Client data, confidentiality and professional responsibility
You have questions about how TwinCounsel handles client data. Good. That diligence is part of choosing technology for a law practice. This guide explains TwinCounsel’s contractual safeguards and the professional questions you should consider alongside them.
Adapted for this preview from the March 2026 Professional Responsibility Guide, with corrections against the July 14, 2026 Terms. Reviewed October 12, 2026. The signed Tavus zero-retention addendum is an express assumption of this preview.
Am I sharing confidential information with a third party?
Yes. Using a technology provider involves processing information outside your own devices, as with email, document storage or practice-management software. That does not remove your duties of competence, confidentiality, communication and supervision. Assess the information involved, the safeguards, the client’s instructions and the rules that apply to the representation.
TwinCounsel’s contractual commitments support that assessment. They do not replace your professional judgment or guarantee how a court will decide privilege.
What the authorities say
ABA Formal Opinion 512 (July 29, 2024). Existing professional duties apply to generative AI. Lawyers must understand a tool’s limitations, review its work and assess disclosure risk. The opinion’s concern about self-learning tools includes the possibility that information may reach another user, even within a firm. No model training is an important safeguard, but not a universal exemption from disclosure or informed consent. When informed consent is required, generic engagement-letter language alone is insufficient. Read Opinion 512, particularly pp. 6–9.
ABA Formal Opinion 477R (2017). Lawyers should make reasonable efforts to protect electronic communications, considering the sensitivity of the information and the risks of disclosure. Some circumstances call for additional safeguards. Read the ABA’s Opinion 477R resource.
United States v. Heppner, No. 25-cr-503 (JSR), ECF No. 27 (S.D.N.Y. Feb. 17, 2026). The court rejected privilege and work-product protection for the defendant’s exchanges with a consumer AI tool, made on his own initiative. The decision examined confidentiality and the lack of counsel-directed use. It did not hold that enterprise AI automatically preserves privilege, and it did not evaluate TwinCounsel. Contractual confidentiality is one relevant safeguard, not a promise of a particular legal outcome. Read the court’s memorandum.
State and local guidance. Review the rules where you practice and any applicable court orders. California’s AI ethics resources, Florida Opinion 24-1 and New York City Bar Opinion 2024-5 address competence, confidentiality, supervision and communication. Guidance can change; the applicable jurisdiction’s current requirements control.
How TwinCounsel is built
Separate matters and authorized firm knowledge
Each matter is processed in an isolated Matter Sandbox. Client communications, documents and matter data do not flow into another matter’s processing, except where you group matters into a Client Engagement and authorize sharing as defined in the Terms.
Separately, the Firm Knowledge Layer holds attorney-authorized templates, drafting preferences, tone, playbooks and reference materials designated for firm-wide use. It improves only through explicit corrections and approvals. It never transfers client communications or matter data between Matter Sandboxes, is never shared across TwinCounsel customers and never trains an AI model. Terms §§6.2, 8.2.
No model training; zero retention at AI providers
User Content is never used to train, fine-tune, evaluate or improve AI models. Upstream AI providers have executed zero-data-retention agreements. The preview includes Tavus under the signed Growth-plan addendum; Daily transports audio and video without storing media, with recording off. Terms §§3.3, 8.1 and provider details.
TwinCounsel retains practice materials to provide the Service under its own retention and export rules. Provider zero retention is distinct from deleting your Second Brain. Terms §§7.3–7.4.
Playbooks you can inspect
Your twin learns from what you correct and approve, and writes that guidance into human-readable playbooks backed by SKILL files. You, your ethics counsel or a bar reviewer can read those instructions. They help explain configured behavior; they do not make every output correct or replace source verification. You can export your playbooks and keep using the exported files after leaving the Service. Terms §§7.2, 8.2–8.3.
Draft only; attorney approval
A hard technical constraint prevents sending email, filing documents or contacting third parties without explicit confirmation by an Authorized User. Approval may be given through the authenticated channels defined in the Terms. Connections are read-only by default, with write access only where you authorize it. You remain responsible for checking facts, citations, dates, figures, applicable rules and the final action. Terms §§2.4, 5.1 and Trust & Safety.
An inspectable history
Operational records identify the playbooks applied, processing steps and outputs. Audit metadata does not reproduce the underlying client communications or documents. Approval of a draft and approval of a future change to a playbook are distinct decisions. Terms §§7.3, 8.2, 10.2.
Infrastructure at a glance
| Safeguard | Commitment and source |
|---|---|
| Encryption | AES-256 at rest; TLS 1.2+ in transit. Terms §11.1. |
| Data isolation | Per-matter execution, with the authorized Client Engagement exception. Terms §8.2. |
| Access | Authorized users and visibility rules; read-only by default. Terms §2.4 and Trust & Safety. |
| AI providers | Zero retention; no model training. Terms §§3.3, 8.1. |
| Residency | User Content processed and stored in the United States. Terms §13.3. |
| Employee access | No routine human access. Scoped prior written consent or legal requirement; logging and notice within 2 business days. Terms §10.2. |
| Export and deletion | Export available at any time; a 90-day raw-content export window after matter closure, with notice before deletion. Terms §7.4. Trust & Safety separately states deletion on request within 30 days. |
| Security program | Least privilege, personnel MFA, logging, annual third-party penetration testing and incident response. Terms §§11.1–11.2. |
| Certifications | SOC 2 Type II and ISO 27001 in progress, not held certifications. See Trust & Safety. |
No blanket GDPR/CCPA compliance claim is made in this guide. A Data Processing Agreement is available as described in Terms §13.4.
Do I need to tell my clients?
Assess disclosure and consent separately for the planned use. Relevant factors include applicable professional rules, confidentiality risks, client instructions, engagement terms, the significance of AI to the representation and court requirements. Do not assume a no-training agreement answers every communication or consent question.
If informed consent is required, explain the use, benefits and material risks in a way the client can understand. A general AI clause does not, by itself, satisfy that process. The preview’s engagement-letter section is a placeholder, not approved language for use with clients.
What happens if data is subpoenaed?
TwinCounsel commits to advance notice where legally permitted, limited production of what is legally required and reasonable cooperation with your assertion of privilege and work-product protection. Matter isolation limits the content held in each container; it does not prevent lawful process or let TwinCounsel decide the scope of a court order. Terms §10.3.
Is this the same as a consumer AI account?
Evaluate the actual provider, contract, settings and use rather than the product category alone. TwinCounsel’s stated safeguards include confidentiality obligations, separate matters, approved playbook changes and zero retention with upstream AI providers. These safeguards support your diligence; none guarantees privilege or removes the need to verify outputs.
What should I keep on file?
Keep the Terms and provider list in effect for your use, your security and consent assessment, relevant client instructions, approved playbooks and appropriate operational history. Revisit that assessment when tools, terms, settings or rules change. This guide is part of that record, not a complete substitute for it.
Authorities and related documents
- ABA Model Rule 1.1: competence and Rule 1.6: confidentiality.
- ABA Opinions 477R and 512, and the state guidance linked above.
- TwinCounsel Terms of Service, Trust & Safety and Subprocessor List.
This guide provides information about TwinCounsel’s safeguards and professional-responsibility considerations. It is not legal advice; apply your jurisdiction’s rules to your own practice and representation.