Vendor: LAWSMITH.AI LLC, a New Jersey limited liability company. Contact: support@lawsmith.ai. The questions below are also the ones ABA Formal Opinion 512 asks, so the answers serve a firm in any state. The detail behind each one is on the Security and privacy pages.
Privacy: who sees client information
- What leaves your computer Only what a task needs: the intake answers and client details for a draft, the text of documents you add to start a matter, the earlier draft and your instruction for a revision, and your question at the research desk. Documents you add are read into text in your browser; the files themselves are not uploaded.
- Where it goes Over HTTPS to Lawsmith's server, which passes it to the AI model through OpenRouter and does not save it. The model providers: named on the Security page when the server can be reached.
- Who at Lawsmith can see it No one. Matter content is not stored on our server, and our logs record counts, never the client's name, the answers or the draft.
- Publishers Statutes and rules are fetched from fixed publisher addresses. Your question and your client's details are never sent to them.
Retention: what is kept, where, and for how long
| Information | Where | How long |
|---|---|---|
| Drafts, intake answers, documents you added, research conversations, review notes and drafting records | Your browser, on your computer, each encrypted (AES-GCM) | Until you delete the draft or use Close desk. Not backed up by Lawsmith. |
| Text sent to the model for a task | The model provider, on a route that must be marked for zero data retention | Not retained, as a routing requirement in our code (see below) |
| Your account: sign-in email, name, optional firm name, usual state, Stripe references, billing dates, usage totals | Lawsmith's server (Amazon DynamoDB, encrypted at rest) | Until you delete the account; database backups for 35 days |
| Your desk setup: letterhead, signature block, standing instructions, usual answers and saved blank forms with their Word files | Lawsmith's server, so they follow you to every device | Until you remove them or delete the account; backups for 35 days. Keep client facts out of them. |
| Firm and assistant membership, roles, invitations and a firm's shared blank forms | Lawsmith's server | Until removed; backups for 35 days |
| Event logs: who (your account), the kind of document, the state, timings and cost | Amazon Web Services, northern Virginia | 90 days |
| Feedback and ratings you send, and email to support@lawsmith.ai | Our mail storage, then the team's inboxes | 30 days in mail storage |
| Card payments | Stripe; card details never reach Lawsmith | Stripe's own records, as tax law requires |
Security
- Hosting AWS Lambda in the United States, reachable only through Amazon CloudFront. TLS 1.2 or later, HTTP redirected to HTTPS, HTTP Strict Transport Security.
- Sign-in A six-digit code emailed to you, single use, valid ten minutes, five tries. No passwords are stored. Sessions are HttpOnly, Secure, SameSite=Strict cookies, revoked on the server at sign-out.
- The page itself A strict content security policy lets only Lawsmith's own code run: no third-party scripts, trackers or ad tags.
- On your computer Saved work is encrypted with a key the browser will not hand to any web page. Your computer's login, screen lock and disk encryption still protect it while the computer is unlocked.
- Certifications Lawsmith has no SOC 2 or other third-party certification, and the model routing has not been independently audited.
Data use: training and sharing
- No training Every model request requires a route marked for zero data retention with data collection denied, with no fallback to another model. Lawsmith does not use what you enter to train or improve any model.
- No sale, no advertising Lawsmith does not sell or share client information, and the site carries no trackers.
- Service providers Amazon Web Services (hosting, database, sign-in and support email), OpenRouter (model routing), the model providers named above, and Stripe (payments).
Tool settings to check (policy rule 3F)
Lawsmith has no setting that shares your prompts or documents, or uses them to improve the tool, so there is nothing to switch off. Three features send information elsewhere, and each is your choice:
- Speak Dictation uses the speech service of your browser's maker (Apple in Safari, Google in Chrome). The audio goes to that company, not to Lawsmith. Type instead when a matter's facts should not go there.
- Email it Sends the Word file to the address you type, through Amazon's mail service, without keeping it.
- Send feedback and draft ratings Go to our team by email. Leave client facts out.
Verifying citations (policy rule 3E)
The policy requires every statute, rule, quotation and citation in an AI-assisted draft to be "verified by law firm personnel using an official source before it is relied on or filed." Lawsmith makes that check faster and leaves a record of it. It does not do the check for you.
- Each statute or rule a draft cites quotes the saved text it rests on, word for word, with the publisher's address, the date the text was saved and a fingerprint of it. A citation without a matching passage is marked [VERIFY] where it appears.
- The proof of sources lists every citation with the words it quotes, so the person checking can open the publisher's text and compare.
- Each source says whether its publisher's text is the official version. Only Delaware's and Ohio's online codes are designated official; elsewhere the website is a copy, and the label names the official publication where one is designated. The method page lists every state.
- A matching quotation shows the words are in the saved text. It does not show the law was applied correctly, that the text is current, or that a court reads it the same way.
- Case citations are not checked against the published opinion unless a CourtListener connection is configured, and then only for a reporter match.
- Facts and client-specific statements still need checking against your file, as rule 3E also requires.
How citations are checked explains the mechanism and its limits.
Transcription (policy section 4)
Lawsmith does not record or transcribe audio. It can read a transcript your firm already has (.vtt, .srt or pasted text) as a document for a matter; that transcript falls under your transcription rules.
Supervised staff (policy section 5)
- Professional includes one assistant login. The assistant drafts with the attorney's letterhead, signature block, standing instructions and saved forms, on the attorney's monthly allowance, and cannot change them. Drafts stay on the assistant's computer; the assistant sends the attorney the Word draft and its proof of sources for review.
- Firm plans give each person a named login. Only the owner adds or removes administrators. Members see the firm's blank forms and nothing of each other's matters.
- The supervising lawyer remains responsible for staff use and for the final work product. Lawsmith drafts; a lawyer reviews and signs.
Client communications (policy section 6)
Lawsmith never contacts your clients. The privacy page is written so you can hand it to a client who asks how their information is handled. Whether and when to tell a client is your decision under your policy.
What this page is not
It is a description of how Lawsmith works today, not legal advice and not a certification. Adopting an AI policy "is not a 'safe harbor'," in the Court's words, and the firm's own diligence governs. Ask anything this page does not answer at support@lawsmith.ai.
Source: New Jersey Supreme Court, Notice, "Responsible Use of Artificial Intelligence (AI) and Related Technologies: Benefits of AI Policies" (March 30, 2026), Example Starter AI Use Policy, rules 3C, 3E, 3F and sections 4 to 6. Printed November 9, 2026 from /vendor-review.