Articles · Files, backup & privacy
Privacy practices for lawyers and consultants
Client cases, drafts, billing — what to feed AI, what to keep strictly local, and how to enforce it via hooks.
Kition Team·Apr 15, 2026·1 min read
Four layers of isolation
- Vault tiers: clients/ in its own vault with custom hooks
- Hook denies: block agent from feeding clients/ content to web_fetch / browser
- Provider tiers: sensitive vault uses local LLM; general vault uses cloud
- Audit log: PostToolUse pipes every tool call to syslog
A common hook snippet
{
"PreToolUse": {
"web_fetch": ".kition/scripts/deny-if-client-path.sh",
"browser_open": ".kition/scripts/deny-if-client-path.sh"
}
}