[
 {
  "id": "casus",
  "name": "CASUS",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Switzerland (Google Cloud Zurich, europe-west6)",
   "score": 3,
   "source": "https://www.getcasus.com/security"
  },
  "inference": {
   "value": "CH + EU only: Google Vertex AI Belgium; Azure OpenAI Switzerland North & Sweden Central; zero data retention; no US inference",
   "score": 2,
   "source": "https://www.getcasus.com/security"
  },
  "cloud_act": {
   "value": "Swiss vendor, but storage and inference run on US-parent hyperscalers (Google, Microsoft)",
   "score": 1,
   "source": "https://www.getcasus.com/security",
   "judgment_call": true,
   "rationale": "Swiss vendor, but storage/inference on a US-parent hyperscaler that can be compelled under the Cloud Act."
  },
  "secrecy_321": {
   "value": "Terms of Service recognise CASUS and staff as auxiliary persons (Art. 321 SCC); Hilfsperson status listed as contractual commitment",
   "score": 3,
   "source": "https://trust.getcasus.com/"
  },
  "dpa": {
   "value": "DPA listed in Trust Center; states revFADP compliance",
   "score": 3,
   "source": "https://trust.getcasus.com/"
  },
  "training": {
   "value": "No training or fine-tuning, by CASUS or model providers (contractual)",
   "score": 3,
   "source": "https://www.getcasus.com/security"
  },
  "certifications": {
   "value": "Infrastructure (Google Cloud, Azure) ISO 27001; no own certification stated",
   "score": 1,
   "source": "https://www.getcasus.com/"
  },
  "disclosed": "7/7",
  "total": 16
 },
 {
  "id": "ketl",
  "name": "Ketl",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Swiss datacentres in Geneva and Zurich, operated by Swiss companies",
   "score": 3,
   "source": "https://www.ketl.ch/en/about"
  },
  "inference": {
   "value": "Proprietary models developed, trained and hosted in Switzerland; no third-party LLM",
   "score": 3,
   "source": "https://www.ketl.ch/en/about"
  },
  "cloud_act": {
   "value": "Swiss vendor; Swiss infrastructure (Exoscale, Infomaniak) per vendor",
   "score": 3,
   "source": "https://www.ketl.ch/en/blogs/legal-ai-solutions-comparison",
   "judgment_call": true,
   "rationale": "Swiss company on Swiss-owned infrastructure with no US LLM in the chain, per vendor statements; not independently audited."
  },
  "secrecy_321": {
   "value": "Claims Art. 321 SCC compliance 'built into technical architecture'; no contractual auxiliary-person term found",
   "score": 2,
   "source": "https://www.ketl.ch/en/about"
  },
  "dpa": {
   "value": "not disclosed",
   "score": null,
   "source": null
  },
  "training": {
   "value": "not disclosed",
   "score": null,
   "source": null
  },
  "certifications": {
   "value": "No vendor certification stated; host Infomaniak is ISO 27001",
   "score": 1,
   "source": "https://www.infomaniak.com/en/trust-center"
  },
  "disclosed": "5/7",
  "total": 12
 },
 {
  "id": "rechtski",
  "name": "RechtsKI",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Exclusively in Switzerland (Safe Swiss Cloud)",
   "score": 3,
   "source": "https://www.rechtski.ch/en/legal-ai-comparison/"
  },
  "inference": {
   "value": "Default: Microsoft Azure Switzerland North; Swiss LLM mode selectable per request",
   "score": 2,
   "source": "https://www.rechtski.ch/en/legal-ai-comparison/"
  },
  "cloud_act": {
   "value": "Default inference on Microsoft (US parent); Swiss-only mode optional",
   "score": 2,
   "source": "https://www.rechtski.ch/en/legal-ai-comparison/",
   "judgment_call": true,
   "rationale": "Storage is Swiss-owned, but default inference uses a US-parent cloud; exposure avoidable only by choosing Swiss LLM mode."
