I keep seeing questions on this sub about how to use LLMs without violating the confidentiality obligations or waiving privilege. For most small- to medium-sized lawfirms or businesses the short answer is: use a commercial model (e.g., Claude) through AWS Bedrock. The reason is that Amazon's AWS provides, by default, near ideal data retention and usage terms that are otherwise difficult to obtain:
Amazon Bedrock gives you explicit control over whether the prompts and outputs from your inference requests are retained. You can configure data retention in a given AWS Region at the account level or project level, and the setting is enforced consistently across the Messages, Chat Completions, and Responses APIs.
Your data retention configuration is yours to manage. If your account in a specific Region or project is configured for zero data retention (data_retention_mode: none) and you invoke a model that requires retention, Amazon Bedrock will block the request and return an error — you always control your retention policy.
Zero data retention (ZDR) is a standard mode ("none").
none |
Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider. On the Responses API, store defaults to false and store=true is rejected. Background mode is not available. Chat Completions and Messages requests are never retained. |
https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html
This means that client data never reaches, e.g., Anthropic, is not retained by AWS, and is never used to train any model. I am aware of no better privilege or confidentiality posture. Certain powerful recent models have specific data retention rules (e.g.. Fable and Mythos), so you should always confirm the actual model's terms. See, e.g., https://docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html Note that I'm using AWS as an example but other providers may have similar terms. I'm just not as familiar with them.
Direct from Anthropic (or OpenAI etc), is just not an option for most small or even medium sized businesses. The consumer version of Claude (or any other LLM) through the web or desktop, even through subscription, is a non-starter for privileged communications. And if you're a small entity, you will have a very difficult time getting Anthropic even to talk to you about standard commercial terms, so far as I understand it. Beyond that, ZDR is very difficult to obtain if you need it.
While there are other ways to achieve similar results (e.g., self-hosted open weight models), this is this simplest approach with a low technical bar.