Attorney-client privilege ends when data hits an LLM.
Law firms and legal departments use AI for contract review, case research, and drafting. TapPass ensures confidential client data never reaches the model unprotected.
The risks of ungoverned AI in legal practice
Privileged information in prompts
Your contract review agent sends client agreements, including party names and deal terms, to an external LLM. Privilege may be waived.
Cross-client contamination
An associate uses the same AI tool for client A (acquiring) and client B (target). The model's context window leaks deal information between adverse parties.
Opposing counsel injection
A document from opposing counsel contains hidden instructions that manipulate your AI's contract analysis. Favourable terms flagged as risky.
No audit trail for AI-assisted work
Courts increasingly require disclosure of AI use. Without logging, you can't prove what the AI contributed to a brief.
Associates using consumer AI
Junior associates paste client documents into ChatGPT. No governance, no policy enforcement, no way to know it happened.
Unbounded AI costs per matter
AI agents making hundreds of LLM calls per case with no budget controls. Client billing disputes follow.
Runtime governance for legal AI
Client data protection
Detect and redact client names, case numbers, party names, and financial terms before reaching the LLM.
Matter-level isolation
Session-scoped taint tracking ensures client A's data never bleeds into client B's AI session.
AI disclosure audit trail
Hash-chained, tamper-evident logs of every AI interaction. Prove what the AI contributed and whether human review occurred.
Firm-wide governance
Route all AI tools through a single governance layer. Associates keep using Copilot or ChatGPT, but every call is governed.
Document injection defence
Scan incoming documents for hidden instructions before your AI processes them.
Per-matter cost tracking
Track AI costs per agent, per matter, per attorney. Budget limits and alerts.
Privilege is not just a doctrine. It is a technical requirement.
Least privilege per tool, a human on the calls that deserve one, and a tamper-evident record of every allow, hold and block. Nothing on this page is a different product from the rest of TapPass — it is the same layer, with the thresholds your regulator already set.