AI note apps and client confidentiality: what data goes to the AI provider

The confidentiality risk in AI note apps comes down to what leaves your computer and what the AI provider does with it. When you use an AI feature or plugin, the app sends your prompt and some of your note text to a cloud model, and that provider's retention and training terms decide how long the data is kept and whether it can be used to improve models. For client data privacy in 2026, the practical approach is to know exactly what each feature sends, limit it, check the provider's terms, and keep storage and transcription on your own computer wherever you can.

This guide covers what gets sent, how provider settings differ, what the American Bar Association's guidance on generative AI asks lawyers to check, and how to set up Barside, a free desktop app for Windows, Linux and Mac, so client material stays under your control. It's written for lawyers, accountants, consultants, therapists and anyone else who holds other people's confidential information. It isn't legal advice, and your own bar or regulator has the final word.

What does an AI feature or plugin send to the cloud model?

When an AI plugin in a note-taking app calls a cloud model, the privacy question is what data gets sent to the provider each time it writes an answer. A language model can't read your hard drive, so whatever it knows about your notes, the app or plugin had to put into the request. That request usually holds some mix of these:

• Your prompt. The question or instruction you typed or spoke, which often names the client or matter.
• Context from your notes. The selected text, the open note, a set of retrieved passages, or in some designs every note in a folder.
• Embeddings or an index. Some plugins send your whole library to a cloud embedding service once, so they can search by meaning later. That upload happens before you ask anything.
• Files and images. Screenshots, PDFs or audio, when the feature reads them.
• Account details. Your API key or sign-in, which ties the request to you or your firm.

The design of the feature decides which of these goes out. A plugin that sends only the passage you highlighted carries far less exposure than one that indexes a whole vault through a third-party server. In apps with plugin systems, each plugin makes that choice on its own. Obsidian, for example, gets its AI features from community plugins, each with its own settings and its own way of handling your notes, so you have to check every one you install.

The prompt needs as much care as the context. Retention rules usually apply to the whole request, and a question like "Summarize the settlement terms for the Alvarez matter" already contains a client name and a fact about the case.

How do providers' retention and training settings differ?

Once an AI plugin sends your prompt and notes to a cloud model, privacy depends on the provider's retention and training terms. Three settings matter: whether the provider may train models on the data, how long it's kept, and who at the provider can see it. These vary by provider, by product and often by plan, so the same model can come with different terms through a consumer chat app, a business plan or a developer API.

OpenAI's enterprise privacy page, for instance, says it doesn't train on business data from its business plans and API platform by default. Note-taking and meeting apps that resell AI add their own layer of terms on top. Granola's security page says, as of October 2026, that it doesn't let third parties such as OpenAI or Anthropic train on your data, and that Granola itself trains on anonymized data to improve its product unless you opt out in Settings, with that training off by default on Enterprise. Both are clear, useful disclosures, and together they show why you need to read the terms of every company in the chain.

When you review a provider, look for these answers in its own documentation:

1. Does it train on inputs by default, and can you turn that off for your account?
2. How long does it keep prompts and outputs, and for what purpose, such as abuse monitoring?
3. Which plan or contract changes those defaults?
4. Where is the data processed and stored?
5. Which other companies receive it, such as a transcription service behind a meeting app?

If an AI note app can't tell you which provider it uses, you can't answer any of these.

What ABA Formal Opinion 512 asks lawyers to check

ABA Formal Opinion 512 is the American Bar Association's guidance for lawyers on generative AI, and it treats the confidentiality of client information in cloud AI tools as a core duty. The opinion, issued July 29, 2024, applies the existing Model Rules to generative AI. On confidentiality under Rule 1.6, its main points are these:

• Understand the tool. Before entering information relating to a representation, a lawyer should evaluate the risk that it will be disclosed to or accessed by others, inside or outside the firm.
• Informed consent for tools that learn from inputs. If a tool can use what you enter to train or improve itself, the opinion says the lawyer needs the client's informed consent before entering client information. A boilerplate clause in an engagement letter doesn't count.
• Read the terms. Lawyers should read the tool's terms of use, privacy policy and related contract terms, or consult someone with the expertise to explain them.

The opinion also covers competence (Rule 1.1), communication with clients (Rule 1.4), reasonable fees (Rule 1.5), candor toward courts, and supervising lawyers and staff who use these tools (Rules 5.1 and 5.3). State bars have issued their own guidance as well, so check yours. In practice, you can't take "the app has AI" on trust. You need to know which feature sends what, to whom, and under which terms.

Checking an AI note app for client data privacy and confidentiality risk in 2026

For AI note-taking apps that hold confidential client data, privacy comes down to enterprise data retention terms, encryption and on-device transcription, and this checklist turns those questions into steps you can run before any client material goes in. It works for enterprise tools and for a solo practice.

