Compliance
Data security built to help you meet LSO Rules.
Surface is designed from the ground up to help Ontario lawyers meet their professional obligations while still getting the benefits of AI. Here's how.
Why most AI tools put Ontario lawyers at risk
The Law Society of Ontario's Rules of Professional Conduct already govern how you can use technology. Rule 3.3-1 requires you to hold all client information in strict confidence. Rule 3.1-2 (competence), whose commentary addresses technological competence, expects you to understand and manage the risks of the technology you use.
These Ontario rules reflect a national standard. The Federation of Law Societies of Canada's Model Code of Professional Conduct — adopted by law societies across Canada — carries the same duties of confidentiality and technological competence, and the Federation added that duty of technological competence in 2019, tying it directly to maintaining privilege. Whichever province you practise in, the underlying obligation is the same.
Most popular AI tools — ChatGPT, Google Gemini, and other US-based services — process your data on American servers. Under the US CLOUD Act, the US government can compel American companies to produce data stored on their servers, regardless of where the user is located. That means a client's confidential information could, in theory, be accessed by a foreign government without your client's knowledge or consent — a direct tension with your confidentiality duty.
How Surface helps you meet them
Canadian servers
Your client data is stored in a Canadian data centre (AWS Montreal, ca-central-1), keeping it within Canadian jurisdiction and outside the reach of the US CLOUD Act.
Data Processing Agreement
A DPA is available on request for firms that require one — documented proof of the reasonable measures Rule 3.3-1 expects.
Never trains AI models
Your documents are never used to train AI models. Client information is processed to answer your questions and nothing else.
Audit logs
Every access and action is recorded, so you can demonstrate exactly who touched a client's information and when — if you're ever asked.
Per-matter isolation
Documents live inside client matters, isolated from one another, so information stays scoped to the file it belongs to.
What happens if you use ChatGPT for client files
In plain English: every time you paste a client document — a contract, a family-law file, an immigration matter, estate financials — into ChatGPT, that text is sent to and stored by an American company on US servers. OpenAI's consumer and team products come with no Data Processing Agreement for individual lawyers, no guarantee the data stays in Canada, and no audit trail of who accessed it.
That combination can put you offside Rule 3.3-1 (confidentiality) and Rule 3.1-2 (competence), whose commentary addresses technological competence — and it's the kind of thing that leads to a complaint to the LSO. The tool being popular or convenient is not a defence.
The compliance checklist
To use AI legally for client work in Ontario, your tool needs to check every one of these boxes. Surface does.
AI you can use for client work, from day one.
Get the benefits of AI for your practice without the compliance exposure.
Start your free 14-day trialThis page is for informational purposes only and does not constitute legal advice. For specific questions about your professional obligations, consult the Law Society of Ontario.