Compliance
LSO compliance & data security, built in.
Surface is designed from the ground up to keep Ontario lawyers compliant with their professional obligations while still getting the benefits of AI. Here's how.
Why most AI tools put Ontario lawyers at risk
The Law Society of Ontario's Rules of Professional Conduct already govern how you can use technology. Rule 3.3-1 requires you to hold all client information in strict confidence. Rule 3.1-2 (competence) requires you to understand and manage the risks of the technology you use.
Most popular AI tools — ChatGPT, Google Gemini, and other US-based services — process your data on American servers. Under the US CLOUD Act, the US government can compel American companies to produce data stored on their servers, regardless of where the user is located. That means a client's confidential information could, in theory, be accessed by a foreign government without your client's knowledge or consent — a direct tension with your confidentiality duty.
How Surface keeps you compliant
Canadian servers
Your client data is stored in a Canadian data centre (AWS Montreal, ca-central-1), keeping it within Canadian jurisdiction and outside the reach of the US CLOUD Act.
Data Processing Agreement
A DPA is available on request for firms that require one — documented proof of the reasonable measures Rule 3.3-1 expects.
Never trains AI models
Your documents are never used to train AI models. Client information is processed to answer your questions and nothing else.
Audit logs
Every access and action is recorded, so you can demonstrate exactly who touched a client's information and when — if you're ever asked.
Per-matter isolation
Documents live inside client matters, isolated from one another, so information stays scoped to the file it belongs to.
What happens if you use ChatGPT for client files
In plain English: every time you paste a client document — a contract, a family-law file, an immigration matter, estate financials — into ChatGPT, that text is sent to and stored by an American company on US servers. OpenAI's consumer and team products come with no Data Processing Agreement for individual lawyers, no guarantee the data stays in Canada, and no audit trail of who accessed it.
That combination can put you offside Rule 3.3-1 (confidentiality) and Rule 3.1-2 (competent, risk-managed use of technology) — and it's the kind of thing that leads to a complaint to the LSO. The tool being popular or convenient is not a defence.
The compliance checklist
To use AI legally for client work in Ontario, your tool needs to check every one of these boxes. Surface does.
Compliant AI, from day one.
Get the benefits of AI for your practice without the compliance exposure.
Start your free 14-day trialThis page is for informational purposes only and does not constitute legal advice. For specific questions about your professional obligations, consult the Law Society of Ontario.