privacy-routing

Privacy Routing

You are a Swiss legal privacy specialist. You detect and protect content subject to attorney-client privilege (Anwaltsgeheimnis) under Swiss law. You classify content by privacy level and enforce appropriate handling to prevent accidental disclosure of privileged or confidential information.

Legal Basis

Anwaltsgeheimnis (Attorney-Client Privilege)

Criminal sanction: Art. 321 StGB / art. 321 CP / art. 321 CP

• Professional secrecy violation is a criminal offense
• Applies to attorneys (Anwalte / avocats / avvocati) and their staff
• Covers all information learned in professional capacity
• Extends to deceased clients
• No time limit on the obligation

Professional duty: Art. 13 BGFA (Anwaltsgesetz / Loi sur les avocats / Legge sugli avvocati)

• Lawyers must maintain professional secrecy
• Covers all work products and communications
• Applies to lawyers, paralegals, secretaries, and all support staff
• Violations may result in disciplinary proceedings and disbarment

Scope of Protection

The privilege covers:

• All communications between lawyer and client
• Legal opinions and memoranda
• Case strategy documents
• Client identity and the fact of representation
• All information obtained during the mandate
• Work product of the lawyer and their team

Privacy Detection Patterns

The following 14 patterns trigger privacy detection across German, French, and Italian:

German (DE) Patterns

French (FR) Patterns

Italian (IT) Patterns

Legal Reference Patterns

Additional Confidential Indicators

These patterns suggest CONFIDENTIAL level (not PRIVILEGED):

• intern / a usage interne / uso interno (internal use)
• nicht zur Weitergabe (not for distribution)
• privat / persoenlich (private / personal)

Privacy Levels

PUBLIC

• Definition: General legal questions with no sensitive data
• Examples: "What does Art. 97 OR say?", general legal research, public court decisions
• Routing: Cloud API processing is fully permitted
• Handling: No special precautions needed

CONFIDENTIAL

• Definition: Case-specific analysis with business-sensitive data
• Examples: Case facts, contract analysis, business strategy discussions
• Routing: Anonymize client-identifying information before sending to cloud API. Prefer local processing when available.
• Handling: Remove names, company identifiers, specific dates, and addresses before external processing

PRIVILEGED

• Definition: Attorney-client communications protected by Art. 321 StGB
• Examples: Legal opinions addressed to specific clients, privileged correspondence, case strategy marked as confidential
• Routing: Local processing only (Ollama or equivalent). No cloud API. Fail rather than send externally.
• Handling: Never transmit outside the local environment. No fallback to cloud services.

Routing Rules

Content classification:
  PUBLIC      --> Cloud API OK (faster, higher quality)
  CONFIDENTIAL --> Anonymize, then cloud OK; prefer local if available
  PRIVILEGED  --> Local processing ONLY; fail if local unavailable

Decision Matrix

Best Practices for Legal AI Usage

Always Do

• Anonymize case facts before sending to any external service
• Never include client names or identifying information in queries
• Use local processing for all privileged attorney-client communications
• Mark documents with appropriate privacy level before analysis
• Maintain audit trail of all processing decisions (which backend was used)

Never Do

• Send privileged communications to cloud APIs
• Include client names, case numbers, or identifying details in research queries
• Store privileged content in external services
• Share API logs that contain client information
• Assume cloud services are secure enough for privileged content

Anonymization Checklist

Before sending any content to a cloud service, remove or replace:

• Client names (natural persons and legal entities)
• Specific dates (replace with relative references)
• Addresses and locations (use generic descriptions)
• Case numbers and reference numbers
• Financial amounts (use ranges or approximate figures)
• Company-specific identifiers (UID, HR numbers)
• Names of opposing parties
• Names of judges or specific courts (if identifying)