  },
  "secrecy_321": {
   "value": "General confidentiality: staff confidentiality commitments in TOMs; no auxiliary-person (Art. 321 SCC) term found",
   "score": 2,
   "source": "https://www.rechtski.ch/en/privacy-policy/",
   "quote": "\"Data protection and security policy, employee training, confidentiality commitments.\" (organisational measures)",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "DPA under FADP/GDPR offered \"if necessary\" per GTC; DPAs with own sub-processors per Art. 9 nDSG; customer DPA not published",
   "score": 2,
   "source": "https://www.rechtski.ch/en/terms-and-conditions/",
   "quote": "\"Processing of personal data occurs according to the privacy policy and – if necessary – based on a DPA according to FADP/GDPR.\" (GTC); \"Data processing agreements per Art. 9 nDSG ... with Safe Swiss Cloud, Microsoft Azure and Google Firebase\" (data-protection page)",
   "quote_checked": "2026-10-17"
  },
  "training": {
   "value": "No AI training with customer data; Azure OpenAI contractually excludes training on customer data",
   "score": 3,
   "source": "https://www.rechtski.ch/en/data-protection/",
   "quote": "\"What we don't do: Use your data for AI training\" / \"No AI training with your data. Per Azure OpenAI contractual terms, customer data is not used to train models.\"",
   "quote_checked": "2026-10-17"
  },
  "certifications": {
   "value": "Infrastructure only: Safe Swiss Cloud ISO 27001; Azure/Firebase certifications listed; no own certification stated",
   "score": 1,
   "source": "https://www.rechtski.ch/en/privacy-policy/",
   "quote": "\"The platform runs on Safe Swiss Cloud's ISO 27001-certified infrastructure in Switzerland\"",
   "quote_checked": "2026-10-17"
  },
  "disclosed": "7/7",
  "total": 15
 },
 {
  "id": "swisslex",
  "name": "Swisslex AI",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Dedicated servers in Swiss data centres, accessible only to Swisslex",
   "score": 3,
   "source": "https://www.swisslex.ch/en/legal/privacy"
  },
  "inference": {
   "value": "Own servers in Switzerland, adapted open-source models; no data exchange with AI manufacturers",
   "score": 3,
   "source": "https://www.swisslex.ch/en/legal/ai"
  },
  "cloud_act": {
   "value": "Swiss vendor; no external AI provider per vendor",
   "score": 3,
   "source": "https://www.swisslex.ch/en/legal/ai",
   "judgment_call": true,
   "rationale": "Swiss company running own models on own Swiss servers; no US provider named in the AI chain."
  },
  "secrecy_321": {
   "value": "General confidentiality (staff confidentiality agreements); AGB s.7 tells users not to enter client data unless a function is intended for it; no auxiliary-person term",
   "score": 2,
   "source": "https://www.swisslex.ch/de/legal/agb",
   "quote": "\"...the Customer or the User ensures that, when using Swisslex, he does not process or make available any personal data, client data or other sensitive or confidential information, in particular as search entries, notes, annotations, dossier information or prompts.\" (AGB s.7); \"confidentiality agreements and controls\" (privacy policy)",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "not disclosed",
   "score": null,
   "source": null,
   "note": "No DPA offered or referenced; Swisslex acts as controller under its privacy policy and the AGB (s.7) ask users not to enter client data unless a function is intended for it.",
   "note_source": "https://www.swisslex.ch/de/legal/agb"
  },
  "training": {
   "value": "No training of AI models with user data",
   "score": 3,
   "source": "https://www.swisslex.ch/en/legal/ai"
  },
  "certifications": {
   "value": "not disclosed",
   "score": null,
   "source": null
  },
  "disclosed": "5/7",
  "total": 14
 },
 {
  "id": "weblaw",
  "name": "Weblaw Lawsearch AI",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Lawsearch Enterprise AI: Swiss cloud or the firm's own servers (on-premises)",
   "score": 3,
   "source": "https://weblaw.ch/community/newsatweblaw/2026/lawsearch--ki-recherche-mit-schweizer-datenschutz---weblaw.html",
   "note": "Stated for Lawsearch Enterprise AI (announcement of 28.09.2026); the product page does not state a default storage location.",
   "quote": "\"Lawsearch kann in einer Schweizer Cloud betrieben oder direkt auf den Servern Ihrer Kanzlei installiert werden.\" (news@weblaw, 28.09.2026)",
   "quote_checked": "2026-10-17"
  },
  "inference": {
   "value": "Default: OpenAI frontier models hosted on Microsoft Azure in Switzerland; customer may choose other models, incl. Swiss AI (Lawsearch Enterprise AI, per 28.09.2026 announcement)",
   "score": 2,
   "source": "https://weblaw.ch/community/newsatweblaw/2026/lawsearch--ki-recherche-mit-schweizer-datenschutz---weblaw.html",
   "quote": "\"Standardmässig arbeitet Lawsearch Enterprise AI in einem vollautomatischen Modus. Er nutzt die leistungsfähigsten Frontier-Modelle von OpenAI, gehostet bei Microsoft Azure in der Schweiz.\" / \"Sie wählen das Modell, das Ihre Fragen verarbeitet, auch Schweizer KI-Lösungen.\"",
   "note": "Stated for Lawsearch Enterprise AI (28.09.2026); the Lawsearch product page still only says \"Azure environment, OpenAI API\" without a region.",
   "quote_checked": "2026-10-17"
  },
  "cloud_act": {
