Legal AI
Spellbook
Medium riskWord-embedded contract drafting and review copilot aimed at transactional lawyers at small and mid-size firms, built on OpenAI and Anthropic models.
Is Spellbook safe for confidential data?
Spellbook's published posture is solid for a small vendor: SOC 2 Type II, encryption in transit and at rest, and negotiated zero-data-retention agreements with its LLM subprocessors (OpenAI and Anthropic), meaning contract text sent for processing exists only in memory and is not persisted or used for training. The risks are proportionate to its profile rather than to any incident: client contracts still transit third-party model providers under commitments you cannot audit, the vendor is a venture-backed Canadian startup rather than an enterprise incumbent, and because Spellbook lives inside Word it tends to be adopted lawyer-by-lawyer — sometimes before anyone has signed terms on behalf of the firm. Reviewed and licensed at the firm level, it is a reasonable choice for confidential transactional work.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Sold per seat to firms and legal teams; the no-training and zero-retention commitments apply across plans. No consumer/free tier.
Data handling
Training on inputs
Spellbook states customer documents are never used to train AI models, and that it holds zero-data-retention and DPA terms with OpenAI and Anthropic so those providers cannot train on or retain customer data. Terms are uniform across paid plans; there is no free tier with weaker terms.
Retention
Content sent to LLM subprocessors is not persisted under the zero-data-retention agreements; documents remain in the customer's Word environment and Spellbook account per contract terms.
Residency
Spellbook is headquartered in St. John's, Newfoundland, Canada, and states compliance with PIPEDA as well as GDPR and CCPA; processing relies on U.S.-based LLM providers, so Canadian firms with strict data-locality duties (e.g. some public-sector clients or Quebec Law 25 assessments) should confirm cross-border flows.
Compliance
- SOC 2Yes
- GDPR / DPAYes
- HIPAA BAANot verified
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- SOC 2 Type II attestation
- Zero-data-retention agreements with OpenAI and Anthropic
- Encryption in transit and at rest
- DPA available (GDPR, CCPA, PIPEDA)
Frequently asked questions
Is Spellbook confidential enough for client contracts?
Its published terms are designed for exactly that: zero-data-retention agreements with OpenAI and Anthropic, SOC 2 Type II, and a no-training commitment. The practical caveat is that these are contractual promises about third-party infrastructure you cannot inspect, from a young vendor — so put the commitments in your signed agreement and treat highly sensitive matters (trade secrets under protective order, for instance) with the same case-by-case judgment you would apply to any cloud tool.
Does Spellbook train on client contracts?
No. Spellbook states customer documents are never used to train its models and that its LLM providers are contractually barred from training on or retaining request data. Verify the current subprocessor list and the zero-retention language when you sign, since model providers change over time.
What if individual lawyers are already using Spellbook or similar Word add-ins?
That is the common failure mode: a Word add-in gets installed seat-by-seat on personal cards before the firm has reviewed terms, so client contracts flow through a tool nobody has vetted. Inventory installed Office add-ins, move users onto a firm agreement, and apply the same review to the consumer chatbots lawyers use alongside it.
Policy changelog
- Initial entry published from Spellbook's published security documentation.
Sources
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Spellbook is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
AI assistant built into Clio Manage, the dominant solo and small-firm practice management platform, answering questions and drafting from the firm's own matter data.
Thomson Reuters' professional AI assistant, delivered inside Westlaw Precision for legal work and as CoCounsel Tax, Audit & Accounting for advisory practices.
Legal AI platform for law firms and in-house teams: research, drafting, document review, and workflow automation built on foundation models.
LexisNexis' generative AI research and drafting assistant, now sold as Lexis+ with Protégé, grounded in the Lexis primary-law and Shepard's citation database.