Encryption at rest refers to the protection of stored data through cryptographic encoding, so that files, databases, and backups on storage media are unreadable without the appropriate decryption key — a baseline security control required for legal AI tools handling confidential client information.
Last reviewed: 2026/05/19
An audit log is a chronological, tamper-evident record of system activities — including user logins, document accesses, queries, and configuration changes — that enables security monitoring, compliance verification, and investigation of incidents in legal AI environments.
SecurityIn the legal AI context, confidentiality refers to the obligation of lawyers and legal AI vendors to protect client information from unauthorized disclosure, and to the technical and contractual measures that implement that protection when client data is processed by AI systems.
SecuritySOC 2 (Service Organization Control 2) is an independent audit framework that evaluates a service provider's security, availability, processing integrity, confidentiality, and privacy controls — commonly cited by legal AI vendors as evidence of their data security practices.
SecurityZero retention is a data handling policy under which an AI tool vendor does not store or retain any client-submitted content after the active processing session ends, ensuring that confidential information is not persisted on the vendor's servers.
The most expensive legal AI in the market — Am Law 100 firms only.
Practice management for 150K+ lawyers with native Manage AI for admin automation.
Cloud eDiscovery with AI predictive coding and document summarization.
Purpose-built US legal AI covering research, drafting, and compliance.
Move from this definition to role-based legal AI shortlists and the selection criteria that matter for each type of legal team.
60 legal AI tools vetted for the solo lawyer: tight budget, no IT team, billable-hours pressure.
Am Law 200 and global firm workflows: accuracy at scale, security compliance, and matter-level auditability.
Legal operations workflows: vendor management, matter management, spend analytics, and process automation.
Last reviewed: 2026/05/19. Definitions are written by the LawyerAI Editorial team. Commercial relationships are disclosed and do not determine editorial scores or conclusions. See our Sponsorship & Affiliate Disclosure.
Encryption at rest refers to the protection of stored data through cryptographic encoding, so that files, databases, and backups on storage media are unreadable without the appropriate decryption key — a baseline security control required for legal AI tools handling confidential client information.
Encryption at rest protects client data in the event of physical theft of storage media, unauthorized server access, or cloud infrastructure breach. Without it, an attacker who obtains access to the physical or logical storage layer could read client documents, queries, and other sensitive legal matter data in plaintext.
For lawyers evaluating legal AI tools under their professional confidentiality obligations, encryption at rest is a baseline security requirement — a minimum expectation for any cloud tool handling confidential client information. Most state bar ethics opinions addressing cloud computing for lawyers implicitly require adequate security measures that include encryption.
Encryption at rest is typically implemented using AES-256, which is the current industry standard. Tools should also encrypt data in transit (using TLS) — both protections together address the primary data exposure risks in cloud environments.
The presence of encryption at rest does not, by itself, mean a tool is adequately secure. Key management practices matter: who controls the encryption keys, whether the vendor could access plaintext data on request or under government compulsion, and whether keys are rotated regularly. Customer-managed encryption keys (where the law firm holds the key, not the vendor) provide a stronger control than vendor-managed keys.
Encryption at rest using AES-256 is standard across major enterprise legal AI platforms. Harvey AI, Clio, Everlaw, and Relativity AI all implement AES-256 encryption at rest as part of their baseline security infrastructure. This is documented in their security pages and confirmed in SOC 2 reports.
The key management dimension is where providers differ. Most vendors use vendor-managed keys, which means the vendor's key management system can decrypt data. This is generally adequate for commercial legal practice but may be insufficient for the most sensitive matters. Some enterprise tools offer customer-managed key (CMK) options, where the law firm controls the encryption key and the vendor technically cannot access plaintext data without the firm's key.
For firms reviewing vendor security documentation, look for: the encryption algorithm used (AES-256 is standard), key management approach (vendor-managed vs. customer-managed), encryption coverage (data at rest, data in transit, and backups), and whether the SOC 2 report confirms these controls are operating effectively.
Encryption at rest is a threshold requirement, not a differentiator. Its absence from a vendor's security posture is a disqualifying factor; its presence is necessary but not sufficient for a complete security assessment.