Outside counsel guidelines
Give clients a deployment-specific explanation of where matter content is processed and what is allowed to leave.
Security / Data handling
The data-handling statement your reviewers can actually use
Every production deployment can be described through a client-specific statement covering hosting, identity, storage, model route, egress, retention and the conditions that have actually been verified.
What it establishes
Eight questions. Deployment-specific answers.
Sanctum Lex lets legal teams pressure-test sensitive positions before they reach opposing counsel, a client or the court, with deployment, data handling and model access governed around the firm's security requirements.
For matters that cannot leave the firm's environment, Sanctum Lex supports private-perimeter deployment without external model egress.
Recorded for the client deployment. A private-perimeter route keeps matter processing and inference inside the approved environment; a governed external model route identifies the approved endpoint and data path.
Access is governed through the firm's identity and role model, with matter and knowledge permissions applied according to the configured deployment.
None in a verified private-perimeter configuration with local inference and outbound paths denied. Where an external endpoint is approved, it is recorded as governed egress.
Sanctum Lex does not use client matter content to train its own models. Any external provider's contractual data-use terms are reviewed as part of the approved model route.
Prompt, matter and audit retention are governed by the deployment policy and client agreement rather than assumed from a generic consumer setting.
The data path is documented for the selected hosting and model route. A private-perimeter deployment can avoid external inference transfer entirely.
The client agreement defines notification obligations, while the platform and deployment record identify the relevant audit and operational evidence.
Deletion, retention and export follow the client-approved storage and matter policy. Private-perimeter deployments keep those operations inside the client environment.
Where firms use it
Security and procurement review
Put the model route, identity boundary, retention and audit position in one document that can be reviewed alongside the architecture.
Internal AI governance
Give risk, innovation and IT teams a fixed description of the approved operating model rather than relying on a sales-call summary.
The statement describes the software and the selected deployment. It is not legal advice, and the firm remains responsible for its own obligations to clients and regulators.
Put the data path in front of your reviewers.
We will document the model route, egress conditions, identity boundary and retention policy for the deployment you are evaluating.