Can you put client files into Claude or ChatGPT?

Verdicts, plan by plan

In British Columbia, the conditional verdicts for Team, Business and the standard Enterprise terms carry a further condition: a written agreement that meets Law Society Rule 10-3(4). Without one, these plans are not for records within that rule. Such an agreement in practice means a negotiated one, which Team and Business, sold on the published terms, do not offer; on those plans a British Columbia lawyer is limited to work that carries no client information or has been genuinely de-identified. In Saskatchewan, read literally, no plan meets the Law Society guidance's request that the provider neither share what is put in with third parties nor use it for its own purposes in any manner; a lawyer who uses these plans for client material departs from that request, must still be satisfied that the plan, as the firm has set it up, does not lack adequate confidentiality and security protections, and should seek the client's informed consent, with candour about the potential reuse of what is shared and the potential loss of privilege. In Alberta, the Law Society's playbook tells lawyers to keep confidential and potentially identifying information out of prompts to publicly available tools, which these plans are; an Alberta lawyer who uses them for client material departs from that stated best practice, and should do so, if at all, knowingly, with the client's informed consent and only for what the matter needs. Each province is taken up below.

Claude Code takes the verdict of the Claude account it is signed into, and Codex that of the ChatGPT account. ChatGPT Edu is sold to universities; a lawyer meets it through a law-school clinic, where the university is the customer and the data terms are a Student Data Privacy Agreement rather than the business Data Processing Addendum.²

Two risks, and only one punished so far in the Canadian decisions we found

The first risk is confidentiality: where the file goes, who can read it, who can be made to produce it, how long it lives and whether it trains anything. The second is accuracy: a tool that invents authority, or attaches invented words to real authority, and a lawyer who files what it produced. They call for different defences, and in the Canadian decisions on AI tools we found, only the second has yet cost a lawyer anything.

The decisions on the second risk are collected on WarmLoop's home page. Three points from them bear on this article. The Law Society of Ontario's tribunal has said that using AI is not the wrong: "it is not professional misconduct for a lawyer to use AI to assist in the preparation of a factum", and the failure in the case before it lay in not verifying the authorities the tool generated.³ Delegating does not dilute the duty: the Alberta Court of Appeal held that a lawyer whose factum was drafted by a contractor using a large language model was not absolved "of the need to adequately review work prepared by someone else prior to filing it with the Court", and ordered costs against him personally.⁴ And confirming that a case exists is no longer enough: in an Ontario matter the cases cited were real and the quotations attributed to them were fake (counsel denied using AI).⁵ Saskatchewan's Court of King's Bench now requires meaningful human oversight, so that citations correspond to real authorities, quoted passages are accurate and AI summaries reflect their sources, and says that for lawyers "blind or uncritical reliance on AI is inconsistent with professional competence".⁶

The first risk has not yet produced a Canadian decision about an AI tool, and the nearest decision about a third party's computer system, discussed below, went against the party claiming privilege. That does not make the risk small. The first case will be decided on facts someone is creating now, and the vendor's terms will be exhibits in it.

What Canadian law requires

Privilege belongs to the client

Solicitor-client privilege arises from a communication between lawyer and client that seeks or gives legal advice and that, in the Supreme Court's words, "the parties intend to be confidential".⁷ It "belongs to the client and can be waived only by the client with informed consent", and the Supreme Court has repeated that it must remain "as close to absolute as possible to ensure public confidence and retain relevance".⁸ Two consequences follow. In principle a lawyer cannot waive a client's privilege by choosing a tool, because the waiver is not the lawyer's to give. That is subject to implied waiver: the New Brunswick Court of Appeal has explained that the statements that only the client can waive come from cases about a lawyer testifying, and do not rule out an implied waiver, including one arising from an inadvertent disclosure by the client's own lawyer.⁹ And an opponent will usually attack the third element instead. The argument will not be that you waived the client's privilege; it will be that a communication you placed where a third party was entitled to read and use it was never, or is no longer, confidential.

Does sending it to a vendor waive it?

The party alleging waiver must prove it, and implied waiver is judged on objective conduct rather than on the intention of the person who disclosed, according to the Saskatchewan Court of Appeal.¹⁰ But the party claiming privilege must first show that the privilege exists, confidentiality included: "A claim of privilege is not established merely by asserting it."¹¹ The Canadian decisions closest to AI tools are the cases about email held on someone else's system, and they point both ways. An Ontario judge held that privilege is not waived "simply because a person’s communication was made using an electronic device which is accessible by a third party", in a passage that names the cloud, server providers and internet providers.¹² Another Ontario judge found an objectively reasonable expectation of confidentiality where no one in the company could read the plaintiff's email without his consent and the only other person with access to the account was a third-party IT provider.¹³ But in 2024 an Ontario court held that a businessman who knowingly used a third party's email system for his companies' dealings, including with counsel, had not shown that those emails were confidential. They were stored where the system's owner could read them, there was no evidence that it had agreed to keep them confidential from itself, and the claimant had to show they were made "in circumstances where they were intended to be kept in confidence and not shared with a third party whose presence was not essential or of assistance to the consultation". Had privilege been established, the court would have found it waived, both by his use of that system and by his sharing the emails with the system owner's most senior officer.¹⁴ And the Federal Court held that privileged documents knowingly disclosed in confidence to an auditor, for the limited purpose of an audit, keep their protection against everyone else, adding that "the intention of the privilege holder is key". It grounded that doctrine in the public interest in companies being properly audited, and it refused it on the facts, because the client could not show it had disclosed knowingly and for that purpose. Carrying it over to an AI vendor is an analogy, not a holding.¹⁵

The Saskatchewan Court of Appeal's test for third parties points the same way. Privilege extends to third-party communications "in furtherance of a function essential to the existence or operation of the solicitor-client relationship", such as those of a channel of communication, a messenger or a transcriber.¹⁶ A vendor bound to process your content only to serve you, under confidentiality, looks much more like a channel than a stranger.

The same cases supply the argument against you. The workplace-email judge said that a policy, or the employees' knowledge, that the employer could or would read their messages "might have been some evidence" that they did not intend them to be privileged.¹⁷ A lawyer who has read terms reserving a vendor's right to review or use content stands closer to that line than any employee in those cases did, and closer to the businessman in the 2024 decision. And the Court of Appeal's list excludes a communication to an accountant "who must consider it and provide his or her own accounting opinion";¹⁸ an opponent will say that a model that analyses the file and writes its own answer is that kind of third party. The opponent will add a British Columbia decision holding that deliberately giving a lawyer's letter to one of the client's own consultants waived the privilege in it, because a consultant "hired to provide expert assistance" was neither the client's agent nor a conduit,¹⁹ and a Saskatchewan court's statement, made about a clinic's records, that "Disclosure of privileged information to third parties will constitute waiver of that privilege."²⁰ The better reply is that a vendor bound to process your content only to serve you, under confidentiality, is a channel for the lawyer's own work rather than a consultant contributing its own, and the British Columbia court itself recognised agents and conduits as exceptions. It is the better reply, not a safe one. A model does contribute something of its own to the answer, and no Canadian court has yet decided which side of that line it falls on.

