Almost every firm we talk to has the same story. Someone starts testing Claude on Pro, is genuinely impressed, then hits a wall fast: a couple of long records in one session and the limit is reached. They upgrade to Max to keep working, and only later ask the question they should have started with: which plan does the firm actually need, and what does each one do with privileged client data?
This is a guide to that decision. It is not about whether Claude is good for legal work; it clearly is. It is about matching the plan to how a firm really uses it, because the plans differ on three axes that matter to a law firm: how much you can run, what it costs, and how your data is handled.
The short version
- Pro is for trying it. Lowest usage allowance; document-heavy work exhausts it quickly.
- Max ($100 or $200 a month) is the practical tier for one person doing heavy document review interactively.
- The API is the right base for a firm-wide or automated workflow: largest context window, pay-per-use, and zero data retention available at the organization level.
- Enterprise carries a seat minimum that makes it the wrong fit for most small and mid-size firms.
Pro: good for the test, not the work
Pro is the cheapest paid plan and the right way to find out whether Claude helps. The catch is the usage allowance, which is the lowest of the paid tiers. Long legal documents are token-heavy, so reviewing a couple of medical records or a deposition in a single session can hit the Pro limit. That is not a knock on Pro; it is doing its job as an entry plan. It is just not built for someone who reviews documents all day.
Max: the practical tier for one heavy user
Max comes in two levels, roughly $100 and $200 a month, and the point of it is dramatically higher usage than Pro. For a single attorney or paralegal doing real document review in the Claude app, this is usually the right plan. You can also turn off having your data used to train models.
One distinction worth getting right: turning off training is not the same as zero data retention. Opting out of training means your content is not used to improve the model; it does not by itself mean nothing is stored. For most internal, non-privileged work that is fine. For privileged client content, read the next two sections before you decide Max is enough.
The API: the base for anything firm-wide or automated
The API is not a seat you log into; it is pay-per-use access that software connects to. For a firm it matters for four reasons:
- Largest context window. You can hand it long documents without the app-tier limits.
- Zero data retention. ZDR is available at the organization level on the API, and models are not trained on API content by default. For privileged data this is the clean answer.
- Automation. A repeatable workflow (summarize every new document, draft from a matter) runs on the API, not by a person pasting into a chat.
- It connects to your practice management system. An open-source connector lets the API read and write your Clio data through a controlled interface instead of re-uploading files by hand.
The trade-off is cost management: per-token billing can run up if you feed huge documents without prompt caching and sensible limits. That is an engineering detail, not a reason to avoid the API; it is the reason to set it up properly.
Enterprise: usually overkill
Enterprise is real and it is strong, but it carries a seat minimum (on the order of 20 self-serve, more for sales-assisted) that makes it expensive for a small or mid-size firm. The privacy guarantee most firms actually want, zero data retention for privileged content, is available on the API without committing to an enterprise contract. Buy Enterprise when the seat count and the procurement requirements justify it, not for the data handling alone.
The part that actually decides it: privileged data
For a law firm the plan question is really a confidentiality question. Two things are easy to get wrong:
- Training-off is not zero retention. Max opting out of training is good, but for privileged content the standard to aim for is zero data retention, so nothing is held by the model provider after the response. The mechanics of why this differs across plans are covered in our zero-data-retention breakdown.
- Access is the exposure, not just logging. The risk with consumer AI is that a model provider processed privileged material at all. A 2026 federal ruling addressed exactly this; see our read of the privilege decision and the three privilege tiers for the build-vs-buy choices.
One nuance for litigation firms: whether HIPAA applies depends on who your client is. If you represent an insurer or insured that is itself a covered entity, your firm is usually a HIPAA business associate, and a business associate agreement plus safeguarded data handling are in scope. If you represent a defendant that is not a covered entity and simply received records in discovery under a protective order, a BAA may not be required. Confirm your status with counsel. Either way, zero data retention with training disabled is the standard worth holding to for privileged and sensitive material.
How to choose, in one pass
- One person, trying it out: Pro.
- One person, heavy document review, mostly internal: Max.
- A firm-wide or automated workflow, or privileged data at volume: the API with zero data retention, connected to your practice management system.
- Large firm with the seat count and procurement needs: Enterprise.
Where Oktopeak fits
We build legal AI integrations for regulated firms, and the plan question is the first thing we settle, because it sets the data path for everything after it. If you want to run it yourself, our Clio connector is open source and free. If you want the firm-wide setup done right, our Guided Setup starts at $1,700 and gets your connection working on the right plan, scoped and audited. Larger custom builds run $17,000 to $53,000 and are scoped per firm after a free discovery call. See how the Clio integration works.