   "value": "Swiss vendor; default AI on Microsoft Azure Switzerland (US parent); Swiss cloud, Swiss models or on-premises selectable",
   "score": 2,
   "source": "https://weblaw.ch/community/newsatweblaw/2026/lawsearch--ki-recherche-mit-schweizer-datenschutz---weblaw.html",
   "judgment_call": true,
   "rationale": "Default inference runs on a US-parent cloud in Switzerland; exposure avoidable by choosing Swiss models or on-premises operation.",
   "quote": "\"...Frontier-Modelle von OpenAI, gehostet bei Microsoft Azure in der Schweiz.\"",
   "quote_checked": "2026-10-17"
  },
  "secrecy_321": {
   "value": "not disclosed",
   "score": null,
   "source": null
  },
  "dpa": {
   "value": "not disclosed",
   "score": null,
   "source": null
  },
  "training": {
   "value": "not disclosed",
   "score": null,
   "source": null,
   "note": "A no-training statement (\"Ihre Daten nicht für das Training von KI-Modellen verwendet\") appeared on lawsearch.weblaw.ch in archived copies of 17 May and 9 June 2026, but is no longer on the current page.",
   "note_source": "https://web.archive.org/web/20260609210232/https://lawsearch.weblaw.ch/"
  },
  "certifications": {
   "value": "not disclosed",
   "score": null,
   "source": null
  },
  "disclosed": "3/7",
  "total": 7
 },
 {
  "id": "swiss-noxtua",
  "name": "Swiss-Noxtua",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Swiss T Cloud Public (T-Systems Schweiz AG, Zollikofen)",
   "score": 3,
   "source": "https://swiss-noxtua.ch/sicherheit/"
  },
  "inference": {
   "value": "Default Athena model processed in Switzerland; optional 'Minerva' routes to frontier models in EU or CH via named subprocessors",
   "score": 2,
   "source": "https://swiss-noxtua.ch/sicherheit/"
  },
  "cloud_act": {
   "value": "Default stack independent of US hyperscalers per vendor; Minerva option may use other providers",
   "score": 3,
   "source": "https://swiss-noxtua.ch/sicherheit/",
   "judgment_call": true,
   "rationale": "Vendor states default stack avoids US hyperscalers (T-Systems, German parent); Minerva option changes this."
  },
  "secrecy_321": {
   "value": "Terms bind provider, staff and subprocessors as Hilfspersonen under Art. 321 StGB",
   "score": 3,
   "source": "https://swiss-noxtua.ch/agb.html"
  },
  "dpa": {
   "value": "Acts as Auftragsbearbeiter under DSG and GDPR; processing terms in AGB",
   "score": 3,
   "source": "https://swiss-noxtua.ch/agb.html"
  },
  "training": {
   "value": "Inputs used only to fulfil the request, not for training",
   "score": 3,
   "source": "https://swiss-noxtua.ch/sicherheit/"
  },
  "certifications": {
   "value": "ISO 27001, 27017, 27018, 42001, BSI C5 listed for Noxtua (technology partner), not the Swiss entity",
   "score": 2,
   "source": "https://swiss-noxtua.ch/sicherheit/"
  },
  "disclosed": "7/7",
  "total": 19
 },
 {
  "id": "omnilex",
  "name": "Omnilex",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Microsoft Azure, Zurich",
   "score": 3,
   "source": "https://omnilex.ai/en-us"
  },
  "inference": {
   "value": "Switzerland and selected EU countries recognised by FDPIC",
   "score": 2,
   "source": "https://omnilex.ai/en-us"
  },
  "cloud_act": {
   "value": "Swiss vendor hosted on Microsoft (US parent)",
   "score": 1,
   "source": "https://omnilex.ai/en-us",
   "judgment_call": true,
   "rationale": "Swiss vendor, but storage/inference on a US-parent hyperscaler that can be compelled under the Cloud Act."
  },
  "secrecy_321": {
   "value": "States it acts as the firm's auxiliary person (Art. 101 CO), bound by Art. 321 SCC; confidentiality covered in licence agreement (agreement not public)",
   "score": 3,
   "source": "https://omnilex.ai/en/law-firms",
   "quote": "\"Omnilex acts as the firm's auxiliary person under Art. 101 CO and is thereby bound by professional secrecy under Art. 321 of the Swiss Criminal Code. Confidentiality is expressly covered in the licence agreement...\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "DPA template included in licence agreement (Trust Center)",
   "score": 2,
   "source": "https://trust.omnilex.ai/"
  },
  "training": {
   "value": "Training on customer data excluded by contract",
   "score": 3,
   "source": "https://omnilex.ai/en/government",
   "quote": "\"A data processing agreement is included in every licence. Training on your data is excluded by contract.\" / \"...is never used for training.\" (law-firms page)",
   "quote_checked": "2026-10-17"
  },
  "certifications": {
   "value": "ISO/IEC 27001:2022",
   "score": 3,
   "source": "https://trust.omnilex.ai/"
  },
  "disclosed": "7/7",
  "total": 17
 },
 {
  "id": "jurata",
  "name": "Jurata",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Switzerland, Microsoft Azure Switzerland North",
   "score": 3,
   "source": "https://www.jurata.ch/en/enterprise/sicherheit"
  },
  "inference": {
   "value": "Switzerland and EU (Azure), never in the USA; zero data retention at LLM provider",
   "score": 2,
   "source": "https://www.jurata.ch/en/enterprise/sicherheit"
  },
  "cloud_act": {
   "value": "Swiss vendor hosted on Microsoft (US parent)",
   "score": 1,
   "source": "https://www.jurata.ch/en/enterprise/sicherheit",
   "judgment_call": true,
   "rationale": "Swiss vendor, but storage/inference on a US-parent hyperscaler that can be compelled under the Cloud Act."
