AI settings for a small law firm

If your firm uses Claude, ChatGPT or Microsoft Copilot, a handful of settings decide where client words end up and who can pull firm files into a chat. This page lists them tool by tool. Every line links to the vendor's own page.

Checked against vendor pages on October 24, 2026

Claude (Anthropic)

1. Use Team or Enterprise for firm work. Anthropic says it does not train on inputs or outputs from its commercial products. The one exception is feedback: a thumbs up or down, or a bug report, can be used for training and is kept for 5 years. An Owner can turn feedback off for the organization. Do it.
   Anthropic: is my data used for training, how long Anthropic stores organization data
2. Know the retention you have. On Anthropic's commercial plans, deleted chats leave its back-end storage within 30 days. Only Enterprise lets you set a retention period (Organization settings, Data and Privacy). The default there is indefinite and the minimum is 30 days.
   Anthropic: how long Anthropic stores organization data, Anthropic: custom data retention
3. Turn on single sign-on. Team and Enterprise both have SSO once you verify your domain. Automatic user provisioning (SCIM) is Enterprise only.
   Anthropic: before enabling SSO
4. Decide on connectors before staff do. Connectors pull Google Drive, Microsoft 365 and other systems into a chat. An Owner adds them under Organization settings, Connectors, and can set each tool to always allow, needs approval, or blocked. On Team, "let members request connectors" is on by default.
   Anthropic: connectors for Team and Enterprise
5. Pick a rule on memory. Claude can remember past chats. Enterprise admins can switch memory off. On Team, have staff use incognito chats for matter work: those are not saved to history or memory.
   Anthropic: memory
6. If you need an audit trail, that is Enterprise: audit logs cover the past 180 days, exported from Organization settings, Data and Privacy.
   Anthropic: access audit logs

Personal plans: since the consumer terms change of August 2025, Free, Pro and Max users choose whether their chats train the model, and if they opt in, chats are kept for 5 years instead of 30 days. Anthropic: updates to consumer terms

ChatGPT (OpenAI)

1. Use Business or Enterprise. Business is the plan that used to be called Team; OpenAI renamed it in August 2025 and kept features and pricing the same. OpenAI says it does not use business data for training by default.
   OpenAI: enterprise privacy, OpenAI: Business rename FAQ
2. Set retention on purpose. Workspace admins on Business can control how long data is kept. Deleted chats are removed within 30 days unless the law requires otherwise.
   OpenAI: enterprise privacy
3. Turn on SSO. It is on Business and Enterprise. SCIM is Enterprise only.
   OpenAI: SSO overview, OpenAI: SCIM
4. Review apps the day you set up. On Business, apps are on by default and Google Drive actions are on by default. Business has no per-role app access, so one setting covers everyone.
   OpenAI: apps in ChatGPT workspaces
5. Teach Temporary Chat for one-off sensitive questions. Those chats are deleted within 30 days and are not used for training.
   OpenAI: data controls FAQ
6. If anyone still uses a personal account, Plus included, have them turn off "Improve the model for everyone" under Settings, Data Controls. OpenAI trains on those conversations unless the user turns it off.
   OpenAI: data controls FAQ

Microsoft 365 Copilot

1. Sign in with the work account, every time. Microsoft's enterprise data protection only covers people signed in with a Microsoft Entra work account. Look for the green shield and the "Work" label before typing client facts. A personal Microsoft account does not get it.
   Microsoft: manage Copilot, Microsoft: enterprise data protection
2. Training: Microsoft says prompts, responses and data reached through Microsoft Graph are not used to train foundation models.
   Microsoft: Copilot privacy
3. Fix oversharing before you buy seats. Microsoft says Copilot only surfaces data the user already has at least view access to. So if a matter folder is open to "Everyone except external users" or shared by a link anyone can use, Copilot can surface it to anyone in the firm. A Copilot license includes the SharePoint data access governance reports on sharing links and "Everyone except external users" access.
   Microsoft: Copilot privacy, Microsoft: SharePoint features with a Copilot license
4. Make a choice on web search. The policy is called "Allow web search in Copilot" and lives in the Cloud Policy service for Microsoft 365. If nobody sets it, web search is on. One option turns it off in Work mode only.
   Microsoft: manage web search in Copilot
5. Keep the record. Copilot activity is logged in Microsoft Purview Audit (Standard) as CopilotInteraction once auditing is on. Admins can also set Purview retention policies for Copilot chats; match them to your file retention.
   Microsoft: audit logs for Copilot, Microsoft: retention for Copilot
6. Lock down agents. In the Microsoft 365 admin center, go to Agents, then Settings. Untick agents from external publishers, and under User access limit who can use agents until you have looked at each one. User access is set to all users by default.
   Microsoft: agent settings, Microsoft: manage agents

What this page is not

This is a tech settings checklist, not legal advice. ABA Formal Opinion 512 (July 29, 2024) walks through how the rules on competence, confidentiality, communication and fees apply when lawyers use generative AI. The settings above are the technical half. Your ethics rules and your state bar's guidance are the other half, and those are yours to decide.

For what each vendor puts in writing on training, retention, subprocessors and breach notice, see what your firm should have in writing.

Who wrote this

I'm Nick Kaufman. I've spent six years in customer-facing technical support for SaaS, payments and CRM software, including three years at Tier 2 on a CRM built for financial advisors, whose firms work under SEC and FINRA rules. I'm not a lawyer and I don't give legal advice. I set up software so it does what the people responsible for it decided it should do.