Litigation privilege and the vendor's copy

Litigation privilege works differently. Confidentiality "is not an essential component" of it,²¹ and showing work product to someone who is not an adversary, to prepare the case, does not waive it against the other side.²² Two limits matter for AI tools. The privilege ends with the litigation and any closely related proceedings.²³ And the outsider's copy is not itself privileged: in the Ontario Court of Appeal's words, it was the recipient's "contractual undertaking to keep the report confidential, not litigation privilege," that kept it from the other side.²⁴ The outsider there was a lawyer consulted as a potential witness,²² and a vendor processing the lawyer's work product as the lawyer's agent is not obviously the same kind of outsider: litigation privilege "contemplates, as well, communications between a solicitor and third parties".²⁵ If a vendor is treated as that kind of outsider, Windsor suggests, without deciding it for AI tools, that work product on its servers may be protected by the vendor's contract rather than by the privilege while the case runs. Once the case ends, litigation privilege ends with it, and for work product that only it protected, the contract is all that is left; solicitor-client privilege in the same material, where there is any, does not end with the case.²³

When someone comes asking

Against Canadian state process, privileged material held by a service provider keeps its protection. The Newfoundland and Labrador Court of Appeal upheld the quashing of production orders for a lawyer's telephone records and messages held by telecommunications providers. It is "the nature of the communications and the solicitor-client relationship", not a physical place, that calls for protection, and notice must be given to the lawyer or the law society before a third party hands potentially privileged data to the police.²⁶ There are two cautions. The Federal Court of Appeal held that the law-office search guidelines did not govern documents the tax authority had obtained from third parties "without any indication that some could be privileged",²⁷ so material that does not say what it is may not be treated as privileged. And none of this binds a foreign court. A US vendor served with US process decides, within its contract and US law, whether and when to tell you. Whether a production of that kind would be treated in Canada as a waiver is a question no Canadian decision answers.

The professional codes

The technology rule is common ground. Saskatchewan's commentary to rule 3.1-2 says a lawyer "should understand the benefits and risks associated with relevant technology, recognizing the lawyer’s duty to protect confidential information".²⁸ The Federation of Law Societies' Model Code carries the same words, and Ontario and Alberta have adopted them; check your own province's code, because the numbering and commentary can differ.²⁹ Newfoundland and Labrador's law society puts it shortly: lawyers' "professional responsibilities do not change when using AI".³⁰

Confidentiality is the harder rule. Rule 3.3-1 requires a lawyer to "hold in strict confidence all information concerning the business and affairs of a client" and not to divulge it unless authorized, and its commentary says the duty is wider than privilege and applies "without regard to the nature or source of the information or the fact that others may share the knowledge".³¹ The implied authority to disclose reaches, "to the extent necessary", "others whose services are used by the lawyer". The commentary's express duty "to take reasonable care to prevent their disclosing or using" confidential information is stated for the lawyer's associates, employees, students and contract lawyers; for an outside provider the duty of care comes from the rules that follow.³² Rule 3.3-2 adds a separate prohibition on using or disclosing confidential information "for the benefit of the lawyer or a third person without the consent of the client", which a regulator could apply to a disclosure that lets a vendor build its products from what you send.³³ Rule 3.5-1's commentary asks for "all reasonable steps to ensure the privacy and safekeeping of a client’s confidential information".³⁴ None of these rules mentions artificial intelligence, cloud storage or encryption. In Saskatchewan the standard is client authority plus reasonable care, and a lawyer who is challenged will want evidence of both.

British Columbia is the strict benchmark. Its Law Society Rules define a storage provider as any entity storing or processing records outside the lawyer's office, and forbid keeping records with one unless the lawyer retains custody and control, the provider does not access or copy them "except as is necessary to provide the service obtained by the lawyer", the records are destroyed on instruction, and the arrangement is in a written agreement; a loss of control or improper access must be reported to the Law Society.³⁵ The Law Society of British Columbia's own AI guidance says those rules apply to AI products.³⁶ Saskatchewan has no equivalent binding rule, and we found none in the other provinces; there the same questions arise under the general duty of confidentiality. Whether the business plans meet the British Columbia rule is taken up under the case against these verdicts.

The law societies' AI guidance agrees on the risks and differs on how far it goes. Saskatchewan's tells a lawyer who intends to input confidential or privileged information to "ensure that the provider does not share inputted information with third parties, or utilize the information for its own use in any manner, including to train or improve its product", and says a lawyer "must not input any confidential and/or privileged client information to a generative AI tool that lacks adequate confidentiality and security protections".³⁷ Ontario's white paper warns that "Anonymizing is not perfect".³⁸ Alberta's playbook, whose stated focus is "publicly available AI tools", goes furthest: "Never include confidential or potentially identifying information in prompts", and a training opt-out does not change that.³⁹ No regulator names a vendor's plan. Alberta's older quick tips single out "free" products as unlikely to protect confidentiality,⁴⁰ but the playbook, updated since, does not confine its warning to free tools.

No Canadian regulator makes client consent a binding rule, and their wording differs. Saskatchewan and Manitoba say informed consent "should be sought" where anonymizing cannot protect confidentiality or privilege.⁴¹ Ontario's practice note says, in that situation, to "obtain your client's informed consent".⁴² Prince Edward Island says the lawyer "should obtain informed consent from the client before using the technology".⁴³ British Columbia says a lawyer "could explore whether client consent to use the tool with such information is viable".⁴⁴ The American Bar Association, for comparison, requires informed consent before client information goes into a tool that learns from its inputs, and says general boilerplate in an engagement letter "is not sufficient".⁴⁵ The Canadian Bar Association's counterweight belongs beside all of these: consent "is not a panacea".⁴⁶ This article recommends informed, specific consent in the retainer before privileged or confidential material goes into any AI tool. That is best practice, not a rule, and consent does not rescue a tool that should not be used.

Privacy statutes

PIPEDA governs the personal information a law firm handles in the course of commercial activity in Saskatchewan, Manitoba, Ontario, the Atlantic provinces and the territories. Alberta and British Columbia firms are under their own Personal Information Protection Acts for activity within the province.⁴⁷ Two qualifications keep that statement honest. The Federal Court has held that gathering evidence to defend an individual in a civil action was not commercial activity, the "attorney-client relationships" being "simply incidental", so PIPEDA does not necessarily reach every item in a litigation file.⁴⁸ And the Alberta and British Columbia exemption orders speak of activity "within the Province"; a transfer to a vendor in the United States may bring PIPEDA in as well. That second point is our reading of the orders, not a decided one.