1. Map every AI feature. List each feature that calls a model: chat, search, summaries, transcription, autocomplete, plugins. Note which ones are on by default.
2. Find out what each one sends. Your prompt only, the open note, retrieved excerpts, or the whole library.
3. Name every provider. The app's AI provider, any transcription service, and any company behind a plugin.
4. Read retention and training terms for each provider, on the plan you actually use.
5. Prefer on-device transcription for calls with clients, so audio never reaches a third party.
6. Keep storage local where you can, and know exactly which features upload anything.
7. Fence off sensitive matters. Use the app's exclusion settings so privileged material is never eligible to be sent.
8. Check encryption honestly. Ask who holds the keys for sync and backup, and whether the company's server can read what you store there.
9. Get consent where needed, and record what you told the client.
10. Train the people you supervise on which features are allowed for which matters.

How Barside handles AI and client data

Barside has no AI model of its own and no AI subscription. You connect your own Claude, ChatGPT, Gemini or OpenRouter account in Settings → AI, and that company bills you for what you use. Without a connection, no note is ever sent to an AI. That keeps the provider question simple: it's the one company you chose, on the plan and terms you hold with it.

This table shows what each AI feature sends:

AI search is retrieval, and it doesn't train any model on your library. The password vault, saved AI keys, the assistant's memory and the account names on bookmarks are never searched. AI keys are saved encrypted by your system, apart from your library. New AI connections are read-only by default and can't see your passwords.

How do I keep a client's matter out of AI entirely?

1. Create a workspace for each client or matter, so excluding one takes a single click. See workspaces for projects.
2. Open Library & briefing and go to the Sources tab.
3. Under Choose included workspaces & notes, untick the workspace, or single notes inside it.
4. Leave Read screenshots with AI off unless you want images in included notes sent to your AI.
5. Leave After each call transcript, prepare a follow-up off in Agents & approvals → Meeting. It's off by default.

Excluded items stay out of Library answers, screenshot reading, meeting analysis and the daily briefing, and agents never receive them. Excluding a note later can't take back an excerpt that was already sent, so set this up before you start asking questions. The AI section of the privacy guide and how AI search uses your data give the details.

Keeping transcription and storage on your computer

On-device transcription and local storage close off the two routes client data most often travels: call audio to a transcription service, and your whole library to someone else's cloud. Barside's call transcription records your microphone and your computer's sound and turns them into text on your computer with Whisper. No bot joins the call, and no audio is uploaded. The speech engine and its model, about 150 MB, download once, and after that transcription works offline. The audio and transcript are saved in your note.

Your library lives in Barside's data folder on your computer: %APPDATA%\barside\data on Windows and ~/.config/barside/data on Linux. There's no account for personal notes. Barside counts which features are used, by name only, and sends crash and error reports that say what went wrong without your content; you can turn each off in Settings. A support report goes out only when you press Send to support. None of these reports include your notes, titles, passwords, clipboard or files.

Be precise about encryption when you describe your setup to a client:

• Notes on your computer and ordinary ZIP backups aren't encrypted by Barside, so protect the computer with disk encryption and a strong sign-in.
• Cloud backup with Barside Plus is encrypted on your computer with AES-256-GCM before upload, and only your recovery key opens it.
• Cloud sync with Barside Plus is encrypted in transit and at rest but isn't end-to-end encrypted, and Barside's server can read synced notes. Spaces aren't end-to-end encrypted either.

For matters that must stay on one machine, leave sync off. Local-first storage and backups explains every layer, and recordings and transcripts covers the audio side. Tell everyone on a call before you record.

How people in client work set this up

• An employment lawyer keeps one workspace per client and excludes all of them in Sources. She uses AI search only on a research workspace of public cases and saved articles, so no client fact is ever eligible to leave.
• A tax accountant transcribes client calls on his computer and skips Meeting follow-through for those calls. He writes the action items himself and puts them on the task board.
• A management consultant has client consent to use AI on project notes. She connects her firm's AI account, whose terms she has read, and uses Meeting follow-through, checking each proposed task before it saves.
• A therapist uses Barside only for scheduling and practice admin, with no AI connected, so nothing goes to any AI provider.

What Barside can't do

AI search matches words on your computer, so it sends excerpts that contain the words you asked about. Text you paste into an included note can be found and sent as an excerpt, so exclude any note that holds something sensitive. The AI company you connect still applies its own policy to what it receives, and Barside can't change that policy for you or recall data a provider already holds. There's no phone app, and Barside runs on Windows 10 and 11, Linux and Mac.

How Barside compares with Obsidian and Granola

Apps differ mostly in where storage and transcription happen. Obsidian keeps notes as files on your device, and its Sync security page explains how it encrypts synced notes so its own server can't read them, which Barside's cloud sync doesn't do; its AI comes from plugins you vet one by one. Granola is a polished meeting notetaker that uses cloud transcription with clear published terms. Barside keeps transcription on your computer and sends AI requests only to the account you connect. You can compare more in the Obsidian alternative, the Granola alternative, the best AI note takers without a bot and the best local-first apps.

Features that work well alongside this

The AI assistant uses the same connected account and asks before it acts, and meeting follow-up shows exactly what a transcript analysis proposes before anything saves.