Attorney-Client Privilege and Cloud Tools: What Counts as Disclosure?

Published August 12, 2026 · 10 min read

A litigation associate needs to merge 40 exhibits into a single PDF before a deposition. The firm's document management system is down, so she searches "merge PDF online," drops the files into a free web tool, and downloads the combined document ninety seconds later. The files contained a draft settlement strategy memo marked privileged. Did that ninety-second upload just waive attorney-client privilege over the entire strategy? The answer is not simple — but the risk is real, and it is entirely avoidable.

The core rule: privilege survives only if confidentiality survives

Attorney-client privilege protects confidential communications between a client and their lawyer made for the purpose of obtaining legal advice. The operative word is confidential. The moment a privileged communication is disclosed to a third party outside the privilege relationship, courts may find that the client no longer held a reasonable expectation of privacy — and the privilege is waived.

Waiver is not always intentional. It does not require the client to publish the document on a billboard. Courts have found waiver where a party voluntarily transmitted privileged material to a third party, even accidentally, when the transmitting party failed to take reasonable precautions to maintain confidentiality. The question for any lawyer using cloud-based document tools is straightforward: does uploading a file to a third-party server constitute disclosure to that third party?

The reasonable expectation of privacy test

Most jurisdictions evaluate inadvertent disclosure through a multi-factor test that examines whether the privilege holder took reasonable steps to prevent disclosure and to rectify it promptly. The factors typically include:

• The reasonableness of precautions taken to prevent disclosure
• The time taken to rectify the error once discovered
• The scope of the disclosure relative to the total production
• The extent of the disclosure (who received it, whether it was disseminated)
• Whether overriding interests of justice favor or disfavor waiver

When you upload a file to a cloud PDF tool, you are transmitting the file's full content — every byte — to a server operated by a third party. That server may be located in a jurisdiction you did not choose, operated by employees you did not vet, and subject to a privacy policy you did not negotiate. Even if the provider's terms say "we delete files after 2 hours," the file existed on their infrastructure. Under a strict reading, that is disclosure to a third party.

Voluntary vs. involuntary disclosure

Courts distinguish between voluntary and involuntary disclosure. Voluntary disclosure — where the privilege holder intentionally transmits the document to an outsider — almost always results in waiver. Involuntary disclosure (theft, hacking, a misdirected fax) receives more lenient treatment, but only if the privilege holder can demonstrate they took reasonable security precautions.

Uploading a file to a web-based tool is, legally speaking, a voluntary act. You chose the tool, you clicked upload, and you transmitted the file. If opposing counsel later discovers that a privileged memo passed through a third-party server, they can argue — with some force — that you voluntarily disclosed the communication. The counterargument (that you reasonably expected the provider to maintain confidentiality) weakens when the provider's terms of service disclaim any fiduciary duty or when the provider is located outside your jurisdiction.

The CFAA angle and unauthorized access

A less-discussed risk involves the Computer Fraud and Abuse Act and its state equivalents. If a cloud tool's server is compromised and your uploaded file is exfiltrated, you face a peculiar situation: the disclosure was technically involuntary, but you placed the file in a vulnerable position. Some courts have considered whether the privilege holder's choice of an insecure transmission method constitutes a failure to take reasonable precautions. The CFAA does not directly govern privilege waiver, but it shapes the factual narrative: if you chose a tool with no encryption, no access controls, and no audit trail, a court is less likely to find your precautions "reasonable."

The safe harbor: tools that never receive the file

The cleanest way to eliminate the disclosure question entirely is to use tools where the file never leaves your device. Client-side processing — where all computation happens in your browser using WebAssembly or JavaScript — means no upload occurs. No server receives the file. No third party ever possesses the document. There is no disclosure because there is no transmission.

LoveMyFile's PDF merge tool works this way. The merge operation runs entirely in your browser. The file bytes are never transmitted to any server. From a privilege standpoint, this is functionally identical to using desktop software installed on your own machine — except there is nothing to install.

The same applies to the redaction tool. When you redact privileged material before production, the redaction process itself must not create a new disclosure event. If you upload a privileged document to a cloud redaction service, you have disclosed the very material you are trying to protect.

What about tools with BAAs or DPAs?

Some enterprise tools offer Business Associate Agreements (for HIPAA) or Data Processing Agreements (for GDPR). These contracts create obligations on the processor, but they do not eliminate the disclosure. The file still transits a third-party server. The contract may give you a breach-of-contract remedy if the provider mishandles the data, but it does not prevent a court from finding that disclosure occurred.

For privilege purposes, the strongest position is: no third party ever received the file. A BAA is a fallback argument ("even if disclosure occurred, we took reasonable precautions via contract"). The no-upload architecture removes the need for the fallback entirely.

Practical checklist for lawyers handling privileged PDFs

1. 1Verify the architecture before use. Open your browser's Network tab (F12 → Network). Upload a test file. If you see a POST request to a remote server, the file left your machine. If there is no network activity during processing, it stayed local.
2. 2Read the terms of service. Look for language about file retention, employee access, and jurisdiction. "We delete files after X hours" is not the same as "files never leave your device."
3. 3Redact before any external transmission. If you must send a document to opposing counsel or a court, redact privileged material first — using a tool that processes locally so the redaction step itself does not create a disclosure.
4. 4Document your workflow. If privilege is later challenged, you want to demonstrate that you used a no-upload tool. A screenshot of the Network tab showing zero requests during processing is contemporaneous evidence of reasonable precautions.
5. 5Train support staff. Paralegals and legal assistants often handle document preparation. A single well-meaning upload to a free converter can create a waiver issue that takes months of litigation to resolve.
6. 6Prefer tools with verifiable source code. Open-source or auditable tools let you confirm the no-upload claim independently, rather than trusting a marketing page.

The metadata problem

Even if the file content is protected, PDF metadata can leak privileged information. Author names, creation timestamps, software used, and revision history are embedded in every PDF. If you merge privileged documents using a cloud tool, the resulting file's metadata may reveal that the merge occurred, when it occurred, and from what IP address. Client-side tools avoid this because no server-side processing metadata is injected.

When preparing documents for production, always strip metadata after redaction. LoveMyFile's processing pipeline does not inject server-side metadata because there is no server involved in the processing chain.

Comparison: cloud tools vs. client-side tools for privileged documents

What if the file was already uploaded?

If you or a colleague already uploaded a privileged document to a cloud tool, take these steps immediately:

• Contact the tool provider and request immediate deletion with written confirmation.
• Document the incident: what was uploaded, when, to which service, and what steps you took to retrieve it.
• Notify the client and assess whether the disclosure triggers any reporting obligation.
• Consult ethics counsel on whether the incident creates a conflict or requires a privilege log amendment.
• Review your firm's acceptable-use policy and update it to prohibit cloud tools for privileged material.

The bottom line

Attorney-client privilege is only as strong as the confidentiality surrounding the communication. Every time a privileged document transits a third-party server, you create a factual question about whether reasonable precautions were maintained. The simplest way to avoid that question is to ensure the document never leaves your device. Client-side tools make this practical without requiring desktop software installation, IT tickets, or per-seat licensing.

The convenience of a free online PDF tool is not worth a privilege waiver motion. Verify the architecture before you process. If the file uploads, find another tool.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Privilege law varies by jurisdiction, and the outcome of any waiver analysis depends on specific facts. Consult a licensed attorney in your jurisdiction for guidance on your particular situation.