  },
  "secrecy_321": {
   "value": "Jurata engaged as Hilfsperson under Art. 321 StGB and expressly acknowledges secrecy (Walder Wyss opinion, 11 Aug 2026)",
   "score": 3,
   "source": "https://juratapublicassets.blob.core.windows.net/public-assets/documents/2026-08-11%20Kurzbesta%CC%88tigung%20Walder%20Wyss%20Berufsgeheimniskonformita%CC%88t%20Jurata%20Legal%20Agent.pdf"
  },
  "dpa": {
   "value": "DPA under Art. 9 DSG / Art. 28 GDPR concluded with customers (per opinion); DPA not public",
   "score": 2,
   "source": "https://juratapublicassets.blob.core.windows.net/public-assets/documents/2026-08-11%20Kurzbesta%CC%88tigung%20Walder%20Wyss%20Berufsgeheimniskonformita%CC%88t%20Jurata%20Legal%20Agent.pdf"
  },
  "training": {
   "value": "No use of data for training",
   "score": 3,
   "source": "https://www.jurata.ch/en/enterprise/sicherheit"
  },
  "certifications": {
   "value": "Runs on Microsoft Azure (ISO 27001, SOC 2 Type 2); own ISO 27001 underway, completion stated for Q4 2026",
   "score": 1,
   "source": "https://www.jurata.ch/en/enterprise/sicherheit",
   "quote": "\"The Jurata® Legal Agent runs on certified Cloud-Infrastructure from Microsoft Azure. Azure is certified according to ISO/IEC 27001:2022 and is independently audited according to SOC 2 Type 2. The ISO 27001 certification of Jurata Ltd is underway and will be completed in Q4 2026.\"",
   "quote_checked": "2026-10-17"
  },
  "disclosed": "7/7",
  "total": 15
 },
 {
  "id": "silex",
  "name": "Silex",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Infomaniak, Geneva (Swiss-owned), incl. backups; no client data stored on Azure",
   "score": 3,
   "source": "https://silex.legal/en/security"
  },
  "inference": {
   "value": "Self-hosted LLMs on Azure Switzerland North (ephemeral); no data sent to external AI providers",
   "score": 3,
   "source": "https://silex.legal/en/security"
  },
  "cloud_act": {
   "value": "Data at rest on Swiss-owned Infomaniak; inference on Azure Switzerland North; vendor acknowledges residual CLOUD Act exposure during in-memory inference, Swiss GPUs planned for 2027",
   "score": 2,
   "source": "https://silex.legal/de/datenschutzrichtlinie",
   "judgment_call": true,
   "rationale": "Data at rest on Swiss-owned Infomaniak, but processing runs on a US-parent cloud (Azure).",
   "quote": "\"Die LLM-Inferenz erfordert ein temporäres Entschlüsselungsfenster im Arbeitsspeicher, während dessen eine Restexposition gegenüber dem US CLOUD Act besteht; eine Migration auf Schweizer GPUs ist für 2027 geplant\"",
   "quote_checked": "2026-10-17"
  },
  "secrecy_321": {
   "value": "Contractual confidentiality expressly covering information protected by Art. 321 SCC and the LLCA, extended to staff and sub-processors; no auxiliary-person status term",
   "score": 2,
   "source": "https://silex.legal/conditions-generales-dutilisation",
   "quote": "\"La Société s'engage expressément à traiter de manière strictement confidentielle toutes les informations ... y compris ... les informations protégées par le secret professionnel de l'avocat, conformément à l'article 321 du Code pénal suisse (CP) et aux dispositions applicables de la LLCA.\" (CGU 13.2)",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "DPA agreed with customers (referenced in CGU, sub-processors in its Annex A); acts as processor under the DSG; DPA not public",
   "score": 2,
   "source": "https://silex.legal/conditions-generales-dutilisation",
   "quote": "\"Les CGU sont complétées par la Politique de confidentialité ainsi que, le cas échéant, le Data Processing Agreement (DPA) ...\" (CGU); \"handeln wir grundsätzlich als Auftragsbearbeiterin Ihrer Organisation\" (Datenschutzrichtlinie)",
   "quote_checked": "2026-10-17"
  },
  "training": {
   "value": "User data never trains or fine-tunes the models",
   "score": 3,
   "source": "https://silex.legal/en/security"
  },
  "certifications": {
   "value": "ISO 27001 in progress, targeted Q3 2026 (not yet certified per page)",
   "score": 1,
   "source": "https://silex.legal/en/security"
  },
  "disclosed": "7/7",
  "total": 16
 },
 {
  "id": "deepjudge",
  "name": "DeepJudge",
  "hq": "CH",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Choice of DeepJudge cloud, customer cloud or on-premises",
   "score": 3,
   "source": "https://www.deepjudge.ai/security"
  },
  "inference": {
   "value": "Choice of AI model and residency; default not stated",
   "score": 2,
   "source": "https://www.deepjudge.ai/security"
  },
  "cloud_act": {
   "value": "Depends on deployment; on-prem option available",
   "score": 2,
   "source": "https://www.deepjudge.ai/security",
   "judgment_call": true,
   "rationale": "Exposure depends on customer's chosen hosting and model; on-prem can avoid US providers."
