AI Data Use
This document is a draft and may change before launch.
Last updated: October 14, 2026
This page explains what happens to your firm's information when someone in your Zrico workspace uses an AI model. It is written for lawyers, accountants and brokers who need to answer client questions about confidentiality.
The short version
- Your data goes to an AI provider only when someone in your firm uses a model.
- None of the providers we use train their models on data sent through our API accounts.
- Each provider keeps data for a limited time to detect abuse, up to 30 days. AWS Bedrock keeps nothing for the models we use.
- All AI processing happens in the United States.
- Our own AI gateway does not store your prompts or the responses.
What we send to AI providers
When a user sends a message, the workspace sends the provider:
- The prompt the user typed.
- Conversation context: earlier messages in the same conversation, so the model can follow it.
- Relevant excerpts of uploaded files. When a user asks about an uploaded document, the workspace finds the most relevant passages and sends those, not necessarily the whole file.
When a user uploads a file for search, the workspace also sends its text to OpenAI's embeddings model (text-embedding-3-small). This turns the text into numbers that let the workspace find relevant passages later. The embeddings are stored in your firm's own workspace database, not by OpenAI.
We send only what is needed to answer the request. We do not send your firm's other conversations or files.
No training on your data
Each provider's API terms say that data sent through the API is not used to train their models by default. We have not opted in to any data-sharing program with any provider.
Provider by provider
| Provider | Models in Zrico | How long the provider keeps it | Used for training? | Source |
|---|---|---|---|---|
| Anthropic | Claude (Sonnet, Opus, Haiku) | Up to 30 days. Content flagged for a usage policy violation: up to 2 years. | No | Anthropic data retention |
| AWS Bedrock | Claude (backup route when Anthropic's API is unavailable) | Not stored for the Claude models we use. | No | Bedrock data retention, Bedrock abuse detection |
| OpenAI | GPT, and text embeddings for file search | Up to 30 days for abuse monitoring. | No | OpenAI: your data |
A few details behind the table:
- Anthropic may also keep automated safety scores (not the content itself) for longer, up to 7 years.
- Human review: each provider may have authorized staff look at content that its automated systems flag as a possible policy violation.
- Law and legal holds can extend any of these periods. A provider may keep data longer if a court order, legal hold or law requires it.
Models we do not use
Some AI providers offer models that require them to keep every request for a set period and allow safety staff to review it. We do not route your firm's requests to any model with terms like that. If a provider changes its terms so that a model we use would require longer retention, we will stop routing to it or tell you before anything changes.
Where processing happens
All AI requests are processed in the United States. On AWS Bedrock we use US-only routing. Your workspace itself is hosted in a US data center.
What our gateway keeps
All AI requests pass through our AI gateway, which enforces your firm's usage budget. The gateway does not store prompts, responses or file contents. It records only usage metadata: the user's email address, the model used, the number of tokens and the cost. We keep that metadata for 400 days for billing and support.
Our system logs never contain prompts, responses, file contents or secrets.
Zero data retention
Some providers offer "zero data retention" agreements, under which they keep nothing at all. We do not have these agreements in place today. They are on our roadmap. We will update this page if that changes.
What your firm can do
- Set a chat retention period. In your firm's settings, choose to keep chats, or delete them automatically after 30, 90 or 365 days. This controls what is kept in your workspace. It does not change what providers keep (described above).
- Leave out client identifiers you do not need. Often the model does not need a client's name, account number or other identifiers to help. Use initials or a matter number instead.
- Choose the model with care. If a client has concerns about a specific provider, ask your users to pick a different model for that work.
- Do not enter information that does not belong in Zrico, such as patient health information. See our Acceptable Use Policy.
- Check your professional rules. Your duties of confidentiality and any client instructions still apply.
More information
Questions: support@zrico.com.
Questions about this document? Email support@zrico.com.