Is CoCounsel (Formerly Casetext) Safe for Confidential Client Data

Short answer: CoCounsel can be used on confidential client matters if your firm signs the right terms and keeps a lawyer in the loop. Thomson Reuters says CoCounsel holds SOC 2 and ISO 27001, was certified to ISO/IEC 42001 (the AI management standard) in June 2025, encrypts data in transit (TLS 1.2) and at rest (AES-256), and sends prompts to model providers through zero-retention API calls, so customer content is not used to train third-party models.

CoCounsel is the AI assistant Casetext built and Thomson Reuters bought in 2023 for about $650 million; it now ships inside Westlaw and Practical Law plans and as the standalone CoCounsel Legal. The vendor paperwork is solid. What decides whether it is safe for your matters is the retention setting on your account, who at the firm can upload what, and whether every cite gets checked before it goes out.

CoCounsel security at a glance

Cost is part of the risk picture too, because a firm that cannot justify the seat price ends up with associates pasting files into consumer chatbots. Reported CoCounsel Legal pricing runs about $784 per attorney per month on a one-year term, falling to about $637 on three years; the full breakdown is in our CoCounsel pricing guide.

What “safe” should mean for law‑firm AI

For a firm, “safe” covers more than encryption. It means client/matter isolation, zero‑retention processing for sensitive work, and no training on your data unless you say so, clearly and in writing.

It also means you can show who accessed what, when, and why, and that a lawyer reviewed the output before anything left the building. A simple approach: map every AI use to your risk tiers, Tier 3 (internal drafts, KM) is open for pilots, Tier 2 needs client awareness, Tier 1 (most sensitive) runs on private inference only. Tie this to Outside Counsel Guidelines you already track, residency, logging, subcontractors, so approvals don’t drag.

Ethical and regulatory framework lawyers must satisfy

Your guideposts are familiar. Model Rule 1.1 (competence), 1.6 (confidentiality), and 5.3 (vendor supervision). Many state bars echo them and suggest consent where the impact is material.

In practice, that means vet security, lock down confidentiality in contracts, supervise outputs, and verify citations. After the Mata v. Avianca mess (fake cites from an unsupervised chatbot), courts reminded everyone to check sources. Do that by policy. Also, be clear in billing: explain attorney oversight and judgment instead of time alone. Clients like efficiency; they love candor.

Data handling, training, and retention policies to require

Get it in writing: no training on your prompts, docs, or outputs by default. Any training must be opt‑in, scoped to a matter, and reversible. The legal ai vendor data retention and deletion policy should name retention windows, support hard delete, and guarantee tenant isolation.

Ask for mapped data flows, a current subprocessor list, and a DPA with SCCs/UK IDTA where needed. Push for “legal hold to aware deletion” so normal cleanup pauses if a matter is on hold, and get deletion certificates when you want them.

One handy move: set “ingestion classes.” Class A (privileged) goes through zero‑retention only. Class B (de‑identified/public) can hit standard endpoints. Class C (firm templates) may be opt‑in for fine‑tuning. This mirrors eDiscovery logic and keeps client/matter data silos clean.

Security fundamentals to verify

Treat the platform like any serious legal SaaS. You want encryption in transit and at rest, customer‑managed keys in your KMS, and enterprise identity: sso/saml mfa and rbac for legal ai platforms with SCIM for fast offboarding. Ethical walls and matter‑level permissions should be native, not bolted on.

Ask about their secure development lifecycle and secrets management. Request an architecture diagram that shows every service touching your data and which paths are zero‑retention. Also line up “break‑glass” support and a named escalation route. When a client CISO calls with a 24‑hour inquiry, you need logs, storage locations, and containment, now, not next week.

Auditability, monitoring, and legal hold readiness

You need exportable audit logs: who ran which prompt, when, against which docs, from what device or IP. Pipe those into your SIEM so audit logs, siem integration, and legal hold in ai tools work together and not as separate boxes to tick.

Make sure every action can be tagged with client and matter numbers to match your DMS. Ask for legal hold capabilities that pause deletion and pull logs into scope. Bonus points for “prompt provenance”, document snapshots, model versions, and settings, so you can reproduce results and defend your process if challenged.

