Is Perplexity AI safe for law firms handling confidential client data in 2025?

One misplaced upload can wreck privilege, set off OCG alarms, and rattle a client relationship you worked hard to earn. With gen‑AI moving fast in 2025, a lot of firms are asking the obvious: Is Perpl...

Short answer: it can be—if you lock it down with zero retention, tight access, and real contracts, not just a glossy slide.

Here’s what we’ll cover: what “safe” actually means for a firm, how these tools handle your data, the biggest risks to watch, and a concrete checklist to vet any vendor. You’ll also see guardrails that work in practice, a 30/60/90 pilot plan, incident steps if something leaks, and the red flags that mean “not yet.” By the end, you’ll know when to use AI on client work and when to keep it on the sidelines.

Short answer: When is Perplexity AI “safe” for confidential client data in 2025?

For attorney‑client information, Perplexity AI is only “safe” in an enterprise setup that you can prove is zero‑retention, access‑controlled, and covered by solid paperwork. Personal accounts and fuzzy training policies won’t cut it under ABA Model Rule 1.6 or typical Outside Counsel Guidelines.

You’ll want a signed DPA with no‑training language, clear data residency, and deletion SLAs. On the tech side, SSO/MFA, RBAC, and exportable audit logs. Ethics opinions like ABA 477R (secure comms) and 498 (virtual practice) point the same direction: use reasonable safeguards and supervise your vendors.

Quick gut check: if you can’t pull logs showing who saw what, where it lived, and that retention/training were off, don’t put client‑identifying data in there. Many Am Law security teams now push for customer‑managed keys (CMEK) and network allowlists for any zero‑retention AI assistant for confidential legal matters.

Also, don’t toss third‑party productions into a shared index unless you’ve got client sign‑off and matter‑scoped isolation. That’s how you avoid cross‑matter bleed and privilege headaches. So, is Perplexity safe for privileged data? Only when the enterprise controls and the DPA are real—and your people follow the policy.

What “safe” must mean for a law firm (confidentiality, privilege, compliance)

“Safe” isn’t vibes; it’s something you can defend to a client or a bar committee. Ethics first: Model Rules 1.1 (tech competence), 1.6 (confidentiality), and 5.3 (vendor oversight) expect thoughtful vetting and ongoing supervision. State bar cloud guidance repeats the basics—encryption, access control, and proper agreements.

Compliance next: treat the AI vendor as a processor under GDPR Article 28 where relevant; align with CCPA/CPRA. Many OCGs now require no training on client data, set residency boundaries, and reserve audit rights.

Operationally, “safe” looks like this: SSO/MFA, RBAC by client and matter, audit logging, encryption in transit and at rest, optional CMEK, and verified deletion. You should be able to show the data stayed in approved regions and never went into training.

Tip that works: set “confidentiality tiers” in your AI policy—Tier 0 (public info), Tier 1 (de‑identified firm content), Tier 2 (client content with approvals and isolation). It keeps risk creep in check. And yes, keep receipts: DPA, SOC 2 Type II letter, ISO 27001, training records, and quarterly access reviews.

How AI assistants process your data: data flows to map before approval

Before you flip the switch, map the whole lifecycle: inputs (prompts, files), processing (models and subprocessors), outputs (responses, logs, caches), and telemetry (analytics). Confirm what sticks around, where it sits, and how long it lasts.

Vendors often promise “no‑train” paths, but you need it in writing (DPA/security schedule) and in the admin console (toggles you control). If browsing is on, figure out what’s fetched, cached, or shared—prompt injection via webpages showed up in 2024 security research, and some tools keep copies of pages they read.

Cross‑border matters too. For global practices, lock down AI data residency and cross‑border transfers (EU/UK/US). SCCs and regional processing are table stakes. If you use retrieval, insist on isolated indices per client/matter with separate keys and logs.

