LLM Confidentiality Environment

Prepared 6 September 2026

Legal Landscape
Case Law on LLMs & Confidentiality

The emerging U.S. case law on large language models and confidentiality turns on a single distinction: consumer / public AI tools versus enterprise and API deployments governed by contract. Every reported decision adverse to AI confidentiality to date involves a consumer tool whose terms permit training and disclosure. Crossband.io's configuration — commercial / API access, contractual no-training, and enterprise data-processing terms on both providers — sits on the protected side of that line.

The leading case — United States v. Heppner

United States v. Heppner, No. 25-CR-503 (JSR), 2026 WL 436479 (S.D.N.Y. 2026) (Rakoff, J.), is the first federal ruling to address whether information submitted to an AI tool retains privilege or work-product protection. A criminal defendant, without his counsel's involvement, entered information he had learned from his attorneys into a consumer, non-enterprise version of Anthropic's Claude. Judge Rakoff held the interactions were not privileged.

The court's reasoning is the operative part for configuration purposes: it focused on whether there was a reasonable expectation of confidentiality, and found none because the consumer terms of service and privacy policy permitted the provider to log inputs and outputs, use them to train models, and disclose information to third parties. Submitting information to a system whose own terms undermine confidentiality was inconsistent with maintaining that expectation. The ruling has been widely analyzed — see, for example, case commentary from Harvard Law Review, Husch Blackwell, Chapman and Cutler and Harris Beach Murtha, and bar-association analyses from the Maryland State Bar Association and the New York State Bar Association.

The consumer-versus-enterprise distinction

Analysis from firms including Proskauer Rose, Paul, Weiss, White & Case, K&L Gates and Duane Morris has converged on the same reading: the outcome was driven by the consumer deployment, and enterprise / API deployments are materially different. The very features the court found missing — a prohibition on training on customer data, restricted access, enterprise-grade security, and contractual privacy commitments — are the features that define enterprise use. As several of these analyses observe, an enterprise AI tool used under such terms may be treated more like a third-party consultant (whose involvement does not defeat confidentiality or privilege) than like disclosure to the public — a line Norton Rose Fulbright draws in the same direction for public and open AI tools.

Work product is more forgiving still

Separately, the work-product doctrine is waived only by disclosure to an adversary, or in a manner likely to reach one. In Warner v. Gilbarco, Inc., as reported in contemporaneous commentary, the use of an AI tool alone did not waive work-product protection absent such adversarial disclosure.

Application to Crossband.io — current configuration, pre-ZDR

Under the standard these authorities articulate, Crossband.io's current usage is defensible without zero data retention:

Bottom line: the reported decisions adverse to AI confidentiality involve consumer tools whose terms permit training and disclosure. Crossband.io uses commercial / API deployments with contractual no-training and enterprise data-processing terms — the configuration these same authorities identify as protected. The pending Zero Data Retention and prompt-logging opt-outs strengthen this position further, but are not required to meet it.

Jurisdiction
Canada

Crossband.io operates from Canada, so its handling of company and personal data is governed primarily by Canadian privacy law and professional-conduct standards. Canada has not produced a confidentiality decision on point, but the applicable regulator and professional guidance point in the same direction as the U.S. case law: the risk lives with tools that retain or train on inputs — precisely what Crossband.io's configuration contracts away.

Privacy law — PIPEDA and the OPC

Under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), an organization remains accountable for personal information it transfers to a service provider, including a processor located outside Canada, and must use contractual and other means to ensure a comparable level of protection. Crossband.io's use of Anthropic and Google under their respective data-processing addenda (no training on customer data; contractual confidentiality and security terms) is the accountability mechanism PIPEDA contemplates for such a transfer.

The Office of the Privacy Commissioner of Canada (OPC), in its Principles for responsible, trustworthy and privacy-protective generative AI technologies (December 2023), advises that sensitive or confidential information be entered into a prompt only where authorised, and that prompts should not be retained, used for secondary purposes, or disclosed unless required. Crossband.io's no-training terms, limited and purpose-restricted retention, and pending retention opt-outs align with that guidance. Notably, the OPC's own enforcement attention has fallen on a consumer product — its joint investigation of OpenAI (PIPEDA Findings #2026-002) — reinforcing the same consumer-versus-enterprise theme seen in the U.S. cases.

If Crossband.io processes the personal information of Quebec residents, Quebec's Law 25 imposes additional obligations (including transfer assessments and enhanced consent) that should be assessed separately.

Professional-conduct guidance — law societies

Canadian law societies have applied existing duties — competence, confidentiality, and supervision — to generative AI rather than writing new rules, as summarized by Osler, Hoskin & Harcourt and in Clio's province-by-province survey. The recurring theme is directly on point: guidance warns that informed client consent may be required before confidential information is uploaded to an AI platform that retains user inputs or uses them to train future models. A platform that does neither — Crossband.io's enterprise configuration — sits on the better side of that guidance.

Canadian case law status

Canadian courts have not yet decided whether use of an AI tool waives confidentiality or solicitor-client privilege; that question is open. The Canadian AI decisions to date — Zhang v. Chen, 2024 BCSC 285, and Ko v. Li (2025, ONSC) — concern counsel citing AI-hallucinated authorities (an accuracy and candour problem), not confidentiality. Solicitor-client privilege is treated as near-absolute in Canada, so the U.S. "reasonable expectation of confidentiality" reasoning is persuasive but not binding here, and should be treated as directional rather than settled.

Caveats

This is a fast-moving and unsettled area. Heppner is a single district-court decision (S.D.N.Y.), not appellate authority, and is not binding outside that court. These cases concern attorney-client privilege and the work-product doctrine; Crossband.io's primary interest is contractual and fiduciary confidentiality, to which the "reasonable expectation of confidentiality" reasoning transfers but is not identical. In Canada, the OPC principles and law-society guidance are interpretive rather than binding law, no Canadian court has yet ruled on AI confidentiality or privilege, and cross-border transfer to U.S.-based providers is permitted under PIPEDA's accountability model but carries the usual exposure to foreign legal process. Case citations, dates and pinpoints should be confirmed against the primary sources. This document is an internal analysis and does not constitute legal advice.

Next: Platform Security & Controls