Law Firms' Biggest Data Sovereignty Questions, Answered by Sinabis

Four questions we hear from law firms again and again, and how we actually answer each one.

When a law firm evaluates a new tool, the first question used to be “does it work.” Increasingly, the first question is “where does the data go”, and for good reason. Case files, disclosure material, and client communications are privileged in a way most business data isn't, and the consequences of getting the answer wrong aren't just a compliance fine. They can mean a breach of privilege itself.

These are the four questions we hear most often from law firms evaluating Sinabis, phrased the way firms actually ask them, along with how we answer each one, including where our own products fit.

I. Is My Law Firm's Cloud Software Actually GDPR Compliant or Just Hosted in Europe?

A vendor pointing to an EU data centre and a signed data processing agreement is not the same as being fully accountable under GDPR for privileged material. “Hosted in Europe” describes geography. It says nothing about how many sub-contractors sit behind the platform, who among them can technically open a file, or what happens if one of those subcontractors is later acquired by a non-EU company.

Before trusting a “GDPR compliant” label, it's worth asking any vendor directly:

1) Who, specifically, can access the files: Not just which country the servers are in, but which people and which companies sit in the access chain.

2) How many subcontractors are involved: Is that list available in writing, not just referenced vaguely in a privacy policy.

3) What happens under a breach or a legal request: Who is notified, on what timeline, and under whose law.

Our answer: Sinacluster is EU-hosted and run directly by Sinabis, without third-party sub-contractors sitting between your firm and your data. If your team wants the flexibility of a managed cloud platform without adding an unclear chain of vendors behind it, that's the product built for that specific concern.

II. Can a US-Owned Legal Software Provider Be Forced to Hand Over Privileged Client Files?

Yes, and this is one of the most under-appreciated risks in legal tech procurement. The U.S. CLOUD Act of 2018 allows American authorities to compel a U.S.-headquartered company to produce data it controls, regardless of where that data is physically stored. Attorney-client privilege is a matter of professional and ethical duty on the firm's side; it does not bind a foreign government, and it does not stop a foreign legal request from reaching a U.S.-owned vendor.

Our answer: Sinabis is a German company with no foreign parent in its ownership chain, so there's no second jurisdiction to account for by default. For matters where even that isn't enough margin of safety, active litigation, government investigations, anything genuinely high-stakes, Sinabox processes everything fully offline, on your own premises, with no external connection for any authority to reach in the first place.

III. How Do I Keep Privileged Documents Secure During eDiscovery and Disclosure?

Every additional hand-off during document review (a new vendor, a new platform, a new reviewer added outside the firm) is a new link in the chain of custody, and a new point a court can question if the process is ever challenged. The risk in eDiscovery usually isn't the review itself; it's the number of systems the material passes through to get there.

Our answer: Sinabis offers in-house, forensically controlled document processing with full chain-of-custody documentation handled directly by our team, including the forensic expertise from our X64 Forensic GmbH subsidiary, rather than passed through a stack of separate eDiscovery vendors. Fewer hand-offs means fewer links for opposing counsel, or a court, to question.

IV. Where Does My Data Actually Go When I Use AI Tools on Client Files?

AI-assisted review and drafting tools are increasingly common in legal workflows, and the capability itself is rarely the problem. The question that matters is what happens to the file the moment it's fed into the tool: does it stay inside infrastructure your firm controls, or does it get sent to a third-party model provider whose retention policy, access controls, and jurisdiction you may not fully know?

Our answer: Sinabox runs AI-assisted processing entirely on-premise, inside your own building, with no data transmitted to an external cloud or model provider at any point. The AI capability is the same either way; the difference is only ever where the client file physically goes while it's being used.

Every one of these questions has the same shape: is this decision based on where a claim is made, or on how the system is actually built? We've tried to make sure ours always answers to the second.

Have a data sovereignty question specific to your firm? Let’s talk it through. Get in touch here.

→ Learn more: www.sinabis.com

Sinabis Analytics GmbH · X64 Forensic GmbH · X64 Systems GmbH