Watch for quiet egress to “helper” services. Ask for a full subprocessors list and network egress details. Best drill: run synthetic client data through, then submit a data access/deletion request. See how fast and complete the response is. That exercise teaches more than any demo—and gives you evidence for your vendor risk file.

Key risks to assess with Perplexity AI in legal workflows

Retention and training: Verify zero‑retention and no‑training are actually on. Check the admin screens and the contract. Consumer defaults often keep prompts “for quality.”
Privilege and confidentiality: Make the vendor your agent via a DPA and segregate per client/matter. Uploading specifics without isolation can risk waiver in some places.
Reliability: Courts have sanctioned fake citations (see the 2023 S.D.N.Y. Avianca case). Use citation checks and human review to curb AI hallucinations and citation issues.
Prompt injection and browsing: Malicious pages can slip instructions into the model. Use allowlists and turn off external browsing for sensitive matters; red‑team it.
Access and insider risk: Enforce SSO/MFA, least privilege, and logging. Re‑certify admin access each quarter.

A sneaky one: cross‑matter accumulation. If your retrieval isn’t isolated, a quick search can surface snippets from the wrong matter. Fix it with separate stores and strict RBAC. And to reduce prompt‑level leakage, add PII/privilege filters and keep link‑following off unless you truly need it.

Ethics and regulatory framework you must align with

Ethics rules don’t ban AI; they expect you to use it carefully. Rule 1.1 asks you to know the tech’s risks and benefits. Rule 1.6 wants reasonable steps to keep info secure. Rule 5.3 says supervise nonlawyers—which includes vendors and systems.

ABA Formal Opinions 477R (2017) on secure communications and 498 (2021) on virtual practice translate well to AI. State bars—from California to Texas—have cloud opinions that echo encryption, due diligence, and, sometimes, client consent.

On privacy, GDPR means a DPA (Article 28), purpose limits, and proper transfer mechanisms. CCPA/CPRA bring service‑provider duties and deletion rights. SOC 2 Type II and ISO/IEC 27001 are helpful, but ask what’s actually in scope. The NIST AI Risk Management Framework (2023) is a useful lens; some firms also look at ISO/IEC 42001 in 2025.

Pro move: log client approvals in your OCG tracker and tie each AI use to the clause that permits it. Saves time during audits.

Due diligence checklist before any deployment

Contractual

Signed DPA with no‑training language, confidentiality, deletion SLAs, and a current subprocessors list (nod to GDPR Article 28 where applicable).
Breach notice timelines that match laws (e.g., GDPR’s 72 hours) and your OCGs.
Right to audit and refreshed security questionnaires each year.

Technical

SSO/MFA, RBAC, audit logs; encryption in transit/at rest; CMEK if available.
Zero‑retention toggles verified; document the enterprise data retention policy 2025 with screenshots and change logs.
Network controls: browsing allowlists/deny‑lists; IP restrictions for admins.

Operational

Onboarding/offboarding runbooks and quarterly access reviews.
Redaction steps and PII filters; human‑in‑the‑loop review baked in.
Incident playbooks with vendor contacts and response SLAs.

Evidence

SOC 2 Type II and ISO 27001 reports on file, with scope noted.
Pilot with synthetic data; submit deletion requests to prove the process works.

Use this as your vendor risk assessment checklist for AI tools in law firms, and keep every artifact in a neutral, audit‑ready space.

Secure configuration and guardrails for a defensible setup

Start simple: no personal accounts. Enterprise access only, with SSO/MFA. Build matter‑scoped workspaces, least‑privilege roles, and separate retrieval indices per client. Flip on zero‑retention/no‑training for prompts and uploads. If the vendor supports it, use CMEK so you hold the keys.

Clamp down on egress. Browsing should use a short allowlist, and file uploads to random links should be blocked. Turn on PII/privilege redaction. Push “citation‑first” drafting so lawyers can check sources fast.

