--- title: "Protect privileged information before it reaches the AI" description: "Attorneys using AI tools risk inadvertent privilege waiver. Locke detects and blocks privileged material locally, before transmission." url: "https://sonomos.ai/who-its-for/legal/" source: "https://sonomos.ai/who-its-for/legal/" --- # Protect privileged information before it reaches the AI Sending client material to an AI provider may waive privilege. Locke flags what looks privileged and masks or blocks it on your device, before it's sent. [Download Locke](https://sonomos.ai/downloads/)[See how it works](https://sonomos.ai/locke/#demo) ## What Locke detects ### Case numbers and docket identifiers Patterns consistent with federal and state case-number formats, near litigation keywords. Contextual pattern matching ### Client names and matter identifiers Named entity recognition finds people, organizations and places. Matter numbers are caught by their proximity to legal keywords. NER + contextual matching ### Witness and party identifiers Names and identifying details near words like deposition, testimony, witness or party. Contextual pattern matching ### Privileged communication markers Patterns associated with attorney-client communications: privilege headers, confidentiality notices, work-product references. Contextual pattern matching ### SSNs and EINs Social Security and Employer Identification Numbers, verified by checksum and digit format. Structural validation ### Financial account data Luhn-validated card numbers, plus bank account and routing numbers near financial keywords. Structural + contextual matching Patent and trademark registration numbers, which are public record, are excluded from privilege signals. Only litigation, case-management and witness data trigger privilege relevance. ## Frameworks that may apply to flagged data Locke reports pattern matches, not compliance status. These frameworks may be relevant when detected data is sent unprotected. ### Attorney-Client Privilege Locke flags a potential privilege relevance signal when litigation, case-management or witness identifiers are sent unprotected to an AI tool. Voluntary submission of privileged material to a generative AI service may constitute waiver. At least one federal court has now addressed the question directly. - [ABA Model Rule 1.6: Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) - [ABA Formal Opinion 512: Generative Artificial Intelligence Tools (2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) ### CCPA Locke flags a CCPA relevance signal when personal or government-issued identifiers (SSNs, names, addresses) are sent to a third-party AI tool. - [California Privacy Protection Agency: CCPA regulations](https://cppa.ca.gov/regulations/) Signal requirements: A relevance signal requires (1) flagged data in a specific category, (2) sent unprotected, (3) to a destination matching a relevant classification. Blocked or remediated transmissions don't trigger one. Locke does not determine whether privilege has been waived, whether a regulation has been violated, or whether data is protected under applicable law. It identifies pattern matches. Legal analysis requires counsel. ## Four steps, all on your device ### Detect Locke scans for case numbers, client names, witness identifiers and privilege markers on your device. Nothing is sent during detection. ### Alert Red marks a high-confidence structural match. Yellow marks a contextual match to review. ### Block or mask Flagged data in an outbound request (a chatbot prompt, a form, an API call) can be masked before it's sent, or the request blocked. ### Report Events are logged on your device. Export PDF reports for the client file, compliance records or your malpractice insurer. ## Client content never reaches Sonomos Attorney-client privilege can be waived by voluntary disclosure to a third party. A privacy tool that sends client data to its own servers becomes one more. Locke processes content on your device, and detection data never leaves it. Sonomos holds only your account, licence status and settings: no client data, no flagged content, no new disclosure. Use AI on the matter. Keep the client's secrets on your device. [Get Locke for your practice](https://sonomos.ai/downloads/) Or [try the interactive demo](https://sonomos.ai/locke/#demo) first. ## Reading for legal - [AI and the Work Product Doctrine: Privilege Risks When Lawyers Use ChatGPT and Claude](https://sonomos.ai/blog/ai-work-product-doctrine-legal-privilege-2026/) - [Can Lawyers Use ChatGPT? Confidentiality, Privilege, and AI in 2026](https://sonomos.ai/blog/can-lawyers-use-chatgpt-confidentiality-2026/) - [AI Tools for Legal Research in 2026: Harvey, Westlaw AI, Lexis+ AI, and Why Citation Hallucination Still Matters](https://sonomos.ai/blog/ai-legal-research-harvey-westlaw-casetext-2026/) - [Is Claude Confidential? What Anthropic Can See, Store, and Train On (2026)](https://sonomos.ai/blog/is-claude-confidential-2026/) See also [Healthcare](https://sonomos.ai/who-its-for/healthcare/)[Financial Services](https://sonomos.ai/who-its-for/financial-services/)[Technology](https://sonomos.ai/who-its-for/technology/)[Individuals](https://sonomos.ai/who-its-for/individuals/) Related concepts [Prompt leakage](https://sonomos.ai/glossary/prompt-leakage/)[What is PII?](https://sonomos.ai/glossary/personally-identifiable-information/)[Data masking](https://sonomos.ai/glossary/data-masking/)[Tokenization](https://sonomos.ai/glossary/tokenization/)[Contextual matching](https://sonomos.ai/glossary/contextual-matching/) [Compare Locke with cloud DLP and enterprise privacy platforms](https://sonomos.ai/compare/).