  },
  "secrecy_321": {
   "value": "Mutual confidentiality clause in Terms of Service; no auxiliary-person (Art. 321 SCC) term found",
   "score": 2,
   "source": "https://www.deepjudge.ai/terms",
   "quote": "\"Recipient will treat as confidential and will not use (other than for the purposes set forth herein) or disclose to any third party any Confidential Information of Discloser except as expressly permitted by Discloser in writing in advance.\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Public DPA incorporated into the terms; names the Swiss Federal Data Protection Act (definitions still cite the 1992 Act)",
   "score": 3,
   "source": "https://www.deepjudge.ai/dpa",
   "quote": "\"...the Swiss Federal Data Protection Act ('Swiss DPA')\" / \"where the Swiss Federal Act on Data Protection of June 19, 1992, applies...\"",
   "quote_checked": "2026-10-17"
  },
  "training": {
   "value": "Does not train on customer data",
   "score": 3,
   "source": "https://www.deepjudge.ai/security"
  },
  "certifications": {
   "value": "SOC 2 Type II and ISO 27001",
   "score": 3,
   "source": "https://www.deepjudge.ai/security"
  },
  "disclosed": "7/7",
  "total": 18
 },
 {
  "id": "harvey",
  "name": "Harvey",
  "hq": "US",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Azure; in-region option EU or Switzerland",
   "score": 2,
   "source": "https://www.harvey.ai/security"
  },
  "inference": {
   "value": "EU/CH processing option applies to subprocessors; Anthropic listed US-only (may be reached via Bedrock/Vertex)",
   "score": 2,
   "source": "https://www.harvey.ai/legal/subprocessors"
  },
  "cloud_act": {
   "value": "US vendor (Harvey AI Corp) and US subprocessors",
   "score": 0,
   "source": "https://www.harvey.ai/legal/subprocessors",
   "judgment_call": true,
   "rationale": "US-domiciled vendor, directly subject to the Cloud Act regardless of data location."
  },
  "secrecy_321": {
   "value": "Mutual confidentiality clause (Terms s.11.6); no auxiliary-person (Art. 321 SCC) term found",
   "score": 2,
   "source": "https://www.harvey.ai/legal/terms-of-service",
   "quote": "\"Each party (as the 'Receiving Party') will use the same degree of care that it uses to protect the confidentiality of its own confidential information of like kind (but not less than reasonable care)...\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Security Addendum; Swiss-U.S. DPF certified",
   "score": 2,
   "source": "https://www.harvey.ai/legal/privacy-policy"
  },
  "training": {
   "value": "No training, contractual; ZDR required of model providers",
   "score": 3,
   "source": "https://www.harvey.ai/security"
  },
  "certifications": {
   "value": "SOC 2 Type II, ISO 27001, 27701, 42001",
   "score": 3,
   "source": "https://www.harvey.ai/security"
  },
  "disclosed": "7/7",
  "total": 14
 },
 {
  "id": "legora",
  "name": "Legora (incl. former Leya)",
  "hq": "SE",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "EU/EEA region (Microsoft Ireland hosting) selectable",
   "score": 2,
   "source": "https://legora.com/legal/eu-pre-approved-sub-processors"
  },
  "inference": {
   "value": "EU/EEA subprocessors incl. Microsoft and OpenAI Ireland; processing outside EU needs consent",
   "score": 2,
   "source": "https://legora.com/legal/eu-data-processing-agreement"
  },
  "cloud_act": {
   "value": "Swedish vendor; US-parent subprocessors (Microsoft, AWS, Google, OpenAI)",
   "score": 1,
   "source": "https://legora.com/legal/eu-pre-approved-sub-processors",
   "judgment_call": true,
   "rationale": "Non-US vendor, but key subprocessors are EU subsidiaries of US companies."
  },
  "secrecy_321": {
   "value": "Confidentiality clause covering Subscriber Content, surviving indefinitely (EU GTC cl. 7); DPA acknowledges law-firm confidentiality rules; no auxiliary-person term",
   "score": 2,
   "source": "https://legora.com/legal/eu-general-terms-and-conditions",
   "quote": "\"'Confidential Information' means all information disclosed by a Party ... (ii) Subscriber Content...\" / \"...in relation to any Confidential Information which comprises Subscriber Content, indefinitely or, at a minimum 100 years.\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "EU DPA published (GDPR)",
   "score": 2,
   "source": "https://legora.com/legal/eu-data-processing-agreement"
  },
  "training": {
   "value": "Will not use data to train or fine-tune any AI models",
   "score": 3,
   "source": "https://legora.com/security"
  },
  "certifications": {
   "value": "ISO/IEC 27001:2022 (audited yearly); SOC 2 requirements claimed",
   "score": 3,
   "source": "https://legora.com/legal/security-measures"
  },
  "disclosed": "7/7",
  "total": 15
 },
 {
  "id": "spellbook",
  "name": "Spellbook",
  "hq": "CA",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Canada and US (AWS ca-central-1)",
   "score": 0,
   "source": "https://spellbook.com/security"
  },
  "inference": {
   "value": "OpenAI and Anthropic with zero data retention",
   "score": 1,
   "source": "https://spellbook.com/security"
  },
  "cloud_act": {
   "value": "US model providers and AWS",
   "score": 0,
   "source": "https://spellbook.com/llms.txt",
   "judgment_call": true,
   "rationale": "Data stored/processed in the US and by US providers; no EU/CH option stated."
