Is AI safe for a law firm? Here is exactly where your client files go.
Case AI is a private AI workspace for small law firms. It runs Claude, made by Anthropic, inside S2Reason's own Amazon Web Services (AWS) account. Your files are never used to train AI, Amazon Bedrock keeps no copy of your questions or the AI's answers, and your files stay until your firm deletes them.
The short answer.
AI is safe for client files when three things are true: the AI company does not learn from your files, you know where the files are kept, and you can show what went in. Case AI is built on all three, and each AI use report puts the setup in writing.
- No training. Your files, questions and answers are never used to train AI.
- One known place. Your files and chats stay in S2Reason's AWS account in the United States.
- A record you can show. Each case has an upload list and a one-click AI use report.
Where your files go.
Your files go into S2Reason's own AWS account and nowhere else. The AI runs on Amazon Bedrock in that same account. Pages with no text layer, such as scans, are read by Amazon Textract in that account too. Textract keeps the result of each page-reading job, encrypted, for up to 7 days.
AWS covers Bedrock, Textract and the storage Case AI uses with its own Business Associate Agreement (BAA) with us. AWS lists each of them as HIPAA eligible.
The AI does not learn from your files.
AWS states that Amazon Bedrock does not use your questions or the AI's answers to train AI models, and does not share them with Anthropic, the model's maker. Our AWS account is also set so that Bedrock writes none of your questions or answers to storage.
We have also turned off AWS's option to use document pages to improve its own AI services, for our whole AWS organization.
How your files are protected.
- Encrypted in transit. Connections to the app use TLS 1.3, and the file store refuses any connection without encryption.
- Encrypted at rest. Each firm's files are encrypted with a separate key used only for that firm, and the database that holds chats is encrypted too.
- Your firm only. Every request checks that the case belongs to the firm asking for it.
- Logs hold no case details. Our system logs never record file names, questions or record text.
Who can see your work.
Everyone in your firm sees every case, so your team works from the same files. At S2Reason, staff can read the questions your team asks, on one staff-only page inside our own AWS account, to support and improve Case AI. In the ordinary course they do not open your files or read the AI's answers. They never use them to train AI. The AI Data Protection Addendum, which any firm can ask for, states this in writing. About the BAA and the Addendum.
How long we keep your files.
Your files, chats and documents stay until your firm deletes them. Nothing is deleted because of its age. Your firm can delete a file, a chat or a whole case at any time, or archive it to hide it without deleting it.
| What happens | When your data is deleted |
|---|---|
| Your firm deletes a file, chat or case | Right away in the app |
| Your plan ends | 104 days later (14 days of full access, then 90 days to read and download) |
| Your firm closes its account | 30 days later |
| Encrypted database backups | Up to 7 days after a delete |
| Textract page-reading results | Up to 7 days |
Before your plan ends, we email your firm's account owners once, 30 days before their files are deleted, so you can download what you need.
The upload list for each case (file name, page count, who uploaded it and when, and when it was deleted) stays after you delete a file, so your firm can still show what went in. It is deleted 30 days after your firm closes its account.
A record you can show a judge.
Each case has a one-click AI use report: a PDF that lists every file uploaded to the case, who uploaded it and when, and explains the AI setup in plain words for a court or a client. It lists files only, never your chats or questions.
Companies that handle your data.
| Company | What it does for Case AI | What it sees |
|---|---|---|
| Amazon Web Services | Stores files, runs the AI (Amazon Bedrock), reads scanned pages (Amazon Textract), sends account emails | Your case files, inside S2Reason's account, under the AWS BAA |
| Anthropic | Makes Claude, the AI model | Nothing. It has no access to your questions or answers |
| Stripe | Takes card payments | Your firm's billing details, plan and amounts only, never case files |
When web search is on, the AI is instructed to write short search phrases with no client, patient or party names, and they go to AWS's web search tool. It searches only a fixed list of reliable legal sources, and your files are never sent to it. For firms with a BAA, web search is off unless they ask for it, because AWS has not confirmed in writing that this tool is covered by its BAA.
What we do not claim.
- We do not say nothing is stored. Case AI keeps your files and chats for your firm, until you delete them. Only Amazon Bedrock keeps no copy.
- We do not say deletion is instant everywhere. Backups and Textract results can last up to 7 days.
- We do not promise court protection. Case AI gives you a record of what went in. Whether your use meets a court order or a rule is your firm's call.
- We do not replace your judgment. The AI can be wrong, and it can miss a page. Its answers cite the pages they rely on so you can check them, and you stay responsible for what you file.