Legal AI
Clio Duo / Manage AI
Medium riskAI assistant built into Clio Manage, the dominant solo and small-firm practice management platform, answering questions and drafting from the firm's own matter data.
Is Clio Duo / Manage AI safe for confidential data?
Clio Duo (being folded into what Clio now calls Manage AI) is contractually well-positioned — it runs on Azure OpenAI, Clio states firm data is never used to train external models, and Clio holds a current SOC 2 Type II report and a published GDPR DPA. What earns it a medium rating is scope: unlike a research tool that sees one uploaded brief, Duo sits over the firm's entire matter database — every client, document, note, and billing entry in Clio Manage — so a permission mistake, a prompt answered from a matter a user should not see, or an account compromise has firm-wide blast radius. With 79% of legal professionals now using AI (Clio's own 2025 Legal Trends Report), the question for Clio shops is less whether to allow Duo than whether matter permissions are actually clean before switching it on.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Available only to Clio Manage subscribers under Clio's terms of service and DPA; no free tier. The Duo-to-Manage-AI rebrand changes packaging, not the published data commitments — but re-check terms at renewal.
Data handling
Training on inputs
Clio states data processed by its AI features is never used to train external AI models or LLMs; generation runs on Azure OpenAI, where Microsoft contractually does not use customer prompts to train foundation models.
Retention
Firm data remains inside Clio Manage; Azure OpenAI processing does not retain prompts for model improvement. Confirm in your subscription whether AI interaction logs are stored and for how long.
Residency
Clio is headquartered in Burnaby/Vancouver, Canada, and offers regional hosting for Clio Manage (including Canadian data residency options subject to plan); PIPEDA-conscious Canadian firms should confirm which region their instance and its AI processing run in.
Compliance
- SOC 2Yes
- GDPR / DPAYes
- HIPAA BAANot verified
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- Runs on Azure OpenAI (no training on customer prompts)
- SOC 2 Type II (current report via Clio Trust Centre)
- Published DPA and subprocessor list
- Matter-level permissions inherited from Clio Manage
- Two-factor authentication
Frequently asked questions
Is Clio Duo safe to turn on for our firm?
Contractually, yes — no training on firm data, Azure OpenAI processing, SOC 2 Type II, and a published DPA. Operationally, treat enablement as a permissions audit: Duo can only be as well-scoped as your Clio Manage access controls, and small firms often run with everyone-sees-everything defaults that were tolerable before an AI could summarize any matter on request.
Does Clio Duo share client data with OpenAI?
Prompts are processed through Microsoft's Azure OpenAI service, not OpenAI's consumer platform. Under Azure OpenAI terms, prompts and outputs are not available to OpenAI and are not used to train foundation models. Client data does leave Clio's application for that processing, so confirm the subprocessor list and region in your DPA.
If we adopt Clio Duo, does that solve our AI exposure?
No — it addresses one sanctioned tool. Clio's own 2025 Legal Trends Report found 79% of legal professionals use AI, and much of that usage is personal ChatGPT accounts outside any firm agreement. A sanctioned assistant inside Clio Manage reduces the temptation but does not eliminate it; most firms still need visibility and guardrails on the unsanctioned tools.
Policy changelog
- Initial entry published from Clio's published security documentation and cited coverage.
Sources
- Clio Trust Centre
- AI features in Clio Manage (Clio Help Center)
- Clio Data Protection Addendum
- Clio 2025 Legal Trends Report announcement
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Clio Duo / Manage AI is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
Thomson Reuters' professional AI assistant, delivered inside Westlaw Precision for legal work and as CoCounsel Tax, Audit & Accounting for advisory practices.
Legal AI platform for law firms and in-house teams: research, drafting, document review, and workflow automation built on foundation models.
LexisNexis' generative AI research and drafting assistant, now sold as Lexis+ with Protégé, grounded in the Lexis primary-law and Shepard's citation database.
Generative AI features (document summarization, drafting, text editing, search) embedded in the MyCase practice management platform for small firms, part of AffiniPay's 8am IQ initiative.