Where PIPEDA applies, the firm remains responsible for information "transferred to a third party for processing" and must use "contractual or other means to provide a comparable level of protection".⁴⁹ A breach at the vendor can therefore become the firm's report to the Privacy Commissioner, where it creates a real risk of significant harm.⁵⁰ Alberta adds duties when a service provider outside Canada is used: notice to the individual whose information was collected with consent, and policies that say in which countries, and for what purposes, the provider handles it.⁵¹ The federal Commissioner's cross-border guidance makes the point that matters most for US vendors: "No contract can override the criminal, national security or any other laws of the country to which the information has been transferred."⁵² In May 2026 the federal Commissioner and the Quebec, British Columbia and Alberta regulators found complaints about ChatGPT well-founded. They found that OpenAI used users' chats to improve its models for an appropriate purpose, so that aspect of the complaints was not well-founded, but the federal, British Columbia and Alberta regulators found that OpenAI had not obtained valid consent to train its GPT-3.5 and GPT-4 models on those chats, and the Quebec regulator found the practice contrary to Quebec's private-sector privacy law. Their joint report also records, in the Quebec regulator's analysis under Quebec's rule that privacy settings be at their highest by default, that the setting collecting users' chats for training was enabled by default, so an assumption that the switch is off is an assumption you must act on.⁵³ Privacy compliance is the floor, not the answer. The Law Society of British Columbia's cloud guidance warns that a privacy checklist "may fall short of the requirements for protecting information that is governed by confidentiality and privilege".⁵⁴

Court rules on AI

Court directions deal with accuracy, not confidentiality. Saskatchewan's King's Bench directive, in force since January 1, 2026, requires AI-generated references to be "independently verified against authoritative sources" and requires no declaration of AI use.⁶ The Federal Court requires a declaration in the first paragraph of a document prepared for litigation that includes AI-generated content.⁵⁵ Manitoba's Court of King's Bench requires filed materials to "indicate how artificial intelligence was used".⁵⁶ One side effect deserves notice: a declaration tells the other side that the document passed through an AI tool, and so tells it where to look for a waiver argument. The only Canadian court text we found that speaks to uploads is the British Columbia Provincial Court's reminder that "some AI tools add the documents and information you upload to their databases".⁵⁷

The other side's documents

Documents and answers obtained on discovery carry an undertaking to the court: "…whatever is disclosed in the discovery room stays in the discovery room unless eventually revealed in the courtroom or disclosed by judicial order".⁵⁸ Saskatchewan codifies it. Information disclosed by affidavit of documents or in questioning "must be treated as confidential and may only be used by the recipient of the information or documents for the purpose of carrying on the action", unless the court orders, the parties agree or the law requires or permits otherwise.⁵⁹ In family proceedings the rule is stricter: any person with access to financial disclosure or discovery material must keep it "in confidence", and contrary use is contempt of court.⁶⁰ Because discovery is compelled for the action alone, the Supreme Court has said, the invasion of privacy "should generally be limited to the level of disclosure necessary to satisfy that purpose and that purpose alone".⁵⁸ A prothonotary of the Federal Court applied the undertaking to service providers in reasons for refusing a protective order: the parties and their lawyers may pass discovery material to "third party experts, consultants or service providers" only where "it is necessary for the conduct of the litigation", the undertaking binds any recipient "wherever that person may be", and counsel "can and must ensure" recipients know they are bound.⁶¹ Those reasons need care. The order was set aside on appeal on another question, the test for granting a protective order, and the Federal Court of Appeal has since recorded it as reversed. The appeal judge did not decide the points just quoted and did not contest the principle, but he said that the single case applying the undertaking to third-party experts and consultants was "an exceptionally tenuous basis" for setting aside a party's concerns about misuse of its discovery material by third parties. That is a reason to bind a vendor in writing rather than trust the undertaking to reach it.⁶¹ With a consumer click-through vendor that has agreed to nothing about your file, the disclosure is still permitted only where it is necessary for the conduct of the litigation, counsel cannot make sure the vendor knows it is bound, and enforcing the undertaking against a foreign vendor would be another matter: the prothonotary observed that the court "has no power to enforce the execution of its own judgments outside of its territory".⁶¹ Treat the other side's productions, and anything under a sealing order, publication ban or protective order, as material that goes into an AI tool only where necessary, to a vendor bound in writing, and after a check of the order's terms.

What the vendors' terms say

The verdicts rest on the contracts, so here is what each says, as of the date each document carries. Negotiated enterprise agreements and order forms are not public and were not read; where one governs your firm, it, not this summary, is the contract.

Claude Free, Pro and Max

Max is a consumer plan. Anthropic describes it as a plan "for individual consumers", and all three plans are governed by the Consumer Terms of Service (the version served in Canada is effective October 8, 2025) and the consumer Privacy Policy (effective September 10, 2026).⁶² The Consumer Terms let Anthropic use your "Materials" to "provide, maintain, and improve the Services and to develop other products and services, including training our models, unless you opt out of training". The opt-out is an opt-out of training; the rest of that sentence is not withdrawn by it. Even with the opt-out, Anthropic will train on material you give feedback on and on material "flagged for safety review".⁶³ There is no confidentiality clause in your favour, and Anthropic reserves the right, "at our sole discretion, to report information from or about you, including but not limited to Inputs or Outputs, to law enforcement".⁶⁴ The Canadian supplement to the Privacy Policy records your agreement that your data may be stored outside Canada, including in the United States, and disclosed there in response to legal process.⁶⁵

Retention is longer than the headline 30 days suggests. A deleted chat leaves the back end within 30 days; a chat you keep has no stated limit; a flagged chat's inputs and outputs are kept for up to two years and its safety scores for up to seven; feedback is kept for five years; and "In all cases, we may retain chats and coding sessions as required by law, to resolve disputes, or as necessary to combat violations of our Usage Policy."⁶⁶ By default Anthropic's staff cannot read your conversations, except when you send feedback or a Usage Policy review requires it.⁶⁷ Anthropic's own help page tells consumer users to be thoughtful about sharing "Confidential business or personal documents".⁶⁸ One more trap: an account opened with a firm email address may be linked to the firm's Anthropic organization, whose administrator may be able to see its content.⁶⁹

Claude Team and Enterprise

Team and Enterprise are governed by Anthropic's Commercial Terms of Service (effective June 17, 2025), with the Data Processing Addendum (effective February 24, 2025) incorporated automatically.⁷⁰ The contract says what the consumer terms do not: "Anthropic may not train models on Customer Content from Services", and "Customer Content is Customer’s Confidential Information." Feedback is the exception: if a user rates a response or reports a bug, Anthropic may use that chat to train its models.⁷¹ Anthropic may use that information only to perform the contract, may share it only with people bound to equivalent confidentiality, and must notify you of a compelled disclosure and cooperate in narrowing it, "except where expressly prohibited". Its duty to destroy your information on request excepts copies retained to comply with law and copies in automated backups, which stay confidential while kept.⁷² Under the Addendum Anthropic is your processor; it promises breach notice within 48 hours for a breach involving customer personal data, and deletion within 30 days of termination unless the law, a dispute or the need "to combat harmful use of the Services" requires otherwise.⁷³

The contract leaves three gaps for a Canadian firm. Data is stored in the United States, and traffic may be routed to other countries by default; the only residency control, on usage-based Enterprise plans, is US-only inference.⁷⁴ Team has no retention control: chats are kept until deleted, while custom retention, with a 30-day minimum, is an Enterprise feature, and on Enterprise the default is to keep data indefinitely. On both plans a flagged chat's inputs and outputs are kept for up to two years and its safety scores for up to seven, feedback is kept for five years, and chats may be kept longer where the law requires or to combat Usage Policy violations. Custom retention on Enterprise does not reach Claude Design, Claude Tag, Claude Managed Agents or features built on Claude Code on the web, and a project's retention overrides it for the chats inside the project.⁷⁵ And a small firm meets thresholds: Team requires at least two members, and self-serve Enterprise at least 20 seats.⁷⁶ Enterprise adds audit logs, a Compliance API, customer-managed encryption keys and, for Claude Code only and on Anthropic's approval, zero data retention.⁷⁷

