California · § 6068.1 · before January 1, 2027

Nine questions to ask any AI vendor. Our answers, in writing.

From January 1, a California attorney may put confidential information only into a system where access is restricted to the attorney and to people bound by a duty of confidentiality. That is a fact about where the client's words go after they leave the attorney's screen, and only the vendor can state it. In a Perspective column for the Daily Journal I set out nine questions to put to any vendor in writing, and to expect answered in writing. This page is where ClearlyConcise answers them.

By John M. Jensen, attorney at law (California) · October 2026
How to read this page

What is true today, who has checked it, and what is still owed.

Each answer says three things: what the workspace does now, which outside party has verified it, and what has not been done yet. ClearlyConcise is in pre-pilot development. An independent security test is scheduled for late October, and a written opinion from outside California privilege counsel is in final revision. Where an answer depends on either, it says so. Nothing on this page claims that any tool, including this one, makes an attorney's use of generative AI comply with the statute. The duties are the attorney's; what a tool can do is make the answers true and showable.

The column itself ran in the Daily Journal on October 9, 2026: read it as printed, reprinted with permission (or on dailyjournal.com, subscription). The questions here are stated in my own words; the answers are ClearlyConcise's.

The nine, answered
Question 1

Who can access the information my firm puts in?

Not "it is encrypted." Who. The roles, and the circumstances in which each role can see client content.

The members of a matter at the firm, and that matter's client, who joins only at an attorney's invitation. Every matter is its own sealed file under its own key. The database itself, not the application, refuses anyone who is not on the matter: an attorney at another firm cannot see that the matter exists; an attorney at the same firm who is not a member cannot open it; a client sees only their own matter.

No one at ClearlyConcise reads a firm's matters in the course of running the service. The application gives our staff no path to client content. A database operator, as at any hosted service, holds administrative access; that access is logged as its own kind of act, is not used to read matters, and is one of the things the outside reviews below exist to check.

Verified by: an outside PostgreSQL security firm reviewed the access design and the row-level policies in 2026; an isolation harness runs after every change (867 checks, none failing, at the last run). Still owed: the independent penetration test, late October.
Question 2

Which outside companies and processors handle the data as it moves to and from the model?

Each one by name. A tool that cannot name its own processors cannot restrict access to them.

One: Amazon Web Services, in the United States. The workspace runs there, the database runs there, and the language model runs there, inside AWS's own service for running models. The model's maker does not receive the firm's content. Content-free notices (that something is waiting in a matter, never what) leave by e-mail; the e-mail service is also AWS's. There is no other processor.

Verified by: the list of services is in the platform agreement a firm signs, and in the written security description given to the testing firm. Still owed: nothing on this question.
Question 3

What confidentiality obligations bind the model provider and those processors?

Ask to see the clauses. A privacy policy is a description; a contract is an obligation.

Two documents. The firm's agreement with ClearlyConcise states our confidentiality obligation to the firm and names the processor. AWS's written terms, including the terms that govern how its model service handles customer content, bind AWS to us. Both are available to a firm under its letter, and the clauses that matter are quoted, not paraphrased, in the written description the firm receives.

Verified by: the agreements as written. Still owed: nothing on this question; the opinion in question 9 reads them.
Question 4

Is anything retained after processing, and is anything used to train a model or to "improve results"?

"We don't train on your data" is not the same promise as "we keep nothing."

By the model: nothing. The model runs under a configuration in which no request or response is written to durable storage by AWS or shared with the model's maker, and nothing is used to train or improve any model. AWS confirmed that in writing to us in October 2026, including that a model which required retention would be refused before any prompt was processed.

By the workspace: the matter record itself. A firm uses the workspace to keep a client's account, documents and drafts, so those are kept, encrypted under the matter's own key, until the firm closes the matter and takes its export. Deletion is an act the firm requests and the record shows. Nothing from one matter is kept for any purpose outside that matter.

Verified by: AWS, in writing (two support cases, October 2026); the workspace refuses every model call unless that configuration has been verified in the account it runs in, so a deployment cannot run on an unverified setting. Still owed: nothing on this question.
Question 5

Can access be limited to the people permitted on one matter, and can you show me afterward who had access?

The statute's test is restriction; the proof of restriction is a record.

