A mid-size law firm (40 to 60 professionals, commercial, corporate and litigation practice) used Claude and ChatGPT daily to summarize contracts, extract clauses, draft legal documents and search internal precedents. Its central repository was an on-premise Nextcloud holding contracts, case files, due diligence work, memoranda and confidential correspondence.
The AI saved hours every week. The firm had no figure for how many documents left its network or what each query cost.
What left the network and what it cost
The working pattern was always the same: open the document in Nextcloud, copy or upload it into the chat, ask. In the diagnostic of the first two weeks we found two serious, simultaneous problems.
Continuous information leakage. Contracts with client data, non-compete clauses, valuations, litigation strategies and information subject to professional secrecy were leaving the firm’s perimeter toward external model providers. No logging, no retention control, no way to revoke.
Disproportionate token cost. A 40 or 80-page contract was re-sent multiple times within the same conversation or in later threads. Average consumption per document query ran 8 to 15 times above what was necessary.
The failed attempt by the internal IT team
Before contacting us, the firm’s technical team had tried to solve it on their own by deploying the official Nextcloud MCP server. The result made the bill worse:
- The server turned out to be heavy for a constrained infrastructure. It consumed memory and CPU noticeably in an already tight environment, degrading performance and raising stability concerns.
- The way it exposed and processed documents generated more context than needed, more calls and more billed tokens, worsening the cost problem it was meant to fix.
The team had swapped copy-paste leakage for a server that used infrastructure resources and raised AI spend.
What we did: a security layer between Nextcloud and the models
In the controlled AI assessment (available in Spanish) we designed and implemented a security layer for AI agent access to confidential documentation, built from six pieces:
-
Lightweight, controlled MCP server. We developed and released as open source nextcloud-mcp-fast: an MCP server written in Go with a minimal resource footprint (20 to 50 MB of RAM at idle), strict path jail, granular permissions (read-only by default) and a circuit breaker. It removes excessive infrastructure consumption and stops the model from receiving more context than it needs.
-
Sensitive-data protection guardrail. Before any content reaches the models, a component intercepts and redacts (or blocks) sensitive data: client personal data, identification numbers, critical amounts, names of parties in litigation, clauses marked confidential, and any other pattern defined by the firm. The AI works with a sanitized version of the document; sensitive data never leaves the perimeter or reaches the model provider.
-
AI perimeter governance. A clear definition of which models and agents can access which folders with which permissions, and the elimination of copy-paste as a leakage vector.
-
Audit and traceability. A log of every tool call and every guardrail action: who queried which file, what was redacted, when, and with what outcome. Demonstrable evidence for compliance, clients or regulators.
-
Technical containment controls. Path jail, read-size limits, rate limiting and authentication via App Passwords or OAuth. The model only sees what the lawyer is already entitled to see in Nextcloud, and only after it passes through the protection filter.
-
Architecture compatible with constrained infrastructure. A lightweight deployment that does not demand more resources than the firm already had.
With these pieces, AI access to documents became a controlled, auditable operation with prior sensitive-data protection and predictable cost.
Select a step to see what happens in it, or play the full route.
Results at 90 days
Measured on the anonymized case, 90 days after deployment.
| Metric | Copy-paste | Official MCP | Security layer |
|---|---|---|---|
| Confidential documents sent to external models | Constant | Reduced, not eliminated | Zero. Redacted before leaving |
| Tokens per document query | 100 % (baseline) | Above baseline | 70 to 85 % fewer |
| MCP server memory | Not applicable | High, with CPU pressure | 20 to 50 MB at idle |
| Time to gather context from a case file | 10 to 20 min | Variable | 2 to 3 min |
| Traceability of access and redactions | None | Partial | Complete and auditable |
| Risk to professional secrecy | High | Moderate | Mitigated and demonstrable |
The lawyers keep using the same models, now inside the firm’s perimeter and with the redaction guardrail active before content reaches the provider.
Why it matters for a law firm
In the legal sector, an information leak carries reputational, disciplinary and contractual consequences on top of the technical ones. Meanwhile, token spend from repeated queries of long documents grows quickly into a relevant operating cost.
The intervention eliminated copy-paste leakage, avoided the overspend of a heavy solution and cut token consumption. Sensitive-data protection acts before information reaches external models.
Does your firm use AI over confidential documents and not know what leaves your perimeter?
The controlled AI assessment includes a scoped, fixed-price diagnostic: document inventory, exposure surface toward model providers, and a risk-prioritized roadmap.