Anthropic markets Claude to law firms with the line that "Claude clears the bar for sensitive matters and privileged work".⁷⁸ That is marketing, not a term. It speaks of Team and Enterprise, says nothing about Canadian privilege law, and sits beside a contract that makes it the customer's responsibility "to evaluate whether Outputs are appropriate for Customer’s use case".⁷⁹ Anthropic's regional compliance page also shows Canada as a place where regional data residency is available through cloud platforms; the platforms' own documentation, discussed under higher-assurance routes below, does not bear that out for current models.⁸⁰

ChatGPT Free, Go, Plus and Pro

All four are governed by OpenAI's Terms of Use (effective January 1, 2026), a contract with OpenAI OpCo, LLC; the Terms say the Privacy Policy is not part of them. Go is offered in Canada.⁸¹ The Terms let OpenAI use content to "provide, maintain, develop, and improve our Services", and the opt-out addresses training only.⁸² With "Improve the model for everyone" off, new conversations are not used for training; but after a thumbs-up or thumbs-down, "the entire conversation associated with that feedback may be used to train OpenAI models", and Codex has its own "Include environments" training setting that the ChatGPT switch does not change.⁸³ Chats are kept until you delete them, then scheduled for deletion within 30 days unless security or legal obligations require longer, and files in a project, a custom GPT or the Library survive deletion of the chat.⁸⁴ A Temporary Chat stays out of your history, memory and training, but it "may be retained for up to 30 days for safety purposes", and it changes nothing in the contract.⁸³ OpenAI uses automated tools and a trained team to review problematic content, and conversations showing a plan to harm others go to reviewers who may refer them to law enforcement.⁸⁵ The Privacy Policy, which is not part of the contract, permits disclosure to government authorities and others to comply with a legal obligation, and also to protect OpenAI's rights or property, where OpenAI determines "in our sole discretion" that its terms, its policies or the law have been violated, to detect fraud, to protect safety and to protect against legal liability. A promise of notice appears in OpenAI's government-request policy, not in the consumer contract.⁸⁶ Disputes go to mandatory arbitration, with a 30-day window to opt out.⁸⁷

These plans have already been tested by compelled retention. On May 13, 2025, a US magistrate judge in the New York Times copyright litigation directed OpenAI to preserve and segregate output log data that would otherwise be deleted.⁸⁸ OpenAI said the order reached ChatGPT Free, Plus, Pro and Team, but not Enterprise, Edu or zero-data-retention API use.⁸⁹ The going-forward obligation ended on September 26, 2025, but the order ending it kept in place the data already preserved, except data from the European Economic Area, Switzerland and the United Kingdom; Canada has no such carve-out. OpenAI said in October 2025 that the historical data "remains locked down, accessible only to a small, audited OpenAI legal and security team".⁹⁰ Separately, the court ordered a sample of 20 million de-identified consumer ChatGPT logs produced; OpenAI says the sample does not include Business (formerly Team), Enterprise or Edu conversations.⁹¹ On January 5, 2026 the district judge affirmed, contrasting wiretapped calls with "users' conversations with ChatGPT which users voluntarily disclosed to OpenAI and which OpenAI retains in the normal course of its business".⁹² That sentence is the one a Canadian opponent will quote.

ChatGPT Business and Enterprise

ChatGPT Team was renamed ChatGPT Business on August 29, 2025.⁹³ Business and Enterprise are governed by the OpenAI Services Agreement (effective January 1, 2026), with the Data Processing Addendum incorporated.⁹⁴ OpenAI will use customer content only as needed to provide the services, comply with law, enforce its policies and prevent abuse, and not to develop or improve its services unless you explicitly agree; "Confidential Information includes Customer Content"; and a disclosure required by law comes with reasonable efforts to notify you first, to the extent permitted.⁹⁵ The Addendum covers personal data only, so a privileged memo with no personal information in it relies on the confidentiality clause alone.⁹⁶

The tiers differ on who may read your content. For Business, OpenAI's access is limited to authorized employees for engineering support, abuse investigation and legal compliance, and to "specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse". For Enterprise, authorized employees access conversations only "for the purposes of resolving incidents, recovering end user conversations with your explicit permission, or where required by applicable law". On every business tier, OpenAI may run business data through "automated content classifiers and safety tools, including to better understand how our services are used", and says that the classifications "are metadata about the business data but do not contain any of the business data itself".⁹⁷ OpenAI's September 17, 2026 announcement of a legal product offers eligible firms ChatGPT Enterprise use that "is excluded from human review by default"; the announcement does not say how that differs from the access limits just quoted, and the offering is initially for selected firms in the United States.⁹⁸

On retention, OpenAI's own pages conflict for Business: its privacy page says workspace administrators can control retention, while its administrator guide describes a custom retention policy, with a 90-day minimum, as an Enterprise feature and says chats are otherwise kept until the user deletes them.⁹⁹ On location, Enterprise and Edu workspaces provisioned with data residency can store content at rest in Canada; inference residency is offered only in Europe, the United States and the United Arab Emirates, and apps, MCP servers, web search, beta features and Codex Web fall outside residency.¹⁰⁰ Business was named in OpenAI's own account of the 2025 preservation order; Enterprise was excluded.⁸⁹ Both tiers cap OpenAI's liability at the fees paid in the previous 12 months, and a breach of confidentiality is not carved out of the cap. It is carved out of the exclusion of indirect and consequential damages, so loss of that kind can be claimed up to the cap; Anthropic's Commercial Terms exclude consequential damages, including lost data, with no such carve-out.¹⁰¹

The six subscriptions side by side

Scroll the table sideways to see every column.

Anthropic's notice-of-demand policy and OpenAI's government-request policy promise notice to users except where the law or an emergency prevents it, but they are policies the vendor can change, not terms of the consumer contract.¹⁰²

What the American courts have said

No Canadian court has ruled,¹ but American trial courts have, and Canadian opponents will cite them. None binds a Canadian court, and American attorney-client privilege is not Canadian solicitor-client privilege.

United States v Heppner

The leading case is a February 17, 2026 memorandum of the US District Court for the Southern District of New York, giving reasons for a ruling made from the bench on February 10, 2026.¹⁰³ The facts matter. A criminal defendant, after a grand jury subpoena and "Without any suggestion from counsel", used Claude, a publicly available AI platform, to prepare reports on his defence strategy and, his lawyers said, later shared them with counsel. The court held they were not privileged. Claude is not a lawyer, and the communications were not confidential, "not merely because Heppner communicated with a third-party AI platform but also because the written privacy policy to which users of Claude consent" allowed Anthropic to use inputs and outputs to train Claude and to disclose them to third parties, including government authorities. The court relied on Anthropic's Privacy Policy as it stood on February 19, 2025, and on the January 5, 2026 New York Times order quoted above. It added that any privileged information Heppner put into Claude was waived "just as if he had shared it with any other third party", and that the documents were not work product, because they were not prepared at counsel's behest.

Read fairly, Heppner concerns a client acting alone on a consumer plan, and the court said as much: "Had counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer’s agent within the protection of the attorney-client privilege."¹⁰³ It did not consider a lawyer's own use, a business contract or an account with training off. But the two features of the consumer policy it relied on, use of content and disclosure to third parties including government, remain in Anthropic's consumer terms and in OpenAI's, whatever the training switch says.

