A compliance reviewer approving an AI research tool for a law firm needs proof of four things: how firm data is kept separate from other tenants, what happens to document text once it leaves encrypted storage, whether any vendor trains models on client files, and what happens when the tool doesn't know an answer. Vorticel is a private, multi-tenant AI research assistant built for exactly this kind of scrutiny — firms upload their own documents and get answers grounded in those files, with citations back to the page they came from, and nothing is answered from outside knowledge. This article walks through what to check, in the order a reviewer actually needs to check it, before signing off.
What should a compliance review of an AI research tool actually check?
It should check data flow, isolation, retention, and vendor use — not marketing language. A vendor's page can say "secure" and "private" without telling you who touches your documents or when. The table below is the minimum a reviewer should get answered, with a citable source for each answer.
| Check area | What to verify | Where to look |
|---|---|---|
| Tenant isolation | Whether one firm's documents can ever be returned to another firm's query | Vendor's security page and data-flow diagram |
| Encryption at rest | Whether uploaded files are encrypted before being written to disk, and with what | Security documentation, ask for the specific library or standard |
| Sub-processors | Which third parties receive document text or passages, and for what step | Sub-processor table on the security page |
| Training-data use | Whether your documents, questions, or answers are used for model training | Get it in the vendor's written policy, not a sales conversation |
| Refusal behavior | What the tool does when an answer isn't in the uploaded documents | A live test during trial, not a claim |
How does tenant isolation keep one firm's files separate from another's?
Every document, extracted passage, and question is tagged with the firm's account at the moment it enters the system, and every database lookup is filtered to that tag before anything is returned. There is no shared search index across firms and no query path that can return another firm's documents — the boundary is enforced at the data layer, not just in the interface. A reviewer should ask a vendor to state this in writing, not just describe it as "secure multi-tenancy," and should ask what happens on a lookup that omits the tag by mistake: a well-built system fails closed (returns nothing or a 404), not open.
This matters more for a law firm than for most software categories, because the documents at stake are privileged client material, not internal notes. A vendor that can't describe its isolation mechanism in one clear sentence probably hasn't had to defend it under review before.
What happens to document text when it leaves encrypted storage?
Uploaded documents are encrypted per firm before they're written to disk, and the original file stays encrypted until the firm requests it back. To make the documents searchable, extracted text is split into passages and sent to an embedding provider (Voyage AI) to be converted into numeric vectors — this is the one point where document text leaves the vendor's infrastructure, and it happens to be embedded, not read or retained. When a user asks a question, only the specific passages retrieved for that question are sent to a language model (Anthropic's Claude) to draft the answer; the full document is never sent anywhere for that step.
A reviewer should get this sequence in writing, in order, with the name of each vendor that touches text and exactly what each one receives. "We use AI" is not an answer a compliance file can rely on. "Passage-level text goes to provider X for embedding, retrieved passages go to provider Y for drafting, the original file never leaves encrypted storage" is.
Reading a vendor's data-flow diagram is the fastest way to get these answers, and Vorticel's documentation lays out the retrieval and citation mechanism step by step if you want to see how the pieces fit together before running a live test.
What should a reviewer ask about sub-processors and training data?
A reviewer should get a named list of every sub-processor, what each one receives, and a direct answer on whether any of it is used for model training. Vorticel does not use uploaded documents, questions, or answers to train any model; the two sub-processors in the pipeline (Voyage AI for embeddings, Anthropic for answer drafting) each receive only the minimum data their step requires, and neither retains it for training. This is a policy statement, and a reviewer should treat any vendor's version of it the same way: ask for it in writing, and ask what recourse exists if it turns out to be false.
It's also worth asking what a vendor is not. Vorticel is not a law firm and does not give legal advice — it finds and cites what the firm's own documents say, and says so plainly when the documents don't contain an answer, rather than guessing. It is not SOC 2 or ISO certified today, is not available on-prem, and does not integrate with practice-management tools like Clio or research platforms like Westlaw or Lexis. A vendor that volunteers these limits before you ask is easier to trust on the claims it does make.
A five-step checklist to run before approval
- Get the data-flow sequence in writing: upload, encryption, embedding, retrieval, drafting, in order, with every vendor named at each step.
- Confirm tenant isolation is enforced at the data layer, and ask what happens on a lookup that fails to scope by firm.
- Get a written answer on training-data use, not a verbal assurance.
- Run a live trial: upload a real (non-privileged, or de-identified) document set and confirm the tool cites the page it answered from, and refuses when the documents don't contain an answer.
- Check plan-level limits against your firm's actual usage — question volume, seat count, and whether you need API access for automated ingestion — before committing to a tier.
Is the cost of a compliance review worth it for a $49-a-month tool?
Yes, and the review scales with the risk, not the price. A tool that touches privileged client material carries the same exposure whether it costs $49 or $4,900 a month, because the cost of a real isolation failure or an undisclosed sub-processor is measured in client trust and bar obligations, not subscription fees. The most common objection at this stage isn't price — it's a version of "we could just have an associate paste text into a general chat tool instead of paying for a dedicated one." That skips the review entirely: a general chat tool has no per-firm isolation boundary to review, no documented retention policy tied to your account, and no citation mechanism to verify an answer against the source page. The review this article describes is the thing a $20-a-month general-purpose tool has no equivalent of at all.
If your firm's checklist is answered the way this article describes it, the next step is to see it directly rather than take it on faith. Start a 14-day free trial at vorticel.com/signup — no card required — upload a real document set, and run your own isolation and citation test before you approve anything firm-wide.