Independent assurance and risk evidence

Trust, then verify. Ask for a current SOC 2 Type II that covers the AI environment. ISO/IEC 27001 helps too, soc 2 type ii and iso 27001 for legal saas vendors are a strong combo. Review recent pen‑test summaries and remediation timelines, and check for a vulnerability disclosure program.

Subprocessor transparency matters. Keep a current list and change alerts. Here’s a time saver: clients increasingly ask firms for vendor artifacts during OCG renewals. If you already have SOC reports, pen tests, DPAs, and data‑flow diagrams on hand, procurement moves faster. Read SOC exceptions first; repeated access‑review gaps deserve a closer look at identity controls.

Data residency, cross‑border transfers, and client restrictions

Be clear on where data lives and where it travels. Require regional hosting and documented paths for data residency eu/us/uk and cross‑border transfers (sccs/uk idta). For EU files, get TIAs and confirm zero‑retention inference if routing across regions.

Some clients still insist on “EU‑only” or even “no cloud” for certain matters. Plan a dual track: private or on‑prem inference for the most sensitive, and zero‑retention public endpoints for the rest. Watch your telemetry, logs that export document titles can quietly break residency promises. Keep logging regional or redact fields before export.

Model governance and safe inference pathways

Route work by sensitivity. For privileged content, require zero data retention llm endpoints for law firms and consider VPC‑isolated or private inference. Use allowlists so only approved models are available, and tie access to ethical walls and client/matter data silos.

Set guardrails that auto‑scan prompts and attachments for PII/PHI and either redact or reroute. Lock down egress on high‑risk matters (limit exports, watermark drafts). Save model version, temperature, and retrieval settings with each output so you can answer “why did we miss Clause X?” without guesswork.

Hallucination control and citation‑first workflows

Accuracy wins trust. Build hallucination control and source‑grounded citations in legal ai into your default: retrieval‑first, mandatory citations, and a simple rule, no source, no send. Yes, Mata v. Avianca is still the example everyone knows. Don’t risk it.

Keep a human in the loop, require cite‑checks, and log reviewer attestations. If retrieval confidence is low, the system should ask for more docs or hand off. Use exclusion lists to block weak sources and favor your KM and templates. Track provenance end‑to‑end so audits don’t turn into inbox archaeology.

Firm‑side policies and approved use cases

Write down what’s allowed. Good fits: first‑draft research memos, deposition prep summaries, contract issue spotting, KM curation, especially with pii/phi redaction and document hygiene for ai assistants baked in. Hold back on final filings, privileged strategy notes, and anything involving opposing party productions, unless a partner signs off.

Set upload rules (no bank accounts or government IDs) and default redaction profiles. Require attorney review notes for anything client‑facing. Think in “risk budgets”: low‑risk tasks can touch broader models; high‑risk tasks demand private inference and tighter controls. Train with real examples from your practice so adoption sticks.

Client communication and engagement terms

Many OCGs now ask about AI. Prepare clear outside counsel guidelines (ocg) ai disclosure language that explains when AI may be used, what gets processed, your zero‑retention paths, who can see the output, and how you supervise and verify.

Offer opt‑outs or private‑inference‑only for sensitive work. Add a consent checkbox to matter intake. Share a one‑pager with controls, certifications, and logging during onboarding. Be upfront about billing: AI can speed tasks, but lawyers remain responsible for accuracy and analysis. Align with the client’s own AI policy to avoid review churn.

Vendor due‑diligence checklist for CoCounsel and other legal AI

Cover people, process, and tech. Security: encryption, network isolation, incident response, disaster recovery, customer‑managed keys. Identity: SSO/SAML, MFA, SCIM, granular roles, ethical walls. Privacy: DPA, subprocessor transparency, regional hosting, zero‑retention inference, and opt‑in training only.

Assurance: soc 2 type ii and iso 27001 for legal saas vendors, fresh pen tests, sample logs, and SIEM integration. Legal: confidentiality, breach SLAs, IP/indemnity, deletion commitments. Technical: data‑flow diagrams, model catalogs with zero‑retention flags, content filtering/PII redaction. Define pilot exit criteria early, and practice offboarding, return data, produce deletion certs, and prove it.