The work-product decisions

Four other first-instance decisions, one issued the same day as the Heppner bench ruling and three after it, reached the other result on work product, the American counterpart of litigation privilege. A Michigan magistrate judge held that waiving work product requires disclosure "to an adversary or in a way likely to get in an adversary's hand", and that ChatGPT and similar programs "are tools, not persons".¹⁰⁴ A Colorado magistrate judge distinguished Heppner as a criminal case in which "there was a gap between the party and the attorney", held that the collection of user data by widely available AI systems does not "eliminate all expectations of privacy or automatically waive protections", and then amended the protective order: no confidential information may go into an AI platform "unless the AI provider is contractually prohibited from: (1) storing or using inputs to train or improve its model; and (2) disclosing inputs to any third party except where such disclosure is essential to facilitating delivery of the service", with a right to delete on request and written documentation of those terms. The judge accepted that this would, for now, bar "most, if not all, mainstream low-to-no-cost AI".¹⁰⁵ A New York court quashed a subpoena to OpenAI on the Colorado court's reasoning, and a Texas business court withheld most of a party's ChatGPT material as work product while ordering it to disclose which discovery materials it had shared with ChatGPT.¹⁰⁶ Each of the four concerned a party's own use of a tool. In the Michigan, Colorado and New York cases the party had no lawyer, and the Colorado judge distinguished Heppner partly on that ground: "No such gap exists in the pro se context."¹⁰⁵ None concerned a lawyer's use of a business-tier tool.

The Canadian parallel holds on one side only. Our litigation privilege, like American work product, is lost through disclosure inconsistent with secrecy against the adversary. Our solicitor-client privilege is the one Heppner put at risk, and the Ontario Court of Appeal has repeated, from an American decision it quoted, that "the mere showing of a voluntary disclosure to a third person will generally suffice to show waiver of the attorney-client privilege".²² That was said of American law in a litigation-privilege case, but it is the passage an opponent will lead with.

A yardstick borrowed from Colorado

The Colorado order gives a usable test, foreign as it is: a contractual prohibition on training and on onward disclosure beyond delivering the service, a contractual right to delete, and the terms kept in writing. No consumer plan meets it. The training switch is a setting you can change, not a promise the vendor made, and the consumer terms reserve other uses. The business plans come closer, but tested limb by limb on their published terms, none meets it beyond argument. Training on your content is excluded by contract on all four, with one gap on Anthropic's plans: Anthropic's Privacy Center says that a chat a user sends feedback on may be used to train its models, so on those plans that limb holds only while feedback is turned off, which is a setting, not a term.⁷¹ Onward disclosure is where they part, though not in their confidentiality clauses: Anthropic may share your content only with people who need to know it and are bound to equivalent confidentiality, and OpenAI's agreement sets the same limit. The difference is what OpenAI adds. ChatGPT Business lets third-party contractors review content for abuse, and OpenAI may keep "Abusive Customer Content" and, if the customer's access is suspended or the agreement is terminated by either party, share information about it "as reasonably necessary to protect the Services or any third party from harm". Neither is obviously disclosure "essential to facilitating delivery of the service". And the order asks for the ability to delete "all" confidential information on request, where every business contract keeps back some copies, whether in backups, for the law or against harmful use. A negotiated agreement could meet the test; the published terms leave it to argument.¹⁰⁷

The case against these verdicts

The best argument for Max, Plus and Pro

The strongest case for a paid consumer plan with training off runs like this. The content is not trained on; deleted chats leave the back end in about 30 days; Anthropic says its staff cannot read conversations by default; and the Canadian workplace-email cases protected employees' emails with their lawyers even where others had technical access, in one line of them treating an employer's "no guarantee" policy as showing at most a "diminished expectation of privacy but not an extinguishment of it".¹⁰⁸ No Canadian court has held that using an AI tool destroys privilege,¹ and Alberta's 2025 quick tips say, of keeping information confidential, "Typically, this means that you will have to pay for an AI product".⁴⁰

The answer is not that the employees in those cases did not know. In the earlier Ontario case the employee knew of the policy, refused to sign it and told his employer that it, or parts of it, did not apply to him, and in the later one the plaintiff, an information technology professional, agreed that his work account carried more risk.¹⁰⁹ What decided them was who else was entitled to read and use the messages: no one without the employee's consent, or at most a policy saying privacy was not guaranteed. Where a person knowingly used a third party's system whose owner had not agreed to keep the messages confidential from itself, the 2024 Ontario court held that privilege was not established.¹⁴ Consumer terms put the lawyer in that position, in writing: the reservations are public and express, and the lawyer has read them. The training switch is a user setting, not a contractual promise: it can be switched back, it does not reach feedback or flagged conversations, and it leaves standing the vendor's right to use content to improve its services. The consumer contracts contain no promise of confidentiality, no contractual notice before disclosure and, in Anthropic's case, a reserved right to report inputs to law enforcement at its own discretion; OpenAI reserves a similar discretion in its Privacy Policy rather than its contract. OpenAI's consumer chats have already been preserved and sampled under a US court order the user never saw. Alberta's own 2026 playbook answers the point about paying: it tells lawyers not to put confidential information into prompts to publicly available tools at all. And a click-through vendor has agreed to nothing about the implied undertaking, which counsel must make sure a recipient knows it is bound by. For de-identified work none of this matters. For client material it is the whole question.

Against the plans this article accepts

The case against the business and enterprise tiers deserves the same weight, because it is strong.

• People at the vendor can still read content in the cases the vendor reserves: flagged conversations at Anthropic, third-party abuse contractors on ChatGPT Business, incident and legal access on ChatGPT Enterprise.
• US legal process reaches the vendor, including national-security process, and the notice promise yields wherever notice is "expressly prohibited". Anthropic's transparency report for the second half of 2025 records content requests from government and reports national-security process only in bands.¹¹⁰ The Canadian protections described above bind Canadian authorities, not American ones.
• Anthropic stores content in the United States on every plan. OpenAI's Canadian residency covers storage at rest, not inference, and only for workspaces provisioned with it.
• The vendor's copy of litigation work product may be protected only by its contract, not by privilege, and after the case the contract is all that is left.
• The terms can change: updates to Anthropic's Commercial Terms take effect 30 days after posting, or at once where they respond to a change in the law, and OpenAI may update its agreement on notice.¹¹¹
• Liability is capped at 12 months' fees, disputes go to arbitration in California, and the data processing addenda, including their breach-notice promises, are written around personal data rather than privileged business information.¹¹²
• No Canadian court has held that a vendor on these terms is inside the privilege.¹

Most of this is the ordinary risk of any outsourced service a firm already relies on, and the contracts place these vendors much closer to the agent under confidentiality that Canadian law treats as a channel than to the stranger it does not. A party alleging waiver must prove it, but the firm must first prove the confidentiality its claim of privilege depends on, and the evidence of that is the firm's own to keep: the client's consent, what it chose to send, the settings it locked and the dated terms it relied on.¹¹ A firm that has all of that would have the facts on its side. Two points no contract answers: foreign legal process, and human access in the cases the vendor reserves. That is why the verdict is conditional, and why the most sensitive files belong elsewhere. Saskatchewan's guidance tells lawyers with especially sensitive information to consider "whether simply not using the tool is a better course of action"; British Columbia's cloud checklist singles out clients "whose activities may be of interest to the United States government or law enforcement"; and the federal Privacy Commissioner has said that some information "is so sensitive that it should not be sent to any foreign jurisdiction".¹¹³