Yes to both. Access is a row someone at the firm wrote on purpose, never something inferred from a title: a supervising attorney puts a colleague on a matter or takes one off, and the database allows or refuses the act. Every grant, removal, screen and refusal is recorded as its own content-free fact: who, which matter, when, and the act. A supervising attorney can read that record for any matter of the firm, and the firm can take it with the matter's export.

Verified by: the outside PostgreSQL review (the access model) and the isolation harness. Still owed: the penetration test; document-level grants for temporary staff and grant expiry are designed and not yet built, and the workspace says so on its own access page.
Question 6

How does the tool help me verify?

A tool that shows its sources makes the duty possible; one that produces polished text with no path back to the record makes it a daily act of faith.

Every statement the workspace makes about the record shows the passage it rests on and whose words they are: the client's account, a document, an answer to a question. When sources disagree, the workspace shows both and decides nothing. A draft pleading carries each paragraph's source beside it, and the workspace lists every authority a draft cites, for the attorney's own reading before anything is filed. The workspace never records whether the attorney verified a citation; that is the attorney's act and the attorney's record.

Verified by: a faithfulness battery run against the workspace's own reads (214 cases at the last full run). Still owed: nothing on this question.
Question 7

What decisions does the model make without an attorney in the loop?

Drafting at the attorney's direction is assistance. Deciding what to claim, what to omit, what a fact is worth, is the practice of law.

None that the statute would call the practice of law. The model organizes what the client said, asks the questions the account left open, compares the sources in the file, reads the facts against the elements of a claim the attorney chose, and prepares drafts for the attorney's revision. It does not weigh evidence, rank authorities, choose a theory, advise the client, send, sign or file. Nothing reaches a client that an attorney of the firm did not approve, and that approval is a recorded act.

Verified by: the refusals are built into the instruments themselves and are tested; the client side delivers only the firm's approved words. Still owed: nothing on this question.
Question 8

Does it learn, or "improve," from my clients' matters, in any form, under any name?

Anonymization is not the test for waiver. Disclosure to a third party for a purpose beyond the representation can be.

No. No model is trained or tuned on any firm's content. There is no memory across matters: a read of one matter is made from that matter's record and nothing else, and informs nothing outside it. Nothing from one firm's work is used for another firm, in any form, including anonymized or aggregated forms. The workspace improves by what we build, not by what your clients told you.

Verified by: the architecture has no such path; the model's configuration (question 4) forbids it on the provider's side. Still owed: nothing on this question.
Question 9

Who holds the written opinion that it preserves privilege, and may I rely on it?

If the vendor's answer is "our terms of service," the answer is no one.

Outside California privilege counsel has been engaged since the summer to opine on the architecture, the agreements, and the client-facing texts. The opinion is in final revision. A firm that engages receives it on the terms it states, including who may rely on it and on what assumptions. Until it issues, this page says "in final revision," and no demonstration or document of ours says more.

Verified by: the engagement exists; the opinion does not yet. Still owed: the opinion itself. This is the one answer on this page with a date in it, and it will be updated the day it changes.
The question the nine leave out

Where does the client's information go?

The statute governs what the attorney puts into generative AI. It does not reach what the client puts into it, and clients are already telling consumer chatbots about their cases, in conversations a federal court has held may not be privileged. ClearlyConcise was built for both sides of that line: a private place where the client tells the story and sends the documents, at the attorney's invitation, inside the same sealed matter the attorney works in. That is the tenth answer, and it is the reason the workspace exists.

The statute in plain language, with a checklist for a firm →
See it

A demonstration, under your firm's letter.

John M. Jensen

If you practice in California and want to see the workspace on a matter in your practice area, write to me. I show it myself, on synthetic facts, in forty-five minutes, under a short confidentiality letter. First matters begin after the independent security test reports in November; nothing of a firm's enters the system before our written readiness notice.

johnjensen@johnmjensen.com

This page describes a product in development and is not legal advice. ClearlyConcise does not create privilege or work-product protection and makes no representation about how a court or the State Bar will read § 6068.1. Whether a firm's use of any tool satisfies the statute depends on the firm's own facts. John M. Jensen is the founder of ClearlyConcise, Inc.; the views are his own.