AI document tools are genuinely useful. But for accountants, solicitors, HR consultancies, and anyone else handling confidential client information, the enthusiasm is tempered by an obvious question:
If I use AI to search my documents, where exactly does my data go?
It's the right question to ask. And the honest answer is: it depends entirely on which tool you use and how it's set up.
This guide gives you a clear, plain-English breakdown of what different AI tools actually do with your data — and what to look for if you're serious about keeping client information confidential.
Not all AI document tools work the same way. There's a crucial architectural difference between them.
Tools like Microsoft Copilot, ChatGPT file uploads, Google NotebookLM, and most SaaS AI assistants work by sending your documents to their cloud infrastructure. Your files are processed, stored, and indexed on servers you don't own or control.
These services are convenient and often well-designed. But they require you to transfer your documents outside your own infrastructure — which for professional services firms raises immediate questions about client confidentiality, data protection, and professional conduct rules.
A locally-hosted system installs on your own server or PC. Your documents are indexed and stored entirely on your own infrastructure. When a question is asked, only the question and a few relevant paragraphs are sent to an AI model to generate the answer.
Your full documents never leave your building.
User asks: "What is our standard fee for a probate matter under £500,000?" → System finds the relevant clause in your fee schedule on your local server → Sends only that clause + the question to Claude AI → Returns the answer with source citation. The rest of your documents stay untouched on your server.
| What happens to your data | Cloud AI tools | Locally-hosted (Weld AI) |
|---|---|---|
| Your documents uploaded to external servers | ✗ Yes | ✓ Never |
| Documents stored on third-party infrastructure | ✗ Yes | ✓ Never |
| Used to train AI models | ~ Depends on settings | ✓ No — Anthropic API TOS prohibits it |
| What gets sent per query | Varies — often full document | Question + 2–3 relevant paragraphs only |
| Data remains under your control | ✗ Partial | ✓ Full control |
| GDPR data processor agreement available | ✓ Usually yes | ✓ Yes (Anthropic) |
The SRA Code of Conduct requires solicitors to keep client information confidential and to consider carefully before sharing it with third parties. Uploading client documents to a cloud AI platform constitutes sharing with a third party — and the SRA's guidance on technology and AI emphasises that firms remain responsible for client data regardless of what tools they use.
For routine internal knowledge — procedures, precedents, standard clauses — cloud AI is likely low risk. For client-specific files, the calculus changes significantly.
Accountancy practices handle significant volumes of personal data — tax returns, payroll records, management accounts. Under UK GDPR, transferring this data to a cloud AI provider requires a lawful basis and typically a Data Processing Agreement with the provider.
Most major AI providers do offer DPAs, but you need to read them carefully. Some reserve the right to use your data to improve their models unless you opt out or use an enterprise tier.
HR files contain some of the most sensitive personal data a business holds — disciplinary records, medical information, salary data. Using a cloud AI tool to search HR files without explicit DPIA assessment and staff notification could create ICO exposure.
Weld AI uses Anthropic's Claude API to generate answers. When a question is asked, the question and relevant document excerpts are sent to Anthropic's API. Here's what Anthropic commits to:
You can review Anthropic's full privacy policy and DPA at anthropic.com/legal.
Based on conversations with accountants and solicitors, here's a sensible approach to deploying AI document search without creating compliance headaches:
Starting with green-light documents gives your team the productivity benefits of AI search immediately, while you take the time to assess the compliance picture for more sensitive data.
AI document search is not inherently incompatible with client confidentiality — but the architecture matters enormously. A cloud tool that stores your documents on external servers is a fundamentally different proposition from a locally-hosted system where your documents never leave your network.
For most small professional services firms, the pragmatic starting point is clear: deploy AI for your internal knowledge first, get comfortable with how it works, and expand carefully from there.
The firms that figure out how to use AI responsibly within their compliance framework will have a real advantage over those that either avoid it entirely or adopt it without thinking through the implications.
We offer a free 20-minute demo using your own documents — so you can see exactly what gets sent where, and make an informed decision.
Book a free demo →No obligation · Remote screen-share · UK-wide