Legal
Use AI on Contracts and Case Files Without Sending Client Data to the Model
- 01
Identify sensitive values
- 02
Replace with stable tokens
- 03
Restore only inside your boundary
574
Built-in detectors for personal data and secrets
47
Country packs, checksum-validated where the format has one
9
AI providers behind one gateway, plus the desktop agent and proxy
Where client confidences meet AI in a firm
An associate has a 60-page share purchase agreement and a partner who wants the indemnity caps by tomorrow morning. Pasting it into Claude takes ten seconds. It also sends the buyer, the seller, the target's directors, a few IBANs from the escrow schedule, and the deal value to a provider the client never agreed to.
Litigation teams summarize witness statements and case files. Knowledge teams build retrieval over precedents. In-house teams review supplier contracts. In every case, what goes into the prompt is information the lawyer is bound to keep confidential, and bar regulators have started saying so in writing.
Maskflare keeps the identifying parts behind: client names from your own client list via Exact Data Match, personal data from 574 detectors, tokens out, real names back in the answer.
Where legal is actually exposed
5 failure modes specific to this environment, not a restatement of general security advice.
01
Contracts pasted for review
A clause review prompt carries party names, signatories, addresses, and bank details. The desktop agent masks them before the text reaches the provider and restores them in the summary, so the associate reads real names.
02
Client and counterparty names
Company names don't match a pattern. Upload your client and matter list to Exact Data Match as keyed hashes, and those exact names and matter numbers are masked wherever they appear.
03
Case files and correspondence
Witness statements, emails, and court documents attached to prompts are scanned as documents. E-mail headers, bodies, and attachments are covered; plain-text exports are masked in place.
04
Retrieval over precedents and matter files
A precedent bank built from past matters puts client names into a vector store. Through the gateway, embeddings use deterministic tokens and fail closed, so the index holds tokens.
05
Legal tech built on third-party models
Many legal AI products call OpenAI or Anthropic underneath. Tools you build or configure can point at the Maskflare gateway instead, so the same rules apply before the provider is called.
Who this page is for
- General Counsel / Managing Partner
- Has to answer a client asking whether their documents go to an AI provider, and wants the answer to be no.
- Risk and compliance partner
- Owns the firm's position on professional secrecy and bar guidance on generative AI.
- IT and security
- Needs a control that works across the AI tools lawyers actually use, not a policy memo.
- Knowledge management and innovation
- Wants retrieval over precedents without client names sitting in an embeddings index.
- Data protection officer
- Has to document what personal data in matter files reaches each AI provider.
How a team would actually run this
Reviewing a contract with AI
- 01 Deploy the desktop agent to fee earners with Intune, Jamf, or Group Policy. Only AI hosts are routed through Maskflare.
- 02 Export your client and matter list from the practice management system and upload it with `maskflare edm upload`. Only keyed hashes leave the firm.
- 03 Turn on the GDPR profile and the country packs for your clients' jurisdictions.
- 04 The associate pastes the agreement into Claude. The provider sees tokens in place of party names and IBANs; the summary shows the real names again.
Building a precedent search
- 01 Send embeddings and chat requests through the Maskflare gateway with a base-URL change.
- 02 The same client name always becomes the same token, so a search for a masked name still finds the right documents.
- 03 Set party names to mask and bank details to redact, so nothing in the index can be turned back into an account number.
Which modules apply, and why
Each links to the module page, where the boundaries and development status are set out in full. Or start at the Maskflare platform overview.
Detection engine
Maskflare Exact Data Match
Masks your own client names, counterparties, and matter numbers from keyed hashes of your list, which pattern detection can't find.
Detection engine
Maskflare Detection Engine
Detects and masks personal names, emails, addresses, national IDs, and IBANs in contracts and case files, and restores them in the answer.
For your people
Maskflare Workforce
The desktop agent covers lawyers on ChatGPT, Claude, Gemini, DeepSeek, and Perplexity, and a one-time console code is needed to uninstall it.
For your people
Maskflare Browser Protection
Masks text typed into AI chat sites before it is sent and restores real values where the answer repeats them.
Detection engine
Maskflare File Security
Reads the text of attached contracts, court documents, and email files, and strips author metadata from images.
For your apps
Maskflare AI Gateway
Puts precedent search and drafting tools behind the same rules, with deterministic embeddings that fail closed.
Regulatory context
Readiness and relevance, not certification. Nothing here is a claim to hold an audit or authorization we do not have.
- ABA Formal Opinion 512 (US)
- Issued 29 July 2024. Covers competence, confidentiality, supervision, and fees when lawyers use generative AI, and says informed client consent is needed before client information goes into some self-learning tools. Masking reduces what a tool receives; it doesn't replace that analysis.
- SRA (England and Wales)
- The SRA's November 2023 Risk Outlook report on AI names confidentiality as a key risk and keeps solicitors accountable for AI-assisted work.
- Professional secrecy
- Criminal-law secrecy rules such as Art. 321 of the Swiss Criminal Code and § 203 of the German Criminal Code cover lawyers. Keeping client identities out of the prompt is part of how firms address them; it is not legal advice on your position.
- GDPR
- Matter files are full of personal data about clients, counterparties, and witnesses. Masking is data minimization; reversible tokens remain pseudonymized personal data for the firm.
What Maskflare does not do
- Maskflare doesn't decide what is privileged or confidential. It masks the values your rules cover.
- Masking names doesn't hide facts. A described transaction or dispute can still identify a client, so judge the context you send.
- It doesn't check AI output for invented case law or citations. Review stays with the lawyer.
- Person-name detection covers English, German, French, Spanish, Italian, and Albanian names; company names need Exact Data Match or a dictionary.
4 questions to ask any vendor here
Including us. If our answer is worse than someone else's, you should know that before you buy, not after.
- 01Can it mask our clients' names, which have no pattern, without us sending the client list in clear text?
- 02Does the provider ever receive party names or bank details from a contract, or only tokens?
- 03Is any document text stored by the tool itself, and where is it hosted?
- 04Which AI chat sites does it cover on lawyers' machines, and which does it not?
Workflow guides for this industry
How a team applies each of these, including the contrast with the tool it replaces.
Definitions worth agreeing on first
Legal questions we get asked
Does Maskflare make AI use compliant with bar rules?
No tool does. Rules such as ABA Formal Opinion 512 turn on competence, consent, and supervision. Masking reduces the client information an AI provider receives, which is one input to that analysis. Not legal advice; check current guidance as of October 2026.
How are client company names detected?
Through Exact Data Match. You upload your client and matter list as keyed hashes with the Maskflare CLI, and those names and numbers are masked wherever they appear. A dictionary rule works for short lists.
Will the lawyer see real names in the AI's answer?
Yes. Values masked on the way out are restored where the answer repeats them, in the browser through the desktop agent and in your own tools through the gateway.
Can we use it with the legal AI tools we already license?
If a tool lets you set the AI provider base URL, point it at the Maskflare gateway. If it calls the provider from its own servers, Maskflare can't see that traffic; ask the vendor.
See it on your own data
Start a free trial or talk to us with the identifiers and AI workflows your legal team actually handles. Bring the case that makes it hard, because that is the part worth testing.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →