How We Protect Client Confidentiality

If you practice law, you already know that a tool’s privacy policy is not enough. You need to know — in concrete terms — what happens to the case facts, theories, and strategy you type into JudgePrep. This page is written for that question. It is not a privacy policy (our full Privacy Policy is the controlling legal document), but it explains the parts that matter most when you are weighing whether to use JudgePrep on an active matter.

The short version: JudgePrep is designed so that the substance of your case sessions is not retained, not used to train AI, and not accessible to anyone else — including us. The longer version, and the honest limits of that promise, are below.

The Four Questions Attorneys Ask

Nearly every attorney who evaluates JudgePrep raises some version of the same four concerns. We address each one directly.

1. “Will my case facts be used to train AI?”

No. Nothing you type into a JudgePrep consultation is used to train, fine-tune, or improve any AI model — ours or our providers’.

• We do not train on your sessions. We do not build models from user content. Our judicial reasoning profiles are built from publicly available court opinions, not from attorney queries.
• Our AI provider does not train on your sessions. JudgePrep sends your queries to Claude Sonnet via the paid Claude API under terms that prohibit Claude, or its owner, Anthropic, from using API inputs or outputs to train its models. This is different from consumer-facing chatbots, where prompts may be used for training unless you opt out.
• No human review of your sessions. We do not read, analyze, label, or mine session content for any purpose.

2. “Could this be subpoenaed?”

This is the right question, and we will answer it honestly in two parts.

Session content (the substance of your queries). On the Solo plan, case session content is processed in memory to generate the judicial analysis and is then discarded. It is not written to any database, log, or backup. If we received a subpoena tomorrow asking for the substance of your last consultation, we would not have it to produce. On the Litigator plan, users may opt in to encrypted case folders; content in those folders is encrypted at rest and accessible only to the user’s own account. If you do not opt in, the Solo architecture applies.

Account and request metadata. We do retain certain operational metadata: your account email, subscription records, aggregate usage counts, request timestamps, and standard web server logs (IP address, user agent, which page was accessed) for up to 90 days. This metadata is theoretically subject to compelled process, but it does not include the content of what you asked. We treat any such request with the scrutiny you would expect, and we will challenge overbroad requests where appropriate.

The bottom line: the substance of your strategy is not on our servers to be produced. The fact that your account used the service on a given date may be.

3. “What happens if there’s a data breach?”

Most state bars now require “reasonable” data security measures for information related to client representation. Our architecture is designed so that the highest-sensitivity category — the substance of your case sessions — is the category most protected, because it largely doesn’t exist at rest.

• No session content at rest (Solo plan). A breach of our database cannot expose case session content on the Solo plan, because that content is never written to the database in the first place.
• AES-256 encryption at rest (Litigator case folders). Opt-in case folders on the Litigator plan are encrypted at rest using AES-256 and scoped to the user’s own account.
• TLS in transit. All traffic between your browser, JudgePrep, and our AI provider is encrypted using HTTPS/TLS.
• Password hashing. Passwords are stored using bcrypt — we never see or store them in plain text.
• Principle of least data. We collect only what the service needs to function. The best protection for sensitive data is not collecting it in the first place.

4. “Could opposing counsel — or the judge I’m preparing for — ever see this?”

No. JudgePrep is a one-way tool: you consult a judicial reasoning profile, and the profile responds. There is no public feed, no “recent queries” page, no training loop that surfaces your questions to other users, and no mechanism by which another user — including the judge you are researching — can see that you used JudgePrep, what you asked, or what you were told. Sessions are strictly scoped to your account.

What We Store, and What We Don’t

What We Don’t Control — and Neither Does Any Vendor

A trust page that claims to eliminate every risk is not being honest with you. Here is what JudgePrep cannot protect against, and what we recommend:

• Your own device and network. If your laptop is compromised, a keylogger sees what you type before it reaches us. Endpoint security is the attorney’s responsibility, but standard measures — full-disk encryption, a password manager, MFA on your email, avoiding public Wi-Fi for sensitive work — are proportionate to most risks.
• Anonymization is still a good habit. Even with no-retention architecture, we recommend using generic or hypothetical framings where possible: “a plaintiff alleging breach of a non-compete” rather than the client’s name and the employer’s name. This is belt-and-suspenders, and it is how we use the tool ourselves.
• Your own account. If someone obtains your JudgePrep password, they can consult judicial profiles as you. Use a unique password and enable any MFA options we offer.

Your Professional Judgment Still Governs

JudgePrep is a preparation and research tool. It does not establish an attorney-client relationship, it does not provide legal advice, and using it does not discharge any duty you owe your client under Rule 1.6 or its state analogues. You are the attorney of record. You decide what it is appropriate to enter into any tool, including this one. We have built the architecture to make that decision easier to justify, not to make it for you.

Questions?

If you are evaluating JudgePrep for your firm and need more detail — including information about data processing agreements, BAAs where applicable, or our provider contracts — email us at support@judgeprep.com. We would rather answer a hard question once than have you guess.