What "your files never leave the building" means, technically

A marketing phrase with a testable meaning

"Your data stays private" has become table stakes in AI sales copy, which is a problem, because the sentence covers everything from a genuinely offline appliance to a cloud service that promises to delete your uploads later. Those are very different arrangements, and the difference matters to a firm that has to answer a client's confidentiality question in writing.

The good news is that this claim, unlike most vendor claims, can be reduced to something concrete. Either bytes derived from your client files cross the boundary of your network, or they don't. That's an engineering question with an answer your IT person can produce.

Three things that can leave, not one

When a firm pictures data leaving, it pictures documents being uploaded. That's the obvious channel, and it's the one vendors address. There are two quieter ones.

• The documents themselves. PDFs, transcripts, medical records, correspondence. Anything sent to an outside service for processing, whether that's the model, an OCR service, or a translation API.
• What the system derived from them. Extracted text, search indexes, vector embeddings, summaries, and prompt logs. These aren't the original files, so vendors sometimes treat them as a separate category. Your client won't. An embedding built from a deposition is still built from the deposition, and text extracted for a query is the record in another shape.
• Telemetry and metadata. Usage analytics, crash reports, license checks, error traces, update pings. This is where careful-sounding systems leak. A crash report can carry the filename, the matter name, or a fragment of the document that caused the crash. A license check that phones home every hour tells an outside party when your firm works and how much.

A claim worth trusting covers all three. When you ask a vendor about this, ask about each one by name, because "we don't store your documents" is a true sentence that leaves both of the others unanswered.

What the architecture has to do

In the Tiber River Legal Workbench, the boundary is the machine in your office. The model weights sit on its drive. Inference runs on its own hardware. Document text, the search index, and the derived structures all live on encrypted local storage and get written nowhere else. There is no account to log into, no bucket in a region, no subprocessor list, because there's no outside service in the path at all.

The parts that normally justify a network connection get handled differently. Software and model updates arrive as a package the firm reviews and installs on its own schedule, the way you'd handle any other on-premises system. Diagnostics stay on the box and get read locally by whoever is troubleshooting. Nothing calls home to tell us the appliance is alive, so the system behaves identically whether or not the office has internet at all.

How to actually test it

This is the part most firms skip, and it's the part that turns an architecture into evidence. None of it requires a security consultant.

1. Give the appliance its own network segment. Put it on a dedicated VLAN or subnet so everything it sends has to pass one place you control.
2. Log every outbound connection at the firewall. Turn on logging for that segment before anyone uses the system, and include DNS lookups. Name resolution is the quietest tell there is: a machine that never sends data still has to ask for an address first.
3. Run a normal week of real work. Load matters, build chronologies, ask questions, generate digests. A test that only exercises the login screen proves nothing.
4. Read the log. Not a summary of the log. The entries. You're looking for any destination outside your network, at any hour, of any size.
5. Then cut the cord. Block outbound traffic from that segment entirely, or unplug the uplink, and do another day of work. If the system keeps doing its job with no outside route available, you have the answer, and you have it from your own equipment rather than from us.

Keep the firewall logs and a short note describing what you ran. That file is what you hand a client, an insurer, or opposing counsel when someone asks how your firm handles AI and client confidentiality. It's a much better answer than a vendor's brochure, because it's yours.

The caveat that keeps this honest

Hardware in a closet isn't a security program by itself, and we've written about that before: an appliance that's unpatched, unlogged, and open to everyone in the office is just risk that stays home. Custody is the foundation, not the whole building. On top of it you still want matter-level access controls, ethical walls, and a record of who saw what. What no egress gives you is the one thing a cloud arrangement can never give you: the ability to prove the confidentiality claim yourself, on your own network, whenever you feel like checking it again.

Related reading: Private AI for law firms: why client files should stay in the building, how to read an AI vendor's security page, the verification tax, and why AI output should wait in an approval queue.