Anyone that actually cares about the privacy of their data isn’t going to be satisfied with just a “promise”.

A legal binding agreement, whatever.

Still not enough. Seriously. Once information is out there it cannot be clawed back, but legal agreements are easily broken.

I worked as a lawyer for six years; there are extremely strict ethical and legal restrictions around sharing privileged information.

> I worked as a lawyer for six years; there are extremely strict ethical and legal restrictions around sharing privileged information.

But Microsoft already got all the needed paperwork done to do these things, it isn't like this is some unsolved problem.

Hospitals are not storing the data on a harddrive in their basement so clearly this is a solvable problem. Here's a list of AWS services which can be used to store HIPAA data:

https://aws.amazon.com/compliance/hipaa-eligible-services-re...

As you can see, there is much more than zero of them.

The biglaw firms I’m familiar with still store matter data exclusively on-prem. There’s a significant chunk of floor space in my office tower dedicated to running a law firm server farm for a satellite office.

You can't unring a bell. Very true.

Nevertheless, the development of AI jurisprudence will be interesting.

This might have been true 10-15 years ago. But I've worked at plenty of places that store/process confidential, HIPAA, etc data in the cloud.

Most company's confidential information is already in their Gmail, or Office 365.

What if there's a data breach? Hackers can't steal data that OpenAI doesn't have in the first place.

Or legal order. If you're on-site or on-cloud and in the US then it might not matter since they can get your data anyway, but if you're in another country uploading data across borders can be a problem.