Rolling out CoCounsel from pilot to firmwide adoption

Start small. Pick two cooperative practice groups and a couple of clear use cases (contract summaries, depo prep). Set KPIs, turnaround, edit rates, citation accuracy, satisfaction, and run a 60 to 90 day pilot with zero‑retention endpoints.

Gate promotion to production on hitting KPIs, clean logs, and no open security issues. Build enablement as you go, office hours, prompt libraries, short demos. Expand by matter tier, not hype. Budget time to tune prompts and templates; that’s where the big gains live. Share specific wins and keep a quarterly review rhythm for safety and updates.

Red flags and how to mitigate them

Watch for “we may use your content to improve our services” buried in terms, That’s training on your data. Also beware vague retention, opaque subprocessors, weak or non‑exportable logs, no SIEM integration, no zero‑retention option, no customer‑managed keys, or missing SSO/SAML.

Fix with contract riders (no training, strict deletion windows, regional hosting), stronger architecture (private endpoints, ethical walls, matter‑level permissions), and tighter operations (narrow use cases, extra human review, reduced exports). If marketing promises don’t match controls, like big claims without source grounding, slow down. Say “yes, with safeguards” you can defend to clients and courts.

Where LegalSoul fits next to CoCounsel

LegalSoul is a narrower tool. It does not do legal research and has no case law, citator or Westlaw content, so it is not a CoCounsel replacement for research. It reads a contract, lease, brief or exhibit you upload and returns the issues, risky clauses and missing terms with page cites. Documents and account data are encrypted in transit and at rest, as set out in the privacy policy.

What LegalSoul does not offer today: SAML single sign-on, SCIM provisioning, a SOC 2 report, customer-managed keys, private or single-tenant deployment, DMS integration or regional hosting. If your outside counsel guidelines require any of those, LegalSoul is not the right purchase for that matter. Where it fits is a small firm that wants document review at a published price, from $99 a month on the LegalSoul plans, instead of a per-attorney research seat. If you are weighing the two, our CoCounsel alternative for small law firms comparison sets them side by side, and Lexis AI vs CoCounsel covers the research side.

When CoCounsel is safe enough for privileged matters

AI can be safe for privileged work when the vendor’s controls and your governance line up. Look for zero‑retention inference, SSO/SAML with MFA and granular roles, encryption with CMK, full logging, and SOC 2 Type II. Pair that with clear use cases, redaction, human review with cite‑checking, and client‑aware disclosures.

If you’re deciding whether CoCounsel is safe for a given client, use a decision tree: residency satisfied, training opt‑in only, audit logs and legal hold ready, source grounding enabled. If the answers are “yes,” pilot low‑risk matters and grow by tier. If not, add compensating controls, or wait.

Quick takeaways

• Safety is doable: zero‑retention processing, no training on your data by default, tenant isolation, SOC 2 Type II, CMK encryption, SSO/SAML/MFA, granular roles/ethical walls, and exportable logs with SIEM.
• Protect privilege with process: define allowed use cases, scrub PII/PHI, require human review and cite‑checks, use retrieval‑grounded outputs, and support legal holds with deletion certs tied to client/matter IDs.
• Mind jurisdiction and models: enforce residency and DPAs/SCCs, disclose subprocessors and data flows, route sensitive work to private or zero‑retention endpoints, restrict models by practice and sensitivity, and record provenance.
• Roll out with intent: pilot low‑risk matters with KPIs, watch for red flags (training on your data, hazy subprocessors, weak logging), and mitigate with contract and architecture.

Conclusion

AI can fit privileged work when tech controls and firm policies meet the same standard. Prioritize zero‑retention inference, no training on your data, CMK encryption, SSO/SAML with granular roles and ethical walls, SOC 2 Type II, rich audit logs, and citation‑first review.

Lock down residency and DPAs/SCCs, pilot low‑risk matters, then expand by tier. For CoCounsel specifically, get the retention setting and the SOC 2 report before the first privileged upload. If what your team mostly needs is contracts and filings read faster rather than research, upload a document to LegalSoul and judge the review on a non-sensitive file first.