Legal AI security checklist for plaintiff firms: BAAs, SOC 2 and your data

Why plaintiff firms need a stricter checklist

Plaintiff files are full of the most sensitive data there is: medical records, Social Security numbers, wage records, immigration status, accounts of abuse. When you upload them to an AI tool, you are trusting the vendor with your clients' secrets and your own duty of confidentiality. In an 8am survey, 68% of PI lawyers named data security as a barrier to firm-wide AI, and 62% ranked protecting attorney-client privilege as a primary concern when choosing a platform.

PlaintiffStack publishes this checklist and sells software you would run through it. We answer it ourselves at the end, including the items where we fall short today: SOC 2 Type II and ISO 27001 are in progress, not held.

HIPAA and the business associate agreement

Start with the agreement, because it is the one item you can check before any data moves.

Does HIPAA apply? HIPAA's rules bind covered entities (health plans, clearinghouses and most providers) and their business associates. A lawyer who provides legal services to a covered entity and receives protected health information from it is a business associate. A plaintiff firm that gets its own client's records through the client's authorization is usually in a different position. Whether HIPAA formally applies to your firm's vendors is a question for your counsel.

Ask for a BAA anyway. A business associate agreement is the clearest contract you can get about health information. HIPAA lists what one must say (45 CFR 164.504(e)), including that the vendor:

• Uses and discloses the information only as the agreement allows.
• Uses safeguards to protect it.
• Reports any breach or unauthorized use to you.
• Binds its own subcontractors to the same terms.
• Returns or destroys the information when the agreement ends.

A vendor that won't sign one is telling you something.

California adds its own rule. Under the Confidentiality of Medical Information Act, someone who receives medical information under an authorization generally may not disclose it further without a new authorization, unless the law allows it (Civil Code 56.13). Know where your vendor sends what you upload.

There is no "HIPAA certified." HHS does not certify software. Treat the phrase as a red flag.

SOC 2 and ISO 27001: what each one proves

Both are independent checks of a vendor's security. They are not the same thing.

How to read a SOC 2 report. Ask for the Type II. Then check the period it covers (is it recent?), the scope (does it include the product you are buying, and where AI models run?), any exceptions the auditor found, and which sub-service providers are carved out. If the period ended months ago, ask for a bridge letter.

If a vendor has neither, that is not automatically disqualifying for a young company, but it shifts the work to you. Ask for a written answer to your security questionnaire, the architecture, and the date the audit is expected.

Where your data lives and who touches it

• Data residency. Which country and which cloud provider hold your case data, documents and backups?
• The models. Where do the AI models run? In the vendor's own cloud account, or does your data go to a separate AI company's API? Each is a different chain of custody.
• Sub-processors. Ask for the list of every company that handles your data, what each does and where. A vendor should tell you before adding one.
• People. Do the vendor's staff, or contractors, read your files to review AI output? Where are they?
• Retention. How long are prompts, outputs and uploaded files kept, including logs?
• Breach notice. How fast will the vendor tell you about a breach, and who there is responsible for it?

Training on your data

Get it in the contract: your firm's data is never used to train or improve any model, the vendor's or a third party's. Consumer chat tools often have different defaults than their business versions, so check the terms of the exact plan your staff use. ABA Formal Opinion 512 says a lawyer needs the client's informed consent before entering client information into a self-learning tool, and that boilerplate consent in an engagement letter is not enough. See our Opinion 512 guide.

Access, audit logs and leaving

Who can see what, and what the AI may do on its own

• Sign-in. Multi-factor authentication, and single sign-on if your firm uses it.
• Roles. Can you limit who sees which cases and pages?
• Isolation. How is your firm's data kept separate from other firms' data in the same system?
• Audit log. Is every change recorded, by person and by AI agent? Can you see who opened a file?
• AI actions. Can the AI send anything, file anything or change a case without a person? It should propose; a person should decide.

Export and deletion when you leave

Ask how you get everything out: cases, contacts, documents, notes, in a format you can use. Ask what it costs, how long it takes, and when the vendor deletes its copy afterward. Get the answer in the contract, not a sales email.

The checklist

Send these questions in writing and keep the answers with the contract. If the sales team and the contract say different things, the contract wins. Ask again at renewal: sub-processors, model providers and data locations change as vendors grow.

How PlaintiffStack answers it

• BAA: signed with every firm before any client data arrives.
• SOC 2 Type II and ISO 27001: in progress. There is no SOC 2 report yet. On a demo we walk your IT lead through how PlaintiffStack is built and hosted and answer your security questionnaire in writing.
• Where data lives: the case database, documents and AI models run in one AWS account in the United States, with models on Amazon Bedrock. Sub-processors are listed on the security page.
• Training: firm data never trains models.
• Encryption and isolation: encrypted at rest and in transit; the database scopes every request to your firm.
• Audit log: every change is recorded, whether a person or an agent made it.
• AI actions: agents propose facts, deadlines and tasks, and a person accepts them. Nothing goes to a client, a carrier or a court until a person sends it. The case summary is the one thing an agent rewrites on its own, with earlier versions restorable.
• Exit: if you leave, we export your cases, contacts and documents, then delete our copy.

See security and the FAQ.