Legal AI security questionnaires run to hundreds of rows, but one question decides most of the others: where does the system run, and who controls that boundary? Answer it precisely and the rest of the questionnaire mostly fills itself in. Answer it vaguely and no volume of certification paperwork will save you.
"Tenant isolation" is the term of art for that question. Here is what it means concretely, without the vendor gloss.
The deployment spectrum
There are four basic ways an AI system can be deployed relative to your firm, and they are not variations on a theme. They are different security postures.
- Consumer SaaS. Shared infrastructure, shared models, terms of service you accept rather than negotiate. Your data leaves the firm, and your controls are account settings.
- Enterprise SaaS, multi-tenant. Contractual protections, SSO, encryption in transit and at rest. But your data sits in the vendor's cloud beside other customers' data, separated by software logic rather than account boundaries. The boundary is the vendor's, and so are the keys.
- Single-tenant, vendor-hosted. A dedicated instance for your firm in the vendor's cloud. Isolation improves markedly: no shared databases, no shared indexes. Keys and network are still ultimately the vendor's.
- Single-tenant, your cloud. The system deploys into the firm's own cloud subscription. Client data never leaves your boundary; the vendor ships software into your environment instead of taking your data into theirs.
Vendor language blurs these categories aggressively. "Private cloud," "dedicated environment," and "virtual private deployment" can each describe either of the middle two models. The test that cuts through the marketing is short: in whose cloud subscription does the system run, and who administers it? If the answer is the vendor, you are in model two or three, whatever the brochure says.
Reframe deploys as the fourth model by default, inside the customer's own Azure tenant, with vendor-hosted single-tenant as the alternative for firms that prefer it. Our security overview documents the specifics; what follows is the general case, vendor aside.
What actually changes as you move down the list
Each step changes concrete facts, not just contract language.
Data residency. "Your data stays in your region" becomes a physical fact of your own subscription rather than a line in a contract. For firms with clients in regulated industries, or matters subject to cross-border transfer rules, this stops being abstract very quickly.
Key custody. In your own tenant, encryption keys are customer-managed, held in your own key vault, HSM-backed if you choose. Revoking a key is a kill switch you own. Nobody reads your data once your keys are withdrawn, including the vendor.
Network path. Traffic between components moves over private endpoints inside your virtual network, with no public egress. There is no public API endpoint holding your document corpus behind a login page, because there is no public endpoint at all.
Identity. Access runs through the firm's own Entra ID: your conditional access policies, your MFA, your joiner and leaver process. When someone leaves the firm, their AI access dies with their directory account, not on a vendor's schedule.
Blast radius. A breach of the vendor, or of another customer of the vendor, does not reach you. In multi-tenant systems the honest answer to "could another tenant's incident affect us" is a paragraph of qualifications. In your own tenant it is no.
Legal process. Subpoenas and other process aimed at your data go to whoever holds it. When the system runs in the firm's tenant, the firm holds it, and the firm's lawyers respond. Third-party custody creates scenarios where data moves before the firm can object, or without the firm knowing at all.
Vendor access. Standing vendor access to a shared platform becomes brokered, logged, time-boxed access to your environment, granted by you, or no access at all. Support becomes something you authorize, not something that silently exists.
Query-time permissions and ethical walls
Isolation from the outside world is half the problem. The other half is isolation inside the firm: an associate walled off from a matter must not be able to reach its contents through an AI answer.
The requirement is simple to state and demanding to implement: every retrieval must be filtered by the asker's current entitlements, mirrored from the DMS ACLs and the firm's wall system, and evaluated at query time. Nightly permission syncs fail this test. Ethical walls go up mid-matter, when a lateral arrives or a conflict crystallizes, and a wall erected at two in the afternoon has to bind the query five minutes later. A stale index that answers from yesterday's permissions is a breach with a timestamp.
This mirrors how document management systems already behave: need-to-know matters, private workspaces, walled teams. The AI layer must be at least as strict as the DMS underneath it, because an answer synthesized from a document is still a disclosure of that document.
The same rule extends to agents: an automated workflow inherits the permissions of the person or process that invoked it, never a privileged index of everything. Governing that properly is its own topic, covered in our piece on agentic legal workflows.
Model endpoints inside the boundary
A quieter question worth asking every vendor: when the system calls a model, where does that call go?
If prompts and retrieved context travel to a shared public API, then whatever the contracts say, your most sensitive material transits infrastructure you do not control. The alternative is private model deployments provisioned inside the same cloud boundary as the rest of the system: dedicated endpoints, no public routing, no training on your traffic as a property of the architecture rather than a clause in a policy. This is how the Reframe platform runs inference: models deployed inside the tenant, alongside the Context Graph they draw on.
Audit that survives scrutiny
The standard is immutable logs: every prompt, every retrieval, every output, tied to a user, a matter, and a timestamp, in storage that cannot be quietly edited. Three audiences need it. Clients, whose outside counsel guidelines increasingly ask exactly this. Insurers and auditors, who want evidence rather than assurances. And the firm itself, when it needs to reconstruct how an answer was produced and what the attorney saw.
Immutable audit is also what makes supervision practical. You cannot supervise what you cannot see, and the professional responsibility framework assumes you can see it.
Retention deserves its own sentence. The audit trail should live in the firm's tenant with the rest of the system, on the firm's retention schedule, because a log held by the vendor is one more copy of sensitive metadata sitting outside the boundary. Who asked what about which matter is itself confidential information, and it deserves the same protection as the answers.
What certifications do and do not tell you
SOC 2 Type II attests that a vendor's controls operated effectively over a period, in the vendor's environment. ISO 27001 certifies the management system around security. The NIST AI Risk Management Framework brings AI-specific risks into scope. All are worth requiring, and all describe the vendor's house.
A certification tells you how the vendor runs their environment. Tenant isolation decides whether their environment is where your client data lives at all.
When the system runs inside your own tenant, certifications still matter as evidence of the discipline of the people shipping software into your environment. But the center of gravity moves to controls you can verify yourself: your keys, your network rules, your logs, your identity system. That inspection, not a badge, is what your clients are really asking about. Nor is deployment into your own tenant a long program; our delivery process stands up the enclave, the graph, and the audit plumbing faster than most firms clear a vendor questionnaire.
So reorder the questionnaire. Put "whose tenant does this run in" first, and let the answer decide how much the remaining two hundred rows matter. Then compare the models honestly, including against the public tools your attorneys already use; our comparison of private legal AI and public chatbots is the place to start.