We built client confidentiality into Zeno's architecture from the start. Zeno is now BRAO-compliant, which is an important milestone for us. German lawyers can now use Zeno with confidence, in line with their obligations under the Bundesrechtsanwaltsordnung, the Federal Lawyers' Act.
Here is what that means for your practice.
Why is BRAO compliance important?
Under § 43a BRAO, German lawyers carry a strict duty of confidentiality (Verschwiegenheitspflicht). It covers all information received in connection with a client, starts at first contact, and continues after a matter concludes. Courts treat a breach seriously: violating confidentiality can be a criminal offence under § 203 StGB, not just a professional one.
This duty extends to every tool German lawyers use.
Under § 43e BRAO, a lawyer who works with a service provider must choose that provider carefully, put a confidentiality agreement in place in text form, ensure the provider understands the legal consequences of a breach, and give the provider access only to what the service actually requires.
The responsibility stays with the lawyer. We built Zeno to make meeting it simple.
What BRAO compliance means for German law firms using Zeno
German law firms can adopt Zeno without putting their strict confidentiality duty at risk. The contractual framework § 43e requires is in place, reinforced by Zeno’s architecture around strict confidentiality duties. Here's what that means for German law firms.
Client data stays in Europe
Zeno runs on EU-only infrastructure and vendors, so all data and models are hosted exclusively within the EU or EEA, keeping German firms fully compliant with § 43e BRAO.
Data stays separate
We isolate each firm's data from every other client on the platform and encrypt it at rest and in transit. Each firm decides what we store and what we delete.
Nobody at Zeno, including our infrastructure providers, can read client content. That directly reflects the § 43e principle: a provider should touch client information only to the extent required to provide the service.
Client data is never used to train AI models
We do not use client data to train or fine-tune any model, and we do not use it to improve third-party products. The duty of confidentiality limits client information to the agreed service.
Every sub-processor is bound by the same duty
§ 43e is explicit that the obligation does not stop at the provider you contract with. The same obligation applies to anyone who processes data on their behalf.
How BRAO compliance sits within Zeno's wider security
Zeno earned ISO 27001, ISO 27017, and ISO 27018 certifications with zero nonconformities earlier this year. These certifications cover company-wide security management, cloud infrastructure, and GDPR-aligned data protection.
In combination with this foundational security framework, BRAO compliance adds the contractual and procedural commitments German professional law requires when engaging a service provider.
Frequently Asked Questions
What does Zeno's BRAO compliance mean for my firm?
Zeno meets the requirements German professional law places on lawyers using an external service provider, particularly under § 43e BRAO. We provide the confidentiality framework the statute requires and run the platform so German lawyers can use it consistent with their professional duties under § 43a BRAO.
Does using Zeno put a lawyer’s confidentiality obligations at risk?
No. The duty stays with the lawyer, and Zeno is built to support it: EU-only infrastructure, isolated firm data, no access to client content by any person, no model training, and a confidentiality commitment in the form § 43e requires.
Is client data used to train AI models?
No. Client data is used only to deliver the service. We never train or fine-tune models on it, and we never use it to improve third-party products.
How does this relate to Zeno’s ISO certifications?
ISO 27001, ISO 27017, and ISO 27018, plus periodic penetration testing, are the independently audited security foundation of Zeno. BRAO compliance adds the contractual and procedural safeguards German professional law requires for engaging a service provider.
