An independent, sourced tracker of where legal AI vendors store data, where their AI actually runs, and what they promise in writing on Swiss professional secrecy (Art. 321 SCC), the revFADP and the US Cloud Act.
4 vendors that store client data only in Switzerland state that AI processing may also take place in the EU, by default or through an option (CASUS, Jurata, Omnilex, Swiss-Noxtua). Several others run their AI in Switzerland on US-parent clouds.
CASUS, Jurata, Omnilex, Swiss-Noxtua state contractual auxiliary-person terms or publish an external opinion. For 1 of 18 vendors we found no public statement.
8 of 126 criteria have no public source. That is a question to ask, not a verdict.
US-domiciled vendors or US-only processing. Every Cloud Act score is an editorial judgment call with a stated rationale.
| Checked | Profile | Field | Before | After |
|---|---|---|---|---|
| 2026-10-17 | Clio (Duo / Work) | Art. 321 SCC auxiliary terms | not disclosed | 2/3 |
| 2026-10-17 | Clio (Duo / Work) | No training on customer data | 3/3 | 2/3 |
| 2026-10-17 | CoCounsel (Thomson Reuters) | Art. 321 SCC auxiliary terms | not disclosed | 2/3 |
| 2026-10-17 | CoCounsel (Thomson Reuters) | revFADP / GDPR processing agreement | not disclosed | 2/3 |
| 2026-10-17 | CoCounsel (Thomson Reuters) | ISO 27001 / SOC 2 | not disclosed | 3/3 |
| 2026-10-17 | DeepJudge | Art. 321 SCC auxiliary terms | not disclosed | 2/3 |
One short email when vendor records change, plus new guides. No spam, unsubscribe anytime.