Two controls firms often miss:

Two‑person approval before any new data source connects to an AI index, written to an admin log.
A “prompt of record” system that stores final prompts/outputs with matter codes for audits and privilege review.

Run monthly red‑team tests for prompt injection and data leaks, then fix what you find. With CMEK, rotate keys when a client disengages to enforce deletion. If you want confidentiality by design, LegalSoul ships with isolated indices, audit trails, and PII filters out of the box—handy when OCGs are strict.

Safe use cases vs. high-risk/prohibited scenarios

Safer uses (no client‑identifying data):

Public‑law research, quick case overviews, regulatory watch.
Neutral templates or checklists; brainstorming issue lists using public facts.
Summaries of depos/contracts after careful de‑identification.

Conditional uses (with controls and approvals):

Drafting from firm templates with de‑identified facts, followed by human review and citation checks.
Internal knowledge retrieval from a firm‑controlled, isolated index, split by client/matter with logging.

High‑risk/prohibited:

Uploading privileged or identifying documents without a DPA, zero‑retention, and isolation in place.
Browsing into sealed or sensitive sources; following unknown links on active matters.
Anything that conflicts with OCGs or privacy rules in your jurisdiction.

For tasks prone to hallucinations and citation slips, require “cite‑before‑accept”: sources first, drafting second. One small workflow tweak: tag each AI task in your matter system with a risk tier so reviewers see the guardrails before they approve uploads. It quietly prevents a lot of drift.

Pilot plan (30/60/90 days) for evaluating fit

30 days: Define scope (research, de‑identified drafting), success metrics (time saved, accuracy, user feedback), and hard red lines (no client IDs). Train a small cohort on safe prompting, redaction, and verification. Turn on logs and give people a quick “report an issue” button. Seed a synthetic dataset to test deletion/export controls.

60 days: Add 2–3 practice groups. Hold weekly reviews and spot‑check 10% of outputs for accuracy and citations. Run a red‑team exercise for prompt injection and browsing. Re‑check that zero‑retention and enterprise data retention policy 2025 settings stayed locked. Screenshot configs and file them with your DPA. Have InfoSec probe SSO/MFA and RBAC gaps.

90 days: Look at KPIs (maybe 25–35% faster first drafts; error rate under your threshold). Do an incident drill with the vendor to confirm SLAs. Note any OCG issues and tune your policy. Decide: continue limited, expand with added controls, or move to a legal‑built platform like LegalSoul. Bake lessons into onboarding and set a quarterly AI governance review.

Incident response for AI-related data exposure

Treat AI incidents like any other data issue—with a few model‑specific twists.

Detect and contain: Disable bad integrations, yank tokens, snapshot logs. Save prompts/outputs (your “prompt of record”).
Scope it: Identify data types (PII, PHI, privileged), jurisdictions, and which clients/matters are affected.
Notify: Follow vendor SLAs; align regulator notices with law (e.g., GDPR’s 72 hours) and OCGs.
Preserve privilege: Consider separate counsel, mark comms, and use common‑interest where appropriate.
Remediate: Purge caches/indices, rotate keys (CMEK), tighten RBAC and egress.

We saw several 2023–2024 incidents where prompts/outputs were visible more widely than intended—root cause was weak RBAC and unclear retention defaults. Keep a “kill switch” script handy: one click turns off browsing, clears session caches, and blocks uploads firm‑wide. Afterward, run lessons‑learned, update training, and adjust vendor requirements. Document everything; clients will ask.

When it still isn’t “safe enough”: red flags and alternatives

Red flags:

No zero‑retention option, or language like “may use data to improve services.”
Half‑baked subprocessors list; no SOC 2 Type II or a tiny audit scope.
No admin logs, weak RBAC, or no way to segregate by client/matter.
Muddy data residency and transfer posture.
Slow, vague answers to access/deletion requests.

