# How to Make a Table of Authorities Without Uploading Your Brief

> Can't upload a brief to the cloud? Which Table of Authorities tools stay local, which send the file out, and how to check a browser tool yourself.

*Updated: 2026-09-24*

**The short answer:** if your brief cannot leave your computer, you have two kinds of options: tools that run locally (Word for Windows' built-in Mark Citation feature, a hand-built table, or a browser tool that processes the PDF on your own machine) and tools that send the document to someone else's server (upload services, cloud-backed add-ins, general AI chatbots). You do not have to take a vendor's word for which kind a browser tool is: the browser's own developer tools show every network request a page makes, and you can watch whether your file leaves. Below: why uploading matters, which TOA options send the brief out, and a five-minute check you can run on any tool. It is general information, not legal or ethics advice.

**Fast facts**

- ABA Model Rule 1.6(c): a lawyer “shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” States adopt their own versions.
- ABA Formal Opinion 512 (July 29, 2024) is the ABA's first formal ethics opinion on generative AI tools. It tells lawyers to assess the risk that information entered into such a tool is disclosed or accessed, and to read the tool's terms or consult people who can.
- A draft or final brief is information relating to the representation, even when the filed version will be public. Drafts, sealed filings and briefs quoting protected-order material are the sharpest cases.
- Microsoft Word for Windows builds a Table of Authorities on your computer with Mark Citation and Insert Table of Authorities. Microsoft says the feature is not supported in Word for Mac or Word for the web.
- Upload services, cloud-backed Word add-ins and general AI chatbots send document text to a third-party server by design. Their security terms vary; the file still leaves your machine.
- A browser tool can process a PDF entirely on your computer. You can check this yourself in the browser's Network panel and by going offline after the page loads.
- BriefAuthority is built to read the final PDF in the browser and never upload it. It is in development; early access is open at /early-access.

## Why uploading a brief is a concern

A Table of Authorities looks like clerical work, but to build one a tool has to read the whole brief: the argument, the record cites, the facts section, and anything quoted from sealed exhibits. Uploading the brief to generate a TOA is, in practical terms, sharing the entire work product with the vendor that runs the server.

For lawyers, the baseline is the duty of confidentiality. **Model Rule 1.6(c)** requires “reasonable efforts” to prevent unauthorized disclosure of, or access to, client information. Comment [18] to the rule lists the factors for what is reasonable, including the sensitivity of the information, the likelihood of disclosure if more safeguards are not used, and the cost and difficulty of those safeguards. The rule does not ban cloud services. It does mean someone has to decide, matter by matter, whether sending a brief to a given vendor is reasonable, and many organizations answer that question in advance with a blanket policy.

**ABA Formal Opinion 512** addresses generative AI directly. It asks lawyers to evaluate the risk that information entered into a generative AI tool will be disclosed or accessed by others, including inside the lawyer's own firm, and says that for tools that learn from the information entered, the client's informed consent is needed before confidential information goes in. It also says boilerplate consent language in an engagement letter is not enough, and that lawyers should read the tool's terms of use and privacy policy or consult someone who understands them. A TOA generated by pasting a brief into a chatbot falls squarely within that analysis.

**Who usually cannot upload**

- **Public defenders and court-appointed counsel**, whose offices often restrict unapproved cloud tools and whose briefs may discuss sealed or juvenile records.
- **In-house counsel**, whose company's information-security policy governs which vendors may receive company documents, and approval can take months.
- **Firms under outside-counsel guidelines** that prohibit sending client documents to unapproved third parties or to any AI tool without written consent.
- **Anyone filing under seal or under a protective order**, where the brief quotes material the court has restricted.

## Which TOA options upload, and which stay local

The table below sorts common approaches by where the brief goes. For named products it relies on each vendor's public positioning only; if a vendor offers a private deployment or specific contractual terms, that is something to confirm with the vendor, not something this page can verify.

**Where your brief goes, by TOA method**

| Method | Where the brief is processed | Leaves your machine? | Notes |
| --- | --- | --- | --- |
| Word for Windows: Mark Citation + Insert Table of Authorities | Locally, inside Word | No, unless the file itself is stored or synced to a cloud drive | Manual marking of every citation; Microsoft says TOA is not supported in Word for Mac or Word for the web |
| Building the table by hand | Locally | No | Slowest option; page numbers must be re-checked after every edit |
| Cloud-backed Word add-ins (e.g. Clearbrief, as published on its site) | Vendor's servers, per the vendor's public materials | Yes, under the vendor's security terms | Some publish certifications such as SOC 2; your policy may still require approval |
| Other Word add-ins (Best Authority, Benchly, research-suite add-ins) | Varies by product and plan | Check the vendor's documentation | Windows Word add-ins; account and licensing requirements vary |
| Upload services (e.g. Jurisage's upload-based TOA page) | Vendor's servers | Yes, by design | You send the PDF or document and receive a table |
| Human formatting services (e.g. TypeLaw) | The service's staff and systems | Yes, by design | People handle the brief; engagement terms govern confidentiality |
| General AI chatbots (ChatGPT, Claude, Gemini and similar) | The AI provider's servers | Yes | Data use and retention terms differ by plan; see ABA Formal Opinion 512 |
| BriefAuthority (in development) | In your browser, on your computer, per its design | No: built so the PDF is never uploaded | Specification as designed; confirmed at launch. Verifiable with the steps below |

> **“Runs in a browser” does not mean “uploads.”** Many web apps send your file to a server, but a browser can also run the processing itself, using JavaScript on your own computer. The reverse is also true: a desktop program or add-in can quietly call a cloud service. Where the processing runs is a factual question you can test, not something to infer from whether the tool opens in a browser tab.