Three provinces' own words

British Columbia's rule is binding, and the published business terms do not meet it on their face. A lawyer may keep records with a storage provider only if the provider maintains them without "accessing or copying them except as is necessary to provide the service obtained by the lawyer" and without "failing to destroy the records completely and permanently on instructions from the lawyer", under a written agreement consistent with the lawyer's obligations; if a third party fails to destroy records despite instructions, the lawyer must report it to the Executive Director at once.³⁵ Anthropic keeps flagged content for review and excepts backups and copies kept to comply with law from its duty to destroy. OpenAI may run business data through classifiers "to better understand how our services are used", lets third-party contractors review ChatGPT Business content for abuse, and may keep content it treats as abusive. A British Columbia lawyer who wants to use these plans for records within the rule needs a written agreement that does meet rule 10-3(4), which in practice means a negotiated one. Team and Business do not offer one: they come on the published terms set out in the comparison above. A British Columbia lawyer or small firm on those plans is therefore left with work that carries no client information or has been genuinely de-identified, and for records within the rule needs a negotiated enterprise agreement, or a cloud route under a contract checked against the rule; the cloud agreements were not read for this article. Without such an agreement, these plans are not for those records.

Saskatchewan's guidance is not binding, and read literally no subscription plan meets it. It asks a lawyer who intends to input confidential or privileged information to "ensure that the provider does not share inputted information with third parties, or utilize the information for its own use in any manner".³⁷ Every plan reserves some use of content for abuse and safety review, OpenAI may also run classifiers over business data to understand how its services are used, and ChatGPT Business adds third-party contractors. The guidance's consent step is written for the case where anonymising cannot protect confidentiality: informed consent "should be sought", with candour about "the potential reuse of information shared as well as the potential for the loss of privilege", and for especially sensitive information a lawyer should ask whether not using the tool is the better course.⁴¹ It does not say that consent cures a tool that "lacks adequate confidentiality and security protections".³⁷ The conditions in this article follow the consent step; they do not pretend the plans pass the first test, or that consent makes up for failing it. What the guidance leaves a Saskatchewan lawyer who uses a business plan for client material is its own bar: to be satisfied that the plan, as the firm has set it up, is not a tool that "lacks adequate confidentiality and security protections", and to have the client's informed consent, sought as the guidance describes.³⁷

Alberta's playbook, whose stated focus is "publicly available AI tools", says without qualification: "Never include confidential or potentially identifying information in prompts."³⁹ The business plans are publicly available tools, sold to the public; they are not tools a firm builds for itself. On its words, then, the playbook reaches them too, and an Alberta lawyer who follows this article's conditional verdict for client material departs from the regulator's stated best practice. If that is done at all, it should be done knowingly, with the client's informed consent and only for what the matter needs.

Claude Code and Codex read folders, not prompts

A chat assistant sees what you paste. A coding agent sees what it opens. Anthropic's documentation says that what Claude Code sends over the network "includes all user prompts and model outputs", and what the agent reads to answer you becomes part of that exchange; Codex runs local work on your device and cloud tasks in OpenAI-managed environments.¹¹⁴ Point either at a matter folder and the folder is the prompt. Both inherit the plan they are signed into: Claude Code runs under the Commercial Terms on Team and Enterprise and under the Consumer Terms on Free, Pro and Max, and Codex under whichever ChatGPT terms govern the account.¹¹⁵ The verdicts above therefore apply, with traps of their own.

• Feedback leaves with your code. Claude Code's /feedback, /bug and /share send a transcript that is kept for five years, and answering yes to a session survey uploads the transcript and raw session log, with "Source code, file contents, and other conversation content" as they are, for up to six months. A /feedback report can also, optionally, open an issue in a public GitHub repository.¹¹⁶
• Transcripts stay on your disk. Claude Code keeps session transcripts in plain text under ~/.claude/projects/ for 30 days by default, but keeps the transcript of a session started or last continued in Claude Desktop or Cowork at any age unless you set a limit for those too; its prompt history (~/.claude/history.jsonl) and its auto-memory notes are kept until you delete them; and a credential a tool reads is written into the transcript. Codex keeps a history.jsonl transcript file and, with file-based storage, its access tokens in ~/.codex/auth.json.¹¹⁷ A home folder synced to a cloud drive copies all of it off the machine.
• A stray credential changes the contract. Claude Code prefers a cloud-provider setting, an ANTHROPIC_AUTH_TOKEN, an ANTHROPIC_API_KEY (once you approve it), an apiKeyHelper script, a CLAUDE_CODE_OAUTH_TOKEN, which can belong to a personal plan, or an Anthropic profile or federation credential (a profile named in ANTHROPIC_PROFILE, the ANTHROPIC_FEDERATION_RULE_ID and ANTHROPIC_ORGANIZATION_ID variables set together, or an active profile set up for federation) over the subscription you signed in to; a Codex session signed in with an API key follows that API organization's settings.¹¹⁸
• Cloud sessions run on the vendor's machines. Claude Code on the web clones your repository into an Anthropic-managed virtual machine, and on Pro and Max a session can be made visible "to any user logged into claude.ai"; Codex cloud tasks run in OpenAI-managed environments, and Codex Web is outside OpenAI's data residency.¹¹⁹
• Remote Control keeps a copy. While Claude Code's Remote Control is connected, the session transcript, including your messages, Claude's responses and tool activity, is stored on Anthropic's servers and retained under Anthropic's data-usage policy. Organizations with zero data retention cannot enable it, and on Team and Enterprise it is off until an Owner turns it on.¹²⁰
• Full access means full access. Microsoft's Codex documentation warns against the full-access mode without understanding its risks. OpenAI reported in August 2026 that, during internal cybersecurity evaluations, several of its models, led by an internal-only research model and "operating under reduced safeguards", circumvented controls meant to isolate them from the internet; it said customer data was not affected. The point is not that Codex did this. It is that isolation controls can fail.¹²¹
• Connectors and MCP servers are third parties. What an agent sends to an MCP server or connector is handled under that operator's terms, not the model vendor's; Anthropic says it "does not security-audit or manage any MCP server", and OpenAI's Service Terms say it is not responsible for app data once sent.¹²² That includes WarmLoop.
• Memory outlives the chat. Claude's memory is on by default on Free, Pro and Max, and memory entries are not removed when the conversation that produced them is deleted; ChatGPT treats memory and training as separate settings.¹²³

A checklist a firm can adopt

The conditions behind the verdicts, as a policy a firm can adopt. It does not make any use of these tools safe; it is the evidence of reasonable care a lawyer will want if that use is ever challenged.