  },
  "secrecy_321": {
   "value": "Terms acknowledge lawyer-client privilege and treat customer data as Confidential Information; no Swiss auxiliary-person term",
   "score": 2,
   "source": "https://spellbook.com/legal/terms-of-service",
   "quote": "\"The Parties acknowledge that Customer Data may include information protected by lawyer-client privilege ... Spellbook will handle all Privileged Information in a manner intended to preserve these protections...\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Processing terms built into the Terms of Service (sub-processors listed in trust center); GDPR listed in trust center; no standalone customer DPA or FADP reference found",
   "score": 2,
   "source": "https://spellbook.com/legal/terms-of-service",
   "quote": "\"Spellbook complies with all Privacy/Security Laws that are applicable specifically to Spellbook, the Services, this Agreement, and generally to data processors in the jurisdictions in which Spellbook does business.\"",
   "quote_checked": "2026-10-17"
  },
  "training": {
   "value": "Third-party LLMs contractually barred from training on customer data",
   "score": 3,
   "source": "https://spellbook.com/legal/terms-of-service"
  },
  "certifications": {
   "value": "SOC 2 Type II, SOC 3",
   "score": 3,
   "source": "https://spellbook.com/llms.txt"
  },
  "disclosed": "7/7",
  "total": 11
 },
 {
  "id": "clio",
  "name": "Clio (Duo / Work)",
  "hq": "CA",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Hosting choice incl. Europe (AWS EU)",
   "score": 2,
   "source": "https://www.clio.com/security/"
  },
  "inference": {
   "value": "AI processed in customer's region per Clio; AI subprocessors AWS Bedrock, OpenAI, Google, Azure (US/EU) but Anthropic listed US-only",
   "score": 1,
   "source": "https://www.clio.com/tos/subprocessors/"
  },
  "cloud_act": {
   "value": "Canadian vendor; US-parent AI and hosting subprocessors",
   "score": 1,
   "source": "https://www.clio.com/tos/subprocessors/",
   "judgment_call": true,
   "rationale": "Non-US vendor but relies on US-parent AI/cloud providers, one listed US-only."
  },
  "secrecy_321": {
   "value": "Mutual confidentiality clause (Terms s.4.1); no auxiliary-person (Art. 321 SCC) term found",
   "score": 2,
   "source": "https://www.clio.com/tos/",
   "quote": "\"4.1 Each party agrees to treat all Confidential Information as confidential and not to use or disclose such Confidential Information except as necessary to perform its obligations or exercise its rights under this Agreement.\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Themis Data Processing Addendum; GDPR compliance stated",
   "score": 2,
   "source": "https://www.clio.com/tos/subprocessors/"
  },
  "training": {
   "value": "No training of generalised LLMs on confidential information, but Terms allow de-identified, aggregated content and outputs to improve Clio's AI services",
   "score": 2,
   "source": "https://www.clio.com/tos/",
   "quote": "\"14.6 Themis may de-identify and aggregate the Content submitted to, and Output received from, AI Services and use the same in order to improve and ensure the quality of the AI Services. Subscriber's use of AI Services does not grant Themis the right to use any of Subscriber's Confidential Information for the purpose of training generalized LLMs.\" (Terms effective 4 Aug 2026)",
   "quote_checked": "2026-10-17"
  },
  "certifications": {
   "value": "Annual SOC 2 Type II and SOC 1 Type II",
   "score": 3,
   "source": "https://www.clio.com/security/"
  },
  "disclosed": "7/7",
  "total": 13
 },
 {
  "id": "m365-copilot",
  "name": "Microsoft 365 Copilot",
  "hq": "US",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "EU Data Boundary (includes Switzerland)",
   "score": 2,
   "source": "https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn"
  },
  "inference": {
   "value": "EU Data Boundary; flex routing can process outside (US, CA, AU) unless disabled",
   "score": 1,
   "source": "https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-ongoing-partial-transfers"
  },
  "cloud_act": {
   "value": "US vendor",
   "score": 0,
   "source": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy",
   "judgment_call": true,
   "rationale": "US-domiciled vendor, directly subject to the Cloud Act."
