Private AI for law firms

A 12-person firm, one confidential matter, and the wrong search result

Consider a 12-person firm with litigation, employment, and corporate teams. A partner asks an internal AI assistant to find a termination clause used in a recent transaction. The document index contains a useful clause—but it belongs to a restricted merger matter. A chat-layer role label is not enough. If retrieval already placed that passage in the prompt, the confidentiality failure happened before the model wrote a word.

Zimmer Server resolves this scenario at the retrieval boundary. The employee belongs to one or more groups, collections remain private until shared, and the vector search applies those grants as a hard filter. The model receives only passages the employee is cleared to read. A grant or revocation takes effect on the next question, and denied retrieval is recorded in the access log.

The data boundary a managing partner can explain

Zimmer Server keeps inference, document indexing, retrieval, and agent tool calls on the firm’s Apple-silicon Mac or local network. There is no Zimmer cloud backend holding client content. The only named account transfer in the pilot is the organisation name, administrator name, and work email used for registration; paid licences carry billing identity, not matter content.

This is an architectural choice, not a compliance certificate. Zimmer does not claim HIPAA, ISO 27001, or SOC 2 certification, and a local installation does not discharge a firm’s legal, professional, or security duties. The CCBE’s 2026 technical guide describes on-premises systems as offering maximum control while placing security, updates, maintenance, and compliance responsibility on the user organisation.

In plain terms, Zimmer combines a local-first workspace with an on-premise appliance: open-weight models run on a Mac or Windows PC for personal work, while a company-owned Apple-silicon server keeps organisational prompts, files, and answers on the firm’s network.

How in-retrieval RBAC protects ethical walls

Zimmer Server enforces access inside vector retrieval, not as an instruction pasted into the system prompt. Users join groups such as Legal, Finance, HR, or Everyone; a law firm can use the same mechanism for practice areas, deal teams, or matter groups. Collections are private until an administrator shares them with a group.

1. 1. IdentifyThe signed request identifies the enrolled device and user before search begins.
2. 2. FilterVector retrieval excludes passages outside that user’s group grants.
3. 3. GenerateOnly authorised passages enter the model context used to produce the answer.

The distinction matters because prompt injection cannot recover text that was never retrieved. It also makes a useful acceptance test: log in as a restricted user, ask for a known document from another matter, confirm that no passage is returned, then check the denied-retrieval log.

Citations make document Q&A reviewable, not authoritative

Zimmer Server returns clickable citation chips with document answers. PDF citations open the relevant page; Word and Markdown citations open the relevant section. If the indexed documents do not support an answer, Zimmer says so. That shortens verification, but it does not turn model output into legal authority or remove the need for lawyer review.

The American Bar Association’s Formal Opinion 512 identifies competence, protection of client information, communication, supervision, candour, and fees among the duties lawyers must consider when using generative AI. A source link supports those duties by making review easier; it does not replace professional judgement.

Remote lawyers connect without a public server port

Zimmer Server opens zero inbound ports. An administrator creates a single-use enrolment payload that expires after 60 minutes. The employee pastes it once, the device creates a keypair, and the private key is sealed in the Mac Keychain. Later requests are signed by that device; browser users receive a one-time sign-in code.

The same enrolment joins the device to an end-to-end encrypted WireGuard-class mesh. The firm does not need a public IP, port forwarding, or an inbound firewall change. Revoking the device denies its next request. This avoids shared passwords while giving the administrator a specific control to test during a pilot.

What a security reviewer should compare

A law-firm AI review should compare enforcement points and failure behaviour, not privacy adjectives. The table below separates an on-premises Zimmer Server deployment from a generic hosted assistant without assuming that either option satisfies a firm’s obligations automatically.

Costs, hardware, and the honest limit

A small firm can host Zimmer Server on a supported Mac mini; a Mac Studio is recommended for a team. The self-service pilot includes three seats. Team pricing is $29 per user per month or $250 per user per year billed annually. Usage is not metered, so repeated document questions do not add per-token charges.

The trade-off is model quality and operational responsibility. A hosted frontier model outperforms any model that fits on a laptop or small server. Without suitable hardware, cloud AI is cheaper to start. Zimmer Server currently hosts only on Apple-silicon Mac hardware; native Windows server hosting, Linux or GPU nodes, and Enterprise SSO are not shipped.

Those limits should be part of procurement. A firm that needs Entra ID today, a certified compliance posture, or the best available model quality should choose another option or retain a hosted tool for selected work. A firm whose decisive requirement is control over confidential document flow may accept the local model trade.

A pilot that tests the risky path first

A Zimmer Server pilot should start with one representative matter, not the whole archive. Create two groups with deliberately different access, index a small PDF and Word collection, and enrol three pilot users. Ask the restricted account for a phrase known to exist only in the protected collection. Confirm that retrieval refuses it and that the access log records the attempt.

Then ask an authorised user a question whose answer spans two documents. Open every citation and compare the cited passage with the answer. Revoke one user and repeat the request. Finally, disconnect the public internet and confirm the local workflow still answers. This tests confidentiality, verifiability, revocation, and continuity rather than merely testing whether a chatbot sounds fluent.

For the implementation boundary, review the Zimmer security architecture. For the appliance and team workflow, see Zimmer for Businesses. Pricing and the free pilot are documented on the Team plan page.

Questions a law-firm buyer should ask