Before any client material goes in

• Use a business plan on a firm account. Claude Team or Enterprise, ChatGPT Business or Enterprise, on accounts the firm owns. The Law Society of Ontario suggests allowing AI use only with accounts created under the organization's credentials.¹²⁴ Watch the reverse trap too: a personal account opened with a firm email can be absorbed into the firm's workspace.¹²⁵
• In British Columbia, get the storage-provider agreement. A written agreement that meets Law Society Rule 10-3(4): no access or copying beyond what the service needs, and complete destruction on instruction. Know that a failure to destroy records as instructed must be reported to the Executive Director.³⁵ Team and Business offer no such agreement; on those plans, keep to work that carries no client information or has been genuinely de-identified, or move to a negotiated enterprise agreement or a cloud route under a contract that meets the rule.
• Get specific consent in the retainer. Informed and in writing, naming the vendor, the plan, where data is stored and processed, and the privilege risk. It is best practice, not a rule, and it does not cure an unsuitable tool.
• Send the question, not the file. Remove names, file numbers, matter names and identifying facts. Anonymizing is imperfect, so assume a determined reader could re-identify what is left.
• Turn off what leaks. Feedback ratings (on Claude Team and Enterprise an owner can disable them for the organization), memory, public or cross-workspace sharing and unreviewed connectors; keep training off wherever a setting exists.¹²⁶
• Decide retention before you start. Set a retention period on Enterprise, knowing that it does not reach every feature and that a project's own retention overrides it;⁷⁵ delete matter content when the matter ends, and clear local transcripts. Litigation privilege ends with the case, and work product that only it protected is then protected in the vendor's copy only by contract.
• Mark privileged material. Label prompts and files as privileged and confidential. Markings support an expectation of confidentiality,¹²⁷ and material that says nothing about privilege may not trigger the Canadian protections described above.
• Keep the other side's documents out. Discovery material, family financial disclosure and anything under a sealing order, publication ban or protective order go in only where necessary, to a vendor bound in writing, and only if the order allows it.
• Verify everything you file. Every authority, pinpoint and quotation against an authoritative source, and know whether your court requires a declaration of AI use.
• Keep the terms on file. Save the dated terms and the settings you relied on. A claim of privilege is yours to prove, and if you ever have to show a limited-purpose disclosure in confidence, this is the evidence.
• Ask your insurer in writing. Ask whether a disclosure through an AI vendor is covered. The 2026 LAWPRO policy in Ontario excludes cybercrime claims except under a $250,000 sublimit and says nothing about AI; the Saskatchewan insurer's policy wording is not publicly readable.¹²⁸
• Plan for a vendor breach. Decide who assesses it and who reports it. Under PIPEDA the firm remains responsible for information it sent out for processing.⁴⁹

For Claude Code and Codex

• Sign in to the firm's account and nothing else. Check that no ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, apiKeyHelper script, cloud-provider setting, ANTHROPIC_PROFILE, federation variables or federation profile is in place, and no personal Codex API key. On Claude Team or Enterprise, deploy the forceLoginMethod and forceLoginOrgUUID settings through device management, because server-managed settings cannot redirect a first login; with the organization ID set, Claude Code refuses at startup to run on an ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN or apiKeyHelper credential, though a token made with claude setup-token is checked only for the login method, and an Anthropic profile or federation credential is not blocked, nor checked for the organization it belongs to. For Codex, set forced_login_method to "chatgpt" and forced_chatgpt_workspace_id to the firm's workspace; Codex logs out a session that does not match.¹²⁹
• Disable feedback uploads. For Claude Code, set DISABLE_FEEDBACK_COMMAND=1 and CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1; for Codex, turn feedback.enabled off.¹³⁰
• Limit local history. Shorten Claude Code's cleanupPeriodDays and set desktopSessionCleanupPeriodDays for Desktop and Cowork sessions, set Codex's history.persistence to "none", and keep ~/.claude and ~/.codex out of synced folders and shared backups. When a matter ends, claude project purge on its folder removes its transcripts, memory and prompt-history lines.¹¹⁷
• No cloud sessions, Remote Control or public sharing for client files. Turn Remote Control off with Claude Code's disableRemoteControl setting, and on Team or Enterprise leave the Owner's Remote Control toggle off.¹²⁰ WarmLoop's guided setup asks the assistant to turn Remote Control on for each WarmLoop session; for client work, choose its bare setup instead, and if you already chose the guided setup, also remove the block it installed (see below).
• Check Codex's separate training switch. On a personal ChatGPT plan, "Include environments" is not changed by the ChatGPT setting;⁸³ better still, keep client work off personal plans.
• Fence the agent. One matter folder per session, and no full-access mode on a machine that holds other clients' files.
• Vet every MCP server and connector as you would a vendor. Each is a separate recipient under its own terms.

For any other assistant or MCP server, WarmLoop included

These questions travel to Microsoft Copilot, Google Gemini, any legal AI product and any MCP server, and they track the guidance on assessing third-party service providers that the federal Privacy Commissioner published in September 2026 and is taking comments on until December 4, 2026.¹³¹

• Is there a contract, and does it call your content confidential? A privacy policy is not a promise to you.
• Does the provider use your content for anything but serving you? Training, product development, safety research, statistics.
• Who can read it, and when? Staff, contractors and reviewers, and whether access is logged.
• How long is it kept? Including backups, flagged content and logs, and whether you can delete it.
• Will it tell you before handing your content to a court or government? And what the exceptions are.
• Where is it stored, and where is it processed? They are often different places.
• Who else receives it? Subprocessors, connectors, web search and other tools in the chain.
• What can the firm control? Accounts, settings, retention and exports.
• Which law governs, and where are disputes decided?

Higher-assurance routes

If Canadian storage or processing matters to a client, among the plans in the verdict table only ChatGPT Enterprise offers any of it, and only storage at rest, in a workspace provisioned with Canadian data residency; it is listed last below. The cloud platforms come closer, with caveats, and they need technical setup and a different contract. They are noted here, not analysed plan by plan.

• Claude on Amazon Bedrock. AWS says inputs and outputs are not shared with model providers and are not used to train their models, and that Bedrock does not store them by default; the exception is Anthropic's Fable 5 and 5.1 models, whose traffic is kept for up to 30 days for abuse detection, with flagged traffic open to review by AWS.¹³² No current Claude model runs in-region in AWS's Canada (Central) region. The closest option is the US geographic profile, which in AWS's words "Keeps data within US and Canada regions".¹³³ Claude Code pointed at a Canadian AWS region defaults to the global profile, which can route anywhere, unless you set the US profile.¹³⁴ Google's platform lists no Claude model in its Montréal region.¹³⁵
• OpenAI models on Microsoft Azure. Microsoft says prompts and completions are not available to OpenAI and are not used to improve OpenAI's models. In Canada East and Canada Central, in-region processing is available only for older models or reserved capacity; the newest models are offered as global deployments that may be processed in any Azure region, and Microsoft may sample prompts for human abuse review unless the customer is approved for modified abuse monitoring. The Codex command-line tool can be pointed at Azure.¹³⁶
• ChatGPT Enterprise with Canadian data residency: storage at rest in Canada, inference outside it, as described above.

We did not read the AWS or Microsoft customer agreements, so the contracting party, governing law and legal-process terms on those routes are not verified here.

Where WarmLoop fits, and where it does not

WarmLoop is a Canadian legal research and verification service that a lawyer uses through an AI assistant. It works today, in early access, with Claude (including Claude Code) and with OpenAI's ChatGPT and Codex; each seat is set up by hand during the pilot. A reader of this article is entitled to ask what it does about the problem described here, and to put WarmLoop to the questions this article asks of every other vendor.

It does not make the model vendor's terms go away. WarmLoop is one more service provider in the chain. Every query you send and every result it returns, including the full text of documents and the content of Records, passes through your assistant's vendor, under your agreement with that vendor and outside WarmLoop's control.¹³⁷ Everything above about the vendors applies whether or not WarmLoop is connected.

Here are WarmLoop's own answers to the questions in the checklist, taken from its Terms of Service and Privacy Policy of September 23, 2026.

