// Trust & Security Report
Thomson Reuters
CoCounsel - generative AI legal assistant suite including CoCounsel Legal, CoCounsel Drafting, and Microsoft 365 integrations for legal professionals. Originally developed by Casetext (acquired July 2023), now Thomson Reuters' flagship professional AI product.
Certifications held
4
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on legal.thomsonreuters.com“CoCounsel maintains SOC 2 Type II and ISO 27001 compliance built into our development process”
Verify on legal.thomsonreuters.com“CoCounsel maintains SOC 2 Type II and ISO 27001 compliance built into our development process”
Verify on thomsonreuters.com“CoCounsel has been successfully included in Thomson Reuters' AI Management System ISO/IEC 42001:2023 Certification, among the earliest generative AI systems in professional services to attain this standard”
Verify on thomsonreuters.com“Thomson Reuters maintains commitment to honoring privacy and keeping personal data safe consistent with GDPR. CoCounsel includes data residency controls to ensure information stays within required geographic boundaries with region-based hosting available in the UK, Australia, and Canada.”
> Show 3 unconfirmed / not-held certifications
source: legal.thomsonreuters.comThomson Reuters achieved FedRAMP 'In Process' status for Westlaw and Practical Law products; CoCounsel is still invested to secure FedRAMP authorization
source: legal.thomsonreuters.comNo public evidence of HIPAA certification found on vendor's own domain. Thomson Reuters provides HIPAA guidance materials for law firms but does not claim HIPAA BAA coverage for CoCounsel itself.
No public evidence found
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Primary: United States (with separate availability zones for backup). Optional region-based hosting: UK, Australia, Canada. All interactions with OpenAI GPT and Google Gemini processed in U.S.
CoCounsel explicitly does not use user content or prompts to train CoCounsel, underlying language models, or third-party AI models (OpenAI GPT, Google Gemini). Third-party partners are contractually prohibited from using customer data for model training. Thomson Reuters processes all GenAI requests under Thomson Reuters identity, never disclosing individual customer identity to LLM providers.
// Security controls
Zero-retention API architecture
All GenAI LLM requests use zero-retention API calls; data not stored by third parties
legal.thomsonreuters.comData retention policies
Customizable per customer; can be configured through account manager; users can delete content anytime
thomsonreuters.comAccess controls
Production environment restricted to authorized personnel; limit-collection principle applied
thomsonreuters.com// Products & data scope
data: Legal documents, research, case analysis, drafting; sensitive professional data
Flagship product; retrieval-augmented generation (RAG) grounds outputs in Westlaw and Practical Law content with citations; used by 10,000+ law firms
data: Contract drafting, legal document generation
Specialized drafting module; data not used for model training
data: Email-based legal research and assistance
Microsoft 365 App Certified; includes security testing and compliance verification
// What to watch
- FedRAMP status is 'In Process' only, not full Authorization - CoCounsel is not yet FedRAMP authorized for government use
- HIPAA not available - product is designed for legal professionals, not healthcare providers; no BAA offering found
- AI model training explicitly disabled via contractual requirements with OpenAI/Google - verified and well-documented
// At a glance
Pricing model
Subscription-based (details vary by product and tier); contact sales for pricing
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Thomson Reuters's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
thomsonreuters.com