## How to verify that a browser tool does not upload your brief

Every major browser ships with developer tools that record each request a page makes. Checking a tool takes about five minutes, and you can do it with a harmless test PDF before you ever load a real brief.

**The five-minute check (six steps)**

- **1. Open the tool's page** in Chrome, Edge, Firefox or Safari (in Safari, first enable the Develop menu in Settings › Advanced).
- **2. Open the Network panel.** In Chrome or Edge press ⌘⌥I on a Mac (Ctrl+Shift+I on Windows) and click Network. Tick **Preserve log** so nothing disappears, then clear the list.
- **3. Load a test PDF** of a known size, for example a 2 MB sample brief, and let the tool finish processing.
- **4. Read the request list.** Sort by the Size column and look at the Method column. An upload shows up as a POST or PUT request roughly the size of your file, or as a large WebSocket (WS) transfer. Small requests for fonts, scripts or page analytics are normal; a request carrying megabytes after you drop the file is not.
- **5. Go offline and repeat.** Load the tool's page, then turn off Wi-Fi (or choose **Offline** in the Network panel's throttling menu) and process the PDF again. A tool that truly works locally keeps working; a tool that needs a server shows an error or stalls.
- **6. Keep a note** of what you saw, with the date and tool version, if your office needs to document why a tool was approved.

Two caveats. The check shows what the page did during your test, so repeat it after updates if your policy requires. And browser extensions can read the pages you visit: for confidential work, use a browser profile without third-party extensions.

> **Where BriefAuthority fits:** BriefAuthority is a browser tool, currently in development, that is built to make a Table of Authorities from your **final PDF** without uploading it. The PDF is read page by page on your computer with PDF.js and a JavaScript citation parser; a review screen lists every authority with its pages so you can merge short forms, link *Id.* and *supra* references and exclude entries; then it exports a formatted **.docx** with category headings and dot leaders. It works on a Mac and needs no Word add-in or account to process. It does not check whether citations are good law or correctly cited. It is not available yet: planned pricing is $39 one-time or $9 per brief, and you can join **early access** at [/early-access](/early-access). When it launches, run the five-minute check above on it. Specification as designed; confirmed at launch.

## If you cannot use any new tool at all

Some offices will not approve any new software on short notice. Then the local options are Word for Windows' built-in feature (mark each citation with Alt+Shift+I, then insert the table) or a hand-built table. Either way, build or check it **after** the last edit, against the printed pages you will file, including roman-numeral front matter; FRAP 28(a)(3) requires page references, and local rules add more.

## Frequently asked

**Is it an ethics violation to upload a brief to a TOA service?**

Not automatically. Model Rule 1.6(c) requires reasonable efforts to protect client information, and what is reasonable depends on the sensitivity of the matter, the vendor's safeguards, and your jurisdiction's version of the rule. Many firms and agencies also have policies stricter than the rule. This page is not ethics advice; ask your firm's general counsel, ethics counsel or your state bar's ethics hotline.

**Can I use ChatGPT to make a table of authorities for a confidential brief?**

Pasting or uploading the brief sends its text to the AI provider. ABA Formal Opinion 512 asks lawyers to assess that disclosure risk, read the tool's terms, and in some cases obtain the client's informed consent first. Separately, a chatbot does not guarantee page numbers that match your final PDF or a complete list. See the ChatGPT page linked below.

**Does Word's built-in Table of Authorities upload anything?**

Word for Windows marks citations and builds the table inside the program on your computer. If the document itself is saved to OneDrive, SharePoint or another synced folder, the file is stored in that cloud as usual, which is a separate question from how the TOA is generated. Microsoft says the TOA feature is not supported in Word for Mac or Word for the web.

**How can I tell if a website uploads my PDF?**

Open the browser's developer tools, go to the Network panel, clear it, then load a test PDF. Look for POST or PUT requests, or WebSocket traffic, roughly the size of your file. Then go offline after the page loads and try again: a tool that works locally keeps working without a connection.

**Does BriefAuthority store or see my brief?**

It is designed not to receive the brief at all: the PDF is processed in your browser, on your computer. BriefAuthority is pre-launch, so treat this as the specification, confirmed at launch, and verify it yourself with the Network-panel and offline checks described on this page.

**Related**

- [How BriefAuthority works](/how-it-works) — The PDF-to-.docx pipeline, step by step.
- [Make a Table of Authorities from a PDF](/table-of-authorities-from-pdf) — Why the final PDF is the right source for page numbers.
- [Can ChatGPT make a table of authorities?](/chatgpt-table-of-authorities) — What a chatbot does well and what to check before you file.
- [Compare TOA tools](/compare) — Word, add-ins, services and BriefAuthority side by side.
- [Join early access](/early-access) — Get the launch price first.

**Sources**

- [American Bar Association — Model Rule 1.6: Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/)
- [American Bar Association — Comment on Rule 1.6](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/comment_on_rule_1_6/)
- [ABA Standing Committee on Ethics and Professional Responsibility — Formal Opinion 512, Generative Artificial Intelligence Tools (July 29, 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf)
- [Microsoft Support — Create a table of authorities](https://support.microsoft.com/en-us/word/create-a-table-of-authorities)
- [Chrome for Developers — Inspect network activity](https://developer.chrome.com/docs/devtools/network)
- [Chrome for Developers — Throttling (including Offline)](https://developer.chrome.com/docs/devtools/settings/throttling)
- [Firefox Source Docs — Network Monitor](https://firefox-source-docs.mozilla.org/devtools-user/network_monitor/)
- [Apple Support — Use the developer tools in the Develop menu in Safari on Mac](https://support.apple.com/guide/safari/use-the-developer-tