AI Principles

The principles

• The firm's data is never used to train a model, ours or the provider's.
• The provider keeps nothing it is sent once it has answered, except for a model the firm has chosen to accept 30-day retention for.
• The assistant is off until the firm turns it on, and the firm chooses which models its people may use and how much each may spend.
• The assistant proposes; a person approves. Nothing changes in the firm's records until someone approves it, and what it drafts is marked as machine drafted.
• Information walls and permissions apply to the assistant as to people: it reads only what the person asking may read, through the same checks their own screens make.
• Every request, the records it read and what it proposed are recorded in the firm's audit trail.
• It does not give legal advice, and says so.

The provider and the agreement

The assistant's models are provided by Anthropic PBC, of the United States, reached only from our servers; a person's browser never talks to Anthropic directly. Anthropic is bound by its Commercial Terms of Service and Data Processing Addendum, under which it processes what we send only to answer it and does not train its models on it.

Our Anthropic account runs under zero data retention: Anthropic keeps neither the request nor the answer after replying, except where the law requires it. The most capable model is not offered under zero retention. A firm may choose it only by accepting, in its settings, that Anthropic keeps what is sent to that model for 30 days; that firm's requests to that model alone go through a second account set up for that retention.

What is sent

The text of the person's request and the records the assistant reads to answer it, such as a matter's details, its deadlines or its time entries. Nothing else from the firm's database is sent. When the firm turns the assistant on, it records its lawful basis for this transfer under the Data Protection Act, 2012 (Act 843).

Changes

If we add a provider or change what is sent, we update this page and the Subprocessors page with 30 days' notice first.