Winter Park Wealth Managers & Law Firms: Are You Handing Your Client Files to Public Cloud AI?

Hector Cabrera — Founder, Sovereignware™ · Trinary Bound™ (U.S. Pat. App. 19/458,785) · HecTec.ai / DMH Florida

The Hub of Elite Capital and Quiet Risk

Winter Park, Florida — historic estates, high-net-worth family offices, boutique law practices — has quietly become a hub for regional private wealth and legal practice.

Beneath the Park Avenue veneer, a quieter problem is unfolding.

Managing partners and senior advisors across Central Florida are integrating AI into document review, estate planning, and portfolio analysis. In the rush toward efficiency, many are routing that work through consumer-grade cloud LLMs — pushing confidential client files, tax strategies, and material non-public information through public multi-tenant APIs.

The assumption is that convenience equals security. It does not. And the question is no longer hypothetical.

The legal reality: what United States v. Heppner actually held

You will hear this case cited — often as “Heppner v. Claude,” which is not its name — as authority that using public cloud AI waives attorney-client privilege outright.

It does not say that, and any vendor telling you otherwise is overstating the law.

United States v. Heppner (S.D.N.Y. 2026, Rakoff, J.) is a narrow, fact-specific holding resting on three grounds, and a judicial split emerged in April 2026. It did not establish a categorical waiver rule.

That is precisely why it should concern you.

What the decision does establish is that how a firm handles client material with third-party services is now a litigated question rather than a theoretical one. The doctrine is unsettled and being tested. A firm that can demonstrate exactly where its client material went — and prove those records are unaltered — is in a materially different position from a firm that cannot, whichever way the split resolves.

We state this plainly because a citation that does not survive being looked up is worse than no citation at all. You are litigators and fiduciaries. You will check.

The regulatory picture is not one rule

The obligations differ by practice, and conflating them is how firms end up with the wrong controls:

• Law firms answer to ABA Model Rule 1.6(c) — reasonable efforts to prevent unauthorized disclosure of information relating to the representation — and Rule 1.1 Comment 8, which makes understanding the technology part of competence.
• Registered investment advisers and family offices fall under SEC Regulation S-P, whose 2024 amendments require written incident response, 30-day customer notification, and documented oversight of third-party service providers handling customer information.
• Broker-dealers additionally answer to FINRA supervisory expectations for third-party technology.

The common thread is the third party. The moment client material enters a service you have not contracted, assessed, or documented, you have an oversight obligation you cannot evidence.

Flipping the script: the sovereign architecture

You should not have to choose between capable AI and control of your records. We reject the binary of vulnerable cloud-first tools versus crippled air-gapped boxes, and build the space between them on the Trinary Bound™ three-tier custody architecture.

Zero-cloud by default. Running on Ark Citadel and Ark Node hardware, firm material is processed on hardware you own and is never transmitted to a model vendor — so it cannot enter public training weights. Where a firm explicitly opts into a cloud lane for a specific task, PII is stripped before egress and the request fails closed if the stripper cannot run.

Physical boundary. Stateless Apple Silicon execution nodes with dedicated PCIe-over-Thunderbolt storage. The original never moves: it stays sealed in the −1 vault, and only a machine-readable twin carrying the original's SHA-256 fingerprint is ever indexed or read.

The YubiKey kinetic gate. Releasing an original takes a physical FIDO2/CTAP2 touch. A remote attacker cannot produce one.

Provable, not asserted. Every record is sealed with a SHA-256 hash computed over its content plus the hash of the record before it. Verification is arithmetic: recompute the chain, and a single altered byte anywhere breaks every hash after it. Your auditor can run it offline — no account, no network, no trust in us required.

What we do not claim

This does not make your firm compliant. Compliance is a programme — written, staffed, trained, and overseen — and no software supplies that. We have not been independently audited or accredited, we do not certify compliance, and we do not guarantee a regulatory outcome. Your obligations remain yours.

What we supply is evidence: records that can be shown to be unaltered, a chain of custody for the documents behind a matter, and a materially smaller third-party surface to oversee — because client material is not being handed to an AI vendor in the first place.

Any vendor promising you more than that is selling something that will not survive an examination.

Secure your practice

DMH Florida provides white-glove, on-premises sovereign AI deployments for law firms and family offices in Central Florida.

To request the Ark Citadel technical brief or arrange a confidential consultation, contact [email protected].

Sources

• ABA Model Rule 1.6, Confidentiality of Information: American Bar Association.
• ABA Model Rule 1.1, Competence — Comment 8 on relevant technology: American Bar Association.
• ABA ethics guidance on lawyers' use of generative AI tools (Formal Opinion 512, July 2024): ABA News.
• SEC amendments to Regulation S-P, adopted May 16, 2024: SEC press release; final rule (PDF).
• FINRA Regulatory Notice 21-29, supervisory obligations for outsourcing to third-party vendors: FINRA.
• United States v. Heppner (S.D.N.Y. 2026) is deliberately not linked here: we cite only sources a reader can open and check for themselves. Consult the primary reporter and your own counsel for the opinion and the subsequent split.

Nothing in this article is legal, regulatory, or compliance advice. Case law is summarised for orientation only and may have developed since publication; consult primary sources and your own counsel.