Which AI tools for law firms say they don't train on client data?

51 of the 125 tools in this directory post a statement on their own site that client or customer data is not used to train AI models and name a security standard such as SOC 2 Type II or ISO 27001. That is what the Confidentiality column on every listing records: "Yes" means both the statement and the standard were found on the vendor's site when we checked on October 31, 2026, and "Not posted" means we did not find both. Every category except Client Intake, Lead Response & AI Receptionists and Immigration & Forms Automation has at least one tool marked Yes, and all six tools in Contract Review & Drafting AI are.

The list, by category

• AI Legal Research (8 of 11): Alexi (SOC 2), CaseMine (ISO/IEC 27001:2022), Clio Work (SOC 2 Type II, ISO 27001), CoCounsel Legal (SOC 2, ISO 42001), Lexis+ AI (SOC 2 Type 2, ISO/IEC 27001), Paxton (SOC 2, ISO 27001), Vincent AI (SOC 2, ISO 27001) and Westlaw (SOC 2).
• Contract Review & Drafting AI (6 of 6): Gavel Exec, Law Insider SimpleAI, LegalOn, Lexis Create+, Macro and Spellbook, all naming SOC 2.
• Document Automation & Assembly (4 of 8): Clio Draft (SOC 2 Type II), Gavel (SOC 2 Type II), Legito (ISO/IEC 27001) and Luminary (SOC 2 Type II).
• Practice Management & Workflow with AI (6 of 10): CASEpeer (SOC 2 Type 2), Clio Manage (SOC 2 Type II), CosmoLex (SOC 2 Type II), MyCase (SOC 2 Type 2), Neos (SOC 2 Type II) and Smokeball (ISO 27001:2022).
• eDiscovery & Document Review AI (4 of 9): Everlaw (SOC 2 Type 2, ISO/IEC 27001:2022), Logikcull (SOC 2 Type II), Nextpoint (SOC 2 Type II) and Reduct (SOC 2 Type II).
• Litigation Analytics, Depositions & Case Prep (7 of 13): Briefpoint (SOC 2 Type II), Clearbrief (SOC 2 Type II), Esquire Intelligent Summary+ (SOC 2 Type II, ISO 27001:2013), Lexitas Deposition Insights (HIPAA, SOC 2), Parrot by Filevine (SOC 2 Type II), SmartDepo (SOC 2 Type II) and Steno Transcript Genius (SOC 2 Type II).
• Medical Records, Demand Letters & Personal-Injury Tools (6 of 15): Anytime AI (HIPAA; controls aligned with SOC 2 Type II), Asabell by Compex (SOC 2 Type II, HIPAA), InPractice (HIPAA), Neos Demands Plus (SOC 2 Type II), Supio (SOC 2 Type II) and U.S. Legal Support RecordSummary Pro (SOC 2 Type 2, HIPAA).
• Billing, Timekeeping & Trust Accounting with AI (1 of 4): Ajax (SOC 2 Type II).
• Legal Marketing, Websites & Lead Generation (1 of 10): Birdeye (SOC 2 Type II, ISO/IEC 27001).
• Transcription, Dictation & Meeting Notes (3 of 10): Philips SpeechLive (ISO 27001), Rev (SOC 2 Type II) and Sonix Legal (SOC 2 Type II).
• Knowledge Management & Firm AI Assistants (5 of 9): Archie AI (ISO 27001:2022), CaseMark Para (SOC 2 Type II, HIPAA), Clio Duo (SOC 2 Type II), MyCase IQ (SOC 2 Type II) and NetDocuments ndMAX (SOC 2 Type 2).

How to read "Not posted"

"Not posted" means one thing: when we read the vendor's site in October 2026, we did not find both a statement that client data is not used to train models and a named security standard on the pages we reached. It is not a finding that a vendor trains on client data. Several vendors marked Not posted do name a standard — Lawmatics, Hona and Filevine, for example, post SOC 2 but we found no statement about training — and a vendor may make the commitment in a contract or data processing agreement rather than on a public page. This directory records only what is posted; each listing's Security standard line shows what was found, and the vendor's own site is the place to confirm either.

Quick answers

Do all practice management platforms post a no-training statement?

Six of the ten in Practice Management & Workflow with AI do: Clio Manage (from $49/user/mo), MyCase (from $50/user/mo billed annually), CosmoLex (from $49/user/mo), Smokeball (quote-based), CASEpeer (from $90/user/mo) and Neos (from $109/user/mo billed yearly).

Which AI receptionists post a no-training statement?

The Confidentiality column reads Not posted for all 17 tools in Client Intake, Lead Response & AI Receptionists, which means we did not find a posted no-training statement with a named standard; it is not a finding about what any vendor does. Several, including Hona, Sona by Quo and Lawmatics, post a SOC 2 statement on the pages we read.

Which research tools name both a no-training statement and SOC 2?

Alexi ($499 a month), Westlaw (from $170.95/mo), Paxton ($499/user/mo), Clio Work, CoCounsel Legal, Lexis+ AI and Vincent AI, the last four quote-based; CaseMine (from $49/mo) names ISO/IEC 27001:2022 instead.