Is it safe to upload client documents to an AI tool?
It depends on the vendor, so ask. Here are seven questions to put to any AI tool before you upload a client's passport, financial records or personal history, and how Casen answers each one.
You stay responsible
Whichever tool you use, you stay responsible for your clients' confidentiality. A vendor's security does not move that responsibility, so check each answer yourself. Read OMARA's guidance on AI and your own obligations as a registered migration agent.
Seven questions to ask any AI vendor
1. Where is the data stored and processed?
Ask for the region of the database, the file storage and the AI model itself. Storage and processing can be in different places.
Casen: Client documents and AI processing stay in Google Cloud's Sydney region (australia-southeast1).
2. Is my clients' data used to train models?
Ask for a plain yes or no, in writing, and look for it in the vendor's legal documents as well as the marketing.
Casen: No. Documents are never used to train AI models, and nothing Casen sends to the AI is used to train any model.
3. How long is it kept?
Ask how long the vendor keeps files, and separately how long the AI provider keeps what it is sent.
Casen: The AI runs with zero data retention. Documents uploaded for a one-off analysis are deleted automatically after 24 hours, and the analysis results stay in your account. Documents attached to a client or a lead stay in your practice's own private storage until you delete them.
4. Who are the subprocessors?
Ask for a named list that says what each third party receives and where it processes it.
Casen: The Trust page names every third party that touches data. It separates the two providers that handle client documents (Google Cloud Platform and Google Vertex AI, both in Sydney) from the providers that only handle practice and account information.
5. Can I delete the data?
Ask what deletion removes, and whether recovery copies remain afterwards.
Casen: Deleting a client removes their record, files and document analyses from Casen. Recovery copies are kept for up to 14 days in case of a system failure, then they are gone.
6. Can I audit the vendor?
Ask whether the contract gives you audit rights, or the right to appoint an independent auditor.
Casen: Casen's DPA lets you audit how Casen processes your data, or appoint an independent auditor to do it, with 30 days' written notice.
7. Who is responsible under my own obligations?
You are, whatever the vendor says. Ask how the tool helps you do your own checking, and what it asks you to do before you switch on anything that shares client information.
Casen: Casen gives an indicative first-pass review and is not legal advice. You check the findings and make the call. If you switch on a connector that sends your clients' information to a third party outside Casen, get your clients' consent first.
Three more things worth asking
- Are uploads scanned? Casen scans every document for malware in Sydney before anyone can open it.
- Is the data encrypted? Casen uses AES-256 at rest and TLS 1.3 in transit.
- Is each practice's data kept separate? At Casen, each practice's data is kept logically separate from every other practice's.
Compare the documents with the marketing
Read the vendor's privacy policy, data processing agreement and trust page, and check that they agree with each other and with what the sales page says. Casen's answers above come from its Trust page and FAQs.
Casen's results are indicative, not legal advice. A registered migration agent checks them and decides what to do.