If these don’t get fixed, keep use to non‑confidential work or pause the rollout. Quick decision path:

Can you get a DPA with no‑training and deletion SLAs? If not, stop.
Can you enforce SSO/MFA, logs, and per‑matter isolation? If not, research‑only.
Do OCGs ban general AI? If yes, get client consent—or don’t use it.

If you want confidentiality baked in, look at a legal‑specific platform like LegalSoul: private cloud or on‑prem, isolated retrieval, and PII/privilege filters included. One more guardrail that pays off: client‑by‑client opt‑ins stored with matter codes before any AI features turn on. It lines up expectations and avoids surprises later.

FAQs partners will ask (quick answers)

Does the tool train on our prompts or documents? In an enterprise, compliant setup—no. You need a no‑training clause and zero‑retention turned on. Keep screenshots and the DPA statement.
Where is our data stored and for how long? Set residency (EU/UK/US), confirm transient processing vs. storage, and define deletion SLAs. Document AI data residency and cross‑border transfers (EU/UK/US) for law firms.
Can we segregate data by client/matter and audit access? Yes. Use isolated indices, least‑privilege RBAC, and exportable logs. Review access quarterly.
How do we prevent privilege waiver? DPA in place, uploads limited to approved matters, PII redaction, and a “prompt of record.” Train and audit.
What if we need to delete everything? Use contractual deletion; with CMEK, rotate keys to make data unrecoverable. Ask for a deletion certificate and test it.
What about hallucinations? Require citation‑first drafting, verify sources, and keep human review. Track accuracy in your pilot metrics.
Can we browse the web safely? Use allowlists, turn off link‑following for sensitive work, and watch egress. Prompt injection is real—test it.

Bottom line and decision checklist

You’re not approving “an AI.” You’re approving a governed workflow. The must‑haves: enterprise‑only access, zero‑retention/no‑training, a signed DPA with deletion SLAs, SSO/MFA, RBAC, audit logs, encryption (ideally CMEK), data residency controls, and isolation per client/matter.

The hard no’s: consumer accounts, unclear data use, no contract protections, and missing logs or segregation.

Decision checklist:

We can prove zero‑retention/no‑training (policy + screenshots + DPA).
RBAC, logs, and client/matter segregation are enabled and tested.
We validated deletion and access requests with a live drill.
Users are trained; human review and citation checks are standard.
Use matches OCGs, with client approvals recorded where needed.

If anything here is missing, keep use to non‑confidential tasks or wait. If you need a path built for privilege, LegalSoul offers confidentiality‑by‑design with private deployment, isolation, and full auditability. With the right guardrails, AI is a defensible boost. Without them, it’s a discovery risk waiting to happen.

Quick takeaways

“Safe” use means enterprise controls you can prove: zero‑retention/no‑training, SSO/MFA, RBAC, logs, encryption (CMEK if possible), data residency, and isolation—plus a DPA with deletion SLAs.
Map data flows end to end. Keep browsing tight (or off), add PII/privilege redaction, and use citation‑first drafting with human review to handle hallucinations and prompt injection.
Run a real program: due‑diligence checklist, 30/60/90 pilot, red‑team tests, “prompt of record,” quarterly access reviews, and an incident kill switch. Until controls are proven, stick to public or de‑identified work.
If you can’t get these guardrails, keep usage narrow—or use a legal‑grade platform like LegalSoul with confidentiality by design.

Conclusion

Perplexity AI can work on client matters, but only in a locked‑down enterprise setup: zero‑retention/no‑training, SSO/MFA, RBAC, logs, encryption (CMEK if you can), residency controls, and matter‑level isolation—backed by a DPA and tested in a pilot and drills.

If you don’t have those assurances, keep it to public or de‑identified tasks. Want end‑to‑end confidentiality that fits privilege and OCGs? Ask for a LegalSoul security review and demo, get the DPA/security schedule, and run a 30/60/90 pilot with InfoSec. Make AI a defensible productivity lift—not a discovery problem.