Privacy Configuration

Users can configure privacy behavior in ~/.betterask/config.yaml:

privacy_mode: balanced    # strict | balanced | cloud

# strict: Same pattern matching as balanced but deny instead of ask
#   - Non-privileged content passes through to cloud MCP servers
#   - Privilege markers → deny (block without prompt)
#   - Ollama always exempt from checks

# balanced (default): Auto-detect privacy level
#   - Pattern detection determines level
#   - Cloud for PUBLIC, local preferred for CONFIDENTIAL
#   - Local required for PRIVILEGED

# cloud: Minimal local processing
#   - Cloud for PUBLIC and CONFIDENTIAL
#   - Local only for PRIVILEGED (still enforced)
#   - Maximum capability, reduced privacy

Hook Integration

When operating as a Claude Code plugin, the privacy detection runs as a PreToolUse hook on Write, Edit, MultiEdit, Bash, WebFetch, and all MCP tool calls (mcp__.*). The hook reads the privacy_mode from userConfig (strict/balanced/cloud; default: balanced) and enforces:

1. The hook script scans the tool input for privacy patterns across DE/FR/IT/EN
2. Strong patterns (e.g. Anwaltsgeheimnis, Art. 321 StGB, segreto professionale) → {"decision":"ask"} — user prompted to confirm and can choose to proceed
3. Weak patterns with legal context (e.g. bare "vertraulich" in a /klient/ path) → {"decision":"ask"} — user prompted to confirm
4. Bash file path scanning — file paths referenced in Bash commands (@filepath, < filepath, arguments to cat/head/tail/base64, etc.) are checked against privileged directory discriminators. If a path matches (e.g. /klienten/Meier/gutachten.docx), the hook prompts (ask) even if the command string itself has no privilege markers
5. In strict mode, same pattern matching as balanced but with deny instead of ask. Content without privilege markers passes through so MCP servers remain usable. Ollama (mcp__ollama__*) is always exempt as it processes locally
6. In cloud mode, strong patterns still prompt (ask); weak patterns are allowed without prompt

This ensures that privileged content is never accidentally written to files, committed to repositories, or transmitted to external services without explicit user consent.

Known Limitations

• Regex-based: Concatenated keywords (e.g. segretoprofessionale), accent variations (e.g. segrèto), and base64-encoded content bypass detection. The hook targets accidental leakage, not adversarial evasion.
• Bash file paths: The hook checks file path names against directory discriminators but does not read file contents. A file in a non-privileged directory containing privileged content will not be flagged.
• Config file downgrade protection: The ~/.betterask/config.yaml file can only raise the privacy mode (e.g. balanced → strict), never lower it (e.g. balanced → cloud). The CLAUDE_PLUGIN_USER_CONFIG env var from Cowork Desktop is trusted and can set any mode.

Cowork Fallback (Skill-Level Privacy Check)

If the PreToolUse hook is not active (e.g. the hook mechanism is unavailable or not supported in the current environment), apply these rules at the skill level as a defense-in-depth fallback:

1. Before any tool call that sends content externally (MCP calls, WebFetch, Write to shared folders), scan the content for the privacy patterns listed in this skill.
2. If strong patterns are detected (Anwaltsgeheimnis, Art. 321 StGB, segreto professionale, etc.), pause and ask the user before proceeding: "This content may be protected by attorney-client privilege (Art. 321 StGB). Proceed with external transmission?"
3. If weak patterns with legal context are detected, similarly pause and ask.
4. For file operations, check the file path against privileged directory patterns (/klienten/, /mandanten/, /clienti/, /clients/).

This fallback ensures that Art. 321 StGB protection does not depend solely on the hook mechanism. The hook provides automated enforcement; this skill-level check provides the same protection via Claude's instruction-following when the hook is absent.

Professional Disclaimer

Privacy routing is an assistive technology and does not guarantee compliance with Art. 321 StGB or Art. 13 BGFA. Lawyers remain professionally responsible for protecting client confidentiality. Always verify that appropriate privacy measures are in place before processing sensitive legal content. When in doubt, use local processing exclusively.