Clio is the dominant cloud practice management platform for law firms, now also offering Clio Duo AI tools after its acquisition of vLex/Fastcase. Its Terms of Service govern how your client data is stored, processed, and used for AI model improvement — clauses that carry real professional responsibility implications. DriftPatrol tracks clio.com/tos continuously and surfaces material changes the day they happen.
| Section | What it says | Why it matters |
|---|---|---|
| §16.6 | AI Training — De-identified aggregation | Clio may use de-identified, aggregated data to improve product quality. Explicitly excludes training large language models on confidential client data. Verify "de-identified" meets your bar association's standard — most ethics opinions require more than contractual labeling. Monitor |
| §16 | AI Human Oversight requirement | Subscribers are contractually required to apply human review to all AI-generated output before use in legal work. Creates an affirmative compliance obligation — and shifts malpractice exposure to your firm if you skip the review step. Monitor |
| §8.2 | Data Retention — 90-day retrieval, 6-month escrow | Post-termination: 90-day window to retrieve your data, then deletion; escrow held 6 months. Short window for a firm switching platforms mid-matter. Plan migration before cancellation, not after. Note |
| §11.2 | Liability Cap — 6 months of fees paid | Total liability capped at six months of subscription fees paid. For a firm paying $1,000/mo, maximum recovery is $6,000 regardless of breach severity. Extremely low for enterprise use. Negotiate a higher cap or purchase separate cyber coverage. Risk |
| §20.10 | Governing Law — British Columbia, Canada | Disputes go to BC courts (no arbitration clause). Canadian jurisdiction means different discovery rules, judgment enforcement costs, and travel burdens for US firms. Factor into vendor risk register. Note |
| §13.2 | Indemnification — IP infringement | Clio indemnifies against IP infringement claims related to the core platform. Standard clause; no unusual carve-outs. Watch for AI-output copyright claims — not expressly covered as of Feb 2026. Note |
| Schedule | Sub-processors — 45 listed | Includes AWS, Azure, Google, Databricks, Salesforce, MavenAGI, Stripe, Zendesk, Zoom, Docusign. Databricks and MavenAGI are AI-specific processors — relevant if your jurisdiction requires DPA amendments for AI subprocessors. Monitor |
Get a plain-English Monday brief the day any of these clauses change. Audit trail to the second.
See plans →Tracked URL: https://www.clio.com/tos/ · Last known update: Feb 11, 2026 · Informational only — not legal advice.
