IntelekIQ
Secure AI for Legal Practice
White Paper A4  |  The architecture decision

Cloud, On-Premises or Sealed?

Choosing a deployment model for confidential client work by comparing contractual controls, technical isolation and the firm's operational responsibilities.

For: partners, IT and the DPO (the decision-makers)  ·  Reading time ~12 min

Once a firm has mapped where its data goes and classified it as Green, Amber or Red, it can decide where AI should process confidential client work. That architecture decision affects confidentiality, control, cost and operational responsibility. It should follow the firm's requirements rather than a general preference for cloud or on-premises systems.

1Three models, and a myth to clear first

AI processing of confidential client information can happen in three broad places. It may use a public or third-party cloud model. It may use a private model in the firm's cloud tenant, operated by a vendor for that firm. Or it may use private AI on the firm's own premises. Each model can suit different work and relies on a different combination of contracts, vendor controls and technical isolation.

On-premises deployment is not automatically safer. A server in the building can still be exposed through poor configuration, weak access controls or delayed patching. A well-managed cloud service may provide stronger security than a poorly managed local server. Location is only one part of the assessment.

"On-premises" is not automatically safer Location alone is not a control; network design, access controls and maintenance all matter Internet-facing on-prem server A server in the building, but exposed to the internet for inbound access. An unpatched, reachable server is a target. The location does not save it. Higher risk vs Controlled on-premises AI Runs in the firm's environment with restricted network access. The firm controls access, maintenance and how confidential files are processed. Lower risk The relevant claim is that AI processing stays under the firm's control, not that cloud services are insecure.
Figure 1. Location does not determine security by itself. Network design, access controls, patching and operational discipline determine whether an on-premises system provides the intended protection.

The goal is therefore more specific than running hardware in the building. The firm needs an on-premises private AI environment with controlled access, appropriate maintenance and a clear boundary around confidential client files. Secure Law is designed for that purpose.

2How the sealed model works

The architecture separates confidential client work from internet-facing research. AI processing of confidential client files takes place within the firm's on-premises environment. External research remains on a separate path, and only approved, non-confidential knowledge is added to the firm's knowledge base.

Secure Law's separated architecture Confidential work stays on premises; approved non-confidential knowledge can be added Internet Firm environment Microsoft 365 / Entra ID SharePoint · document servers · matter files Internet: as today Secure Law private AI Local LLM + embeddings Reranker + orchestrator Two RAG indexes: · Firm knowledge (GREEN) · Per-matter (AMBER) No outbound internet Research / egress Legal-database client DLP filter Verification staging No confidential client files matter docs the wall verified knowledge client files never out Approved non-confidential knowledge can be added to Secure Law; confidential client work stays on premises. External research remains separate from the private AI environment used for confidential client files.
Figure 2. The architecture separates the firm's existing systems, Secure Law's on-premises private AI and internet-facing research. Approved non-confidential knowledge can support later work without putting confidential client files on the external research path.

Three controls define the design. First, Secure Law processes confidential client files on premises. Second, external research follows a separate internet-facing path and should not contain confidential client information. Third, approved non-confidential knowledge can be added to the firm's knowledge base after review. Together, these controls distinguish private AI processing from ordinary internet use.

3The claim to make, and the one to avoid

Secure Law supports a precise claim: AI processing of confidential client files takes place on premises, within the firm's controlled environment. This does not mean that cloud services are inherently insecure.

Reputable cloud services can provide strong security. The reason to choose on-premises private AI is different. For selected confidential work, the firm may want AI processing to remain within its own environment rather than sending files to a third-party AI model.

If the firm uses Microsoft 365, some client files may already sit in Microsoft's cloud under the firm's tenant. Secure Law does not change that storage arrangement and does not make the firm air-gapped. It changes where AI processes confidential client files: on premises, rather than in a public or third-party AI model.

Use the accurate claim. Secure Law runs on premises and processes confidential client files within the firm's controlled environment. It is not a claim that the whole firm is air-gapped or that cloud services are insecure.

4The market is moving this way, with a caveat

Legal AI is available through public, enterprise, single-tenant, private-cloud and self-hosted models. This range reflects different requirements for confidentiality, data residency, control and operational responsibility. Firms should verify each vendor's current deployment and data-handling terms.

Self-hosting is not a general regulatory requirement. Regulators in Malaysia and Singapore take a technology-neutral approach.

The case for on-premises private AI rests on the firm's confidentiality assessment, client requirements and preferred level of control. It should not be presented as a regulatory mandate.

5Choosing, in practice

Different models suit different work. The firm can match controls to the sensitivity of the information and the client's requirements. The two axes below provide a starting point.

Which posture fits which work Match the control to the data and the client's requirements, not one blanket answer Private VPC / selective on-premises Strict clients, but lower- sensitivity work Secure Law on-premises private AI Privileged work + strict client or regulatory requirements Enterprise cloud AI (zero-retention) Routine, lower-sensitivity work; standard requirements Private model in your cloud (VPC) Confidential work; standard client requirements Standard Highly confidential / privileged Data sensitivity → Client / regulatory strictness → A firm may use cloud services for suitable work and on-premises private AI for confidential client files.
Figure 3. A decision aid, not a verdict. The same firm can use enterprise cloud services for suitable work and Secure Law for confidential client files that it wants to process on premises.

A firm does not need one architecture for every task. It can use a well-governed enterprise cloud service for suitable work and Secure Law for confidential client files that should be processed on premises. The classification scheme from the previous note helps the firm decide which route applies.

6The honest bounds

On-premises private AI carries hardware, maintenance and support costs. Local models also differ from the largest external models, and no model is best at every task.

External research still depends on careful procedure. Secure Law also does not remove the firm's underlying duties. Confidentiality, data protection, access management and breach response remain the firm's responsibility.

AI can still produce inaccurate or fabricated material. Lawyers must review the output, verify the supporting sources and remain responsible for professional work.

An honest bound

The right architecture balances risk, cost and operational responsibility for each class of work. A reputable enterprise cloud service may be appropriate for many tasks. Secure Law provides an on-premises private AI option for confidential client work that the firm wants to keep within its controlled environment.

With the architecture chosen, the next papers examine its controls. A5 explains how retrieval separates one client's material from another's work. A6 covers how external research becomes approved firm knowledge. A7 examines the threat model for on-premises private AI.

Notes & further reading

  1. On the market shift toward private / single-tenant legal-AI deployments through 2025 to 2026, including cloud-native vendors offering isolated deployments for law-firm clients, see contemporary legal-technology coverage; verify specifics against current vendor documentation before relying on them.
  2. US National Institute of Standards and Technology, AI Risk Management Framework: nist.gov. ISO/IEC 42001:2023 (AI management system): iso.org/standard/42001. The frameworks against which a deployment's controls can be structured and, in the case of 42001, certified.
  3. Companion papers: A2 Follow the Data (the inference wall and the four postures); A3 Classifying Firm Information for AI (which work belongs in which posture); A5–A7 (how the sealed core works and its threat model).

Self-hosting is not a general regulatory requirement. The choice rests on the firm's confidentiality assessment, client requirements and preferred level of control.

IntelekIQ · Secure AI for Legal Practice · White Paper A4: Cloud, On-Premises or Sealed? Next in the series: A5: Grounded Retrieval and the Two-Index Model: stopping conflict and privilege leaks.