9Every firm treats the delete key as an eraser. When a partner pastes a draft into a consumer AI chat tool and then closes the tab, they assume the conversation is gone — that a careless moment, once cleared, is simply no longer on the record. That assumption is the most expensive thing in the room, because public AI does not forget the way a local hard drive does.
A prompt entered into a hosted model is not a private exchange. It travels to someone else’s infrastructure, is processed across their systems, and can persist in logs, training corpora, and internal records long after the browser window closes. You can clear your history. You cannot un-receive the copy they hold. For a firm whose entire value is the promise of confidentiality, that gap between what feels private and what is actually private is the professional liability nobody has priced until it bites.
Why the delete key fails you
The persistence problem is not one thing; it is a stack of things acting together:
Logs outlive the session. Hosted platforms retain activity records for their own operations — security monitoring, billing, troubleshooting, model improvement. A session you consider closed is, on their side, an event that may be retained, reviewed, or shared with subcontractors.
Training is a one-way door. Once material is ingested to improve a model, there is no practical way to pull it back out. It is diffused across weights and datasets. No deletion request reaches it.
Chain of custody is unreadable. You cannot see where a given prompt went, which systems touched it, who could access it, or how long each copy was kept. Even the best-written terms in the world cannot compensate for a data path you literally cannot inspect.
Prompt leakage compounds. The documents you paste are often not the only exposure. The surrounding context you type — the client name, the matter, the strategy — rides in on the same submission.
What this means for your obligation
If your firm is governed by professional confidentiality duties, a client file is not something you can hand to a hosted service and reasonably call protected. The standard is not whether a leak has happened. It is whether you took reasonable steps to keep the information from leaving your control in the first place. A prompt that sits in someone else’s logs does not stop being your exposure just because you deleted your own copy. Every retention schedule, every indemnity clause, every assurance in a vendor’s marketing is subordinate to one question: can you actually show where that data ended up?
Private, sovereign AI answers the question differently. The model runs on your own infrastructure. The data stays inside your boundary. There is no external corpus, no third-party log, no unreadable chain of custody. What you maintain is yours, start to finish — which is precisely what a regulator, an insurer, or a client’s counsel will eventually ask you to prove.
Before you trust another paste
Talk openly with your team about what a public prompt actually exposes. Treat the delete key as the fantasy it is. And map which of your workflows — conflict checks, document reviews, drafts — are quietly routing client information where you cannot reach it again.
Run a rapid, confidential check on where your sensitive data actually travels before the next submission becomes the one you cannot undo. Get the free Confidential AI Exposure Checklist and see exactly what your firm is exposing right now.