisfy my duty of confidentiality under Rule 1.6?

On-device processing directly addresses the unauthorized-disclosure concern by keeping document content on your own computer, which removes the third-party data flow that cloud tools create. It is a strong technical foundation, but Rule 1.6 and ABA Formal Opinion 512 also involve informed consent, competence, and supervision. Those remain your responsibility regardless of where the processing happens.

Can I verify that no document content leaves my computer?

Yes. Apioni includes an in-app network self-check, and you can also use standard operating-system tools such as lsof to observe the app's network connections while you work. This lets you confirm that document content stays local and that the only outbound connection is the version check to apioni.com, which carries no document content.

Does it work offline, and what is the licensing model for a firm?

Apioni works without an internet connection, so you can run it on an offline machine for sensitive work. It is a one-time purchase of KRW 39,000 with a company-wide license and no device limit, and there is a 14-day free trial that requires no card or payment details. You can start the free trial or buy the company-wide license.

Try it on your own files

The fastest way to evaluate on-device legal AI is to run it on your own documents and watch the network behavior yourself. Start the 14-day free trial, no card required, or buy the company-wide license at apioni.com.