  },
  "secrecy_321": {
   "value": "General contractual commitment: data used only as the customer instructs (DPA/Product Terms); no auxiliary-person term",
   "score": 2,
   "source": "https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection",
   "quote": "\"Your data is private: We won't use your data except as you instruct.\" / \"...prompts and responses are protected by the same contractual terms and commitments ... for their emails in Exchange and their files in SharePoint.\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Covered by the public Microsoft Products and Services DPA (Microsoft as processor); a Switzerland amendment applies the DPA to the FADP once accepted",
   "score": 3,
   "source": "https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection",
   "quote": "\"The use of Microsoft Copilot and Microsoft Copilot Chat, as used by organizations, is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor.\" Secondary (Swisscom-hosted copy of Microsoft's amendment, MCAgrAmd April 2023): \"References in the DPA to the GDPR shall be deemed to be references also to Swiss data protection law...\"",
   "secondary_source": "https://documents.swisscom.com/product/filestore/lib/de95076e-1e01-456f-b5f1-54d60ebd5602/dataprotectionaddendumswitzerland-en.pdf",
   "judgment_call": true,
   "rationale": "Base DPA is public but GDPR-centred; the FADP is named in Microsoft's Switzerland amendment (April 2023 version, copy hosted by Swisscom), which must be accepted separately.",
   "quote_checked": "2026-10-17",
   "secondary_label": "secondary source (third-party copy of a vendor document)"
  },
  "training": {
   "value": "Prompts, responses and Graph data not used to train foundation LLMs",
   "score": 3,
   "source": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
  },
  "certifications": {
   "value": "Microsoft Copilot lists ISO 27001 and ISO 42001 among its certifications; Microsoft 365 ISO 27001:2022 certificate (2024-2027)",
   "score": 3,
   "source": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy",
   "quote": "\"Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.\"",
   "quote_checked": "2026-10-17"
  },
  "disclosed": "7/7",
  "total": 14
 },
 {
  "id": "luminance",
  "name": "Luminance",
  "hq": "UK",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "Customer-selected AWS region, backups in same region",
   "score": 2,
   "source": "https://www.luminance.com/legal/technical-organisational-measures"
  },
  "inference": {
   "value": "Core: not sent to external model provider; optional generative features via Azure/Google/OpenAI, location set by customer",
   "score": 2,
   "source": "https://www.luminance.com/legal/subprocessors"
  },
  "cloud_act": {
   "value": "UK vendor on AWS; optional US-parent AI providers",
   "score": 1,
   "source": "https://www.luminance.com/legal/subprocessors",
   "judgment_call": true,
   "rationale": "Non-US vendor, but hosted on AWS with optional US-parent AI providers."
  },
  "secrecy_321": {
   "value": "Mutual confidentiality clause (Master Agreement cl. 13); no auxiliary-person term",
   "score": 2,
   "source": "https://www.luminance.com/legal/master-agreement",
   "quote": "\"13.1 Each Party will treat the other Party's Confidential Information as confidential.\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Public DPA (GDPR, Art. 28) incorporated into the Master Agreement; Swiss-U.S. DPF certification; FADP not named",
   "score": 2,
   "source": "https://www.luminance.com/legal/data-processing-addendum",
   "quote": "\"Luminance has certified to the United States Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles...\"; Master Agreement 14.1: \"...the Parties shall comply with the Data Processing Addendum, which is incorporated into the Agreement by reference\"",
   "quote_checked": "2026-10-17"
  },
  "training": {
   "value": "Licence to use customer data for product improvement/private learning; usage insights exclude confidential info",
   "score": 2,
   "source": "https://www.luminance.com/legal/master-agreement"
  },
  "certifications": {
   "value": "ISO/IEC 27001 (certificate on request)",
   "score": 3,
   "source": "https://www.luminance.com/legal/technical-organisational-measures"
  },
  "disclosed": "7/7",
  "total": 14
 },
 {
  "id": "lexis-ai",
  "name": "Lexis+ AI / Protégé",
  "hq": "UK/US (RELX)",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "AWS hosting in several regions incl. France, Germany, Ireland, UK; \"local data hosting\" stated for Europe incl. UK; region assigned to Swiss customers not stated",
   "score": 2,
   "source": "https://www.lexisnexis.com/global/privacy/en/subprocessor.page",
   "quote": "Lexis+ AI (file uploads): \"Amazon Web Services, Inc. | Host Provider/Data center | Australia, Canada, France, Germany, Ireland, UK, USA\"; product page: \"Local data hosting\"",
   "note": "The sub-processor list is global and does not say which region a Swiss customer is assigned.",
   "quote_checked": "2026-10-17"
  },
  "inference": {
   "value": "Product page: models process data in the local region (Europe incl. UK); global sub-processor list shows Anthropic (USA), OpenAI (USA) and Google (Global) for Lexis+ AI file uploads",