• Is there a contract, and does it call your content confidential? Yes. The Terms treat your content and account information as confidential, allow disclosure only to named service providers, the readers you approve for a Record, WarmLoop's professional advisers, a successor, a court in a dispute with you and a person who needs it because of an emergency that threatens an individual's life, health or security, and otherwise where the law requires, and do not displace your own duties of confidentiality and privilege.¹³⁸
• Does it use your content for anything but serving you? WarmLoop does not use your content to train AI models, and does not use the text of your research queries to develop the service or send it to an AI tool outside Canada. The Privacy Policy says two things keep that promise: the service sends query text to no AI model other than the reranking model in Canada, and the features that could send a request to such a model when a user asks for it are switched off; and WarmLoop's rule is that its development tools are not used to read query text, a rule "kept by WarmLoop's own practice, not by a technical control". Other content WarmLoop examines in its development and support work, such as feedback, is processed through Anthropic's Claude, which is hosted outside Canada, and feedback is kept indefinitely and used to improve the service.¹³⁹
• Who can read it, and when? WarmLoop's development tools run on the computers and servers where your content is held, so the rule that they are not used to read your query text is a rule WarmLoop keeps, not one its systems enforce. It accesses a Record's content only as needed to operate, secure, support and troubleshoot the service, to act on a notice, or where the law requires. WarmLoop's owner also practises law, at a firm that is a separate organization and itself a WarmLoop customer. The Privacy Policy says that the owner's access to WarmLoop's data is "on WarmLoop's behalf only", and that WarmLoop makes no personal information of its users available to that firm, other than what any customer receives about its own account and its own Records. Whether WarmLoop's own access to your content is logged, neither the Terms nor the Privacy Policy says. Both describe an access log for each Record, which records each view and each exhibit opened and which the Customer can see; the Privacy Policy also describes an audit log of listed platform events and logs of WarmLoop's administrative sessions on its servers, kept for 400 days. Neither says in terms that any of them records WarmLoop's own reading of your content.¹³⁹
• How long is it kept? Query text is deleted from the query log 30 days after it is recorded and stays for about 12 months more in encrypted backups, longer on a backup drive connected less often than once a month, and the two most recent nightly copies of that database are kept unencrypted on WarmLoop's own server. Some search text, and the citations and passages sent for checking, sit in request logs with no set deletion period, and a citation form you look up may be kept permanently. Records are kept until they are removed, with no self-service delete; WarmLoop acts on a request for removal within 30 days, except so far as it must keep information by law, and Records stay in encrypted database backups for up to about 120 days after removal; the text and exhibits of a publication that failed are kept with no set period. Transcripts of WarmLoop's development and support work, which can contain feedback and other content examined in it, are copied to Apple's iCloud Drive and kept indefinitely.¹⁴⁰
• Will it tell you before handing your content to a court or government? Yes, unless it is legally prevented: the Terms promise to tell you of a lawful demand for your content "so that the Customer can assert privilege or object". The promise covers a lawful demand only; the Terms make no promise to tell you of a disclosure to a person who needs your content because of an emergency.¹³⁸
• Where is it stored, and where is it processed? WarmLoop's own systems run in Canada. The web service, its database and the Record store run in Amazon Web Services' Canada (Central) region, and the corpus, search and query log on WarmLoop's own servers in Saskatchewan. The text of each query, with candidate passages, is also sent to a reranking model (Cohere Rerank) that Amazon Web Services hosts in Canada (Central). Content WarmLoop examines in its development and support work, such as feedback, is processed by Anthropic outside Canada; Apple holds copies of the transcripts of that work, which can contain such content, and GitHub holds summaries of feedback, in places WarmLoop does not control, some of them outside Canada, as the next answer says.¹⁴¹
• Who else receives it? Your assistant's vendor receives everything, as above. Anthropic (development and support, outside Canada), Apple (the iCloud copies of development transcripts), GitHub (summaries of feedback and test queries derived from it) and Microsoft (WarmLoop's mailboxes) process content in places WarmLoop does not control, some of them outside Canada; Stripe, Google and Microsoft sign-in, and Cloudflare for the website alone, handle payment, sign-in and website data.¹⁴¹
• What can the firm control? Less than on the vendors' enterprise plans. There is no self-service export or deletion of an account, its data or a Record; requests go to WarmLoop, which answers within 30 days; and each account belongs to one user.¹⁴²
• Which law governs, and where are disputes decided? Saskatchewan law, before a single arbitrator in Regina, with a class waiver and no appeal to a court on a question of law. Liability is capped at the greater of two months' fees and $500, or, for a breach of confidentiality or of WarmLoop's security safeguards for personal information, the greater of 12 months' fees and $5,000; lost data and consequential loss are excluded for every claim short of fraud or wilful misconduct; and there is no uptime commitment.¹⁴³ Measured against the vendors' business terms, which cap liability at 12 months' fees, WarmLoop's general cap is lower; its cap for a breach of confidentiality is the same 12 months' fees, with a $5,000 floor; and, like Anthropic's terms and unlike OpenAI's, it keeps consequential loss excluded even for a breach of confidentiality.¹⁰¹

One thing WarmLoop's guided setup does cuts against this article's own checklist. If you choose that setup, the instructions it adds to your assistant include one to turn on the assistant's remote-control feature "for each WarmLoop session", or to tell you how, and later setup runs may refresh those instructions without asking you again.¹⁴⁴ On Claude Code that feature is Remote Control, which stores the session transcript on Anthropic's servers and retains it under Anthropic's data-usage policy; organizations with zero data retention cannot enable it.¹²⁰ A lawyer working on client files should choose WarmLoop's bare setup, which writes nothing, or turn Remote Control off in Claude Code as the checklist describes. If you have already chosen the guided setup, switching each connection to the bare setup means later setup runs refresh nothing, but the Terms do not say it removes what is already installed, and the marked block in CLAUDE.md or AGENTS.md carries that instruction. Remove the block as well, or remove everything the guided setup installed (the block, the command and agent-definition files, and the templates and programs it downloaded or copied), after which a setup run is to ask you again before it installs anything.¹⁴⁴

What WarmLoop is for is the second risk, and minimisation on the first. It returns Canadian law with checked citations and pinpoints, and checks a draft's citations and quoted passages against the text it holds. It machine-checks; it does not review or endorse an argument, and "verified" means it found the case, the pinpoint and a close match for the quoted words in an unofficial copy, not that the authority is good law.¹⁴⁵ Research and citation checking need no document uploads; you upload documents only if you choose to publish a Record, which WarmLoop keeps as described above. A research question can be framed without a client's name or identifying facts.¹⁴⁶ Checking a draft still exposes it to your assistant's vendor. To check a draft, your assistant reads it, or at least the passages it checks, so your assistant's vendor receives them as it receives everything else,¹³⁷ and the citations looked up and the passages sent to be located stay in WarmLoop's request logs with no set deletion period.¹⁴⁰ For a client draft, either use an assistant on a plan and settings that meet the conditions above, or take the citations and the quoted passages out of the draft and give the assistant only those to check. WarmLoop's Terms do require you to use your assistant's no-training setting wherever it has one, but that clause protects material retrieved from WarmLoop from being used to train models; it is not a confidentiality protection for your files, and where an assistant offers no such setting, the vendor's use of your conversations is not a breach of that clause by you.¹⁴⁷ None of that makes a consumer plan safe for client files. It means the research half of the work need not put them there.