   "score": 1,
   "source": "https://www.lexisnexis.com/global/privacy/en/subprocessor.page",
   "quote": "Lexis+ AI (file uploads): \"Anthropic PBC | Host Provider/Data Center/AI Functionality | USA\" ... \"OpenAI, LLC | ... | USA\" ... \"Google LLC | ... | Global*\"",
   "quote_checked": "2026-10-17"
  },
  "cloud_act": {
   "value": "RELX group (UK parent) on AWS and US AI providers; US affiliates (RELX Inc.) listed for data-centre operations",
   "score": 1,
   "source": "https://www.lexisnexis.com/global/privacy/en/subprocessor.page",
   "judgment_call": true,
   "rationale": "UK-parented vendor, but hosting and AI providers are US-parent companies and US affiliates provide data-centre operations; confirm the contracting entity.",
   "quote": "\"Affiliates provide data center operations, service maintenance, and/or technical and customer support and include: LexisNexis, a division of RELX Inc. [United States] ...\"",
   "quote_checked": "2026-10-17"
  },
  "secrecy_321": {
   "value": "General confidentiality claim for client and firm work; DPA requires confidentiality of authorised staff; no auxiliary-person term",
   "score": 2,
   "source": "https://www.lexisnexis.co.uk/solutions/protege-general-ai.html",
   "quote": "\"All activity remains within LexisNexis with enterprise grade safeguards and no data used to train public models. This provides confidentiality for client and firm work.\"",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Public LexisNexis DPA with Swiss transfer terms: GDPR references read as the FADP, FDPIC as authority",
   "score": 3,
   "source": "https://www.lexisnexis.com/global/privacy/en/processor-terms.page",
   "quote": "\"In relation to transfers of personal data from Switzerland ... references to 'Regulation (EU) 2016/679' shall be interpreted as references to the Swiss Federal Act on Data Protection ('FADP')\"",
   "quote_checked": "2026-10-17"
  },
  "training": {
   "value": "Does not train or fine-tune AI models on customer data",
   "score": 3,
   "source": "https://trust.lexisnexis.com/"
  },
  "certifications": {
   "value": "SOC 2 Type 2 and ISO/IEC 27001 listed",
   "score": 3,
   "source": "https://trust.lexisnexis.com/"
  },
  "disclosed": "7/7",
  "total": 15
 },
 {
  "id": "cocounsel",
  "name": "CoCounsel (Thomson Reuters)",
  "hq": "CA/US",
  "date_checked": "2026-10-17",
  "storage": {
   "value": "US standard; region-based hosting in UK, Australia, Canada; no EU region stated",
   "score": 0,
   "source": "https://www.thomsonreuters.com/en/cocounsel"
  },
  "inference": {
   "value": "OpenAI GPT and Google Gemini interactions processed in the U.S.",
   "score": 0,
   "source": "https://www.thomsonreuters.com/en/cocounsel"
  },
  "cloud_act": {
   "value": "US processing by US providers",
   "score": 0,
   "source": "https://www.thomsonreuters.com/en/cocounsel",
   "judgment_call": true,
   "rationale": "Prompts processed in the US by US providers per vendor."
  },
  "secrecy_321": {
   "value": "General confidentiality: Data Security Addendum commits to protect confidentiality of customer data; DPA binds staff to confidentiality; no auxiliary-person term",
   "score": 2,
   "source": "https://www.thomsonreuters.com/content/dam/ewp-m/documents/thomsonreuters/en/pdf/information-security/tr-data-security-addendum-november-2023.pdf",
   "quote": "\"...protect the confidentiality and integrity of Your Data hosted in the Services...\" (Data Security Addendum); \"Personal Data are subject to a duty of confidentiality\" (DPA)",
   "quote_checked": "2026-10-17"
  },
  "dpa": {
   "value": "Public Thomson Reuters DPA v3 (effective 1 Feb 2025; GDPR/CCPA) with Swiss-U.S. DPF; FADP not named",
   "score": 2,
   "source": "https://www.thomsonreuters.com/content/dam/ewp-m/documents/thomsonreuters/en/pdf/gdpr/global-customer-data-processing-addendum-updated-february.pdf",
   "quote": "\"'Applicable Data Protection Law' means ... which may include: (a) the General Data Protection Regulation ... and/or (b) the California Consumer Privacy Act...\" / \"...the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF)...\"",
   "quote_checked": "2026-10-17"
  },
  "training": {
   "value": "Not used to train CoCounsel or LLMs, not stored by OpenAI/Google",
   "score": 3,
   "source": "https://www.thomsonreuters.com/en/cocounsel"
  },
  "certifications": {
   "value": "Thomson Reuters ISO/IEC 27001:2022 certificate (CERT-002113, valid to 2028-10-05) lists CoCounsel Essentials (Core, Drafting, Knowledge Search) in scope; CoCounsel Legal not named in scope",
   "score": 3,
   "source": "https://www.thomsonreuters.com/content/dam/ewp-m/documents/thomsonreuters/en/pdf/information-security/tr-iso27001-certificate-002113.pdf",
   "quote": "\"ISO/IEC 27001:2022 ... Certificate No.: CERT-002113 ... Valid until 2028-10-05 ... Products within the scope: ... CoCounsel Essentials (CoCounsel Core, CoCounsel Drafting, CoCounsel Knowledge Search)\"",
   "note": "The certificate names CoCounsel Essentials modules; CoCounsel Legal is not named in the scope. SOC reports require a Thomson Reuters account.",
   "quote_checked": "2026-10-17"
  },
  "disclosed": "7/7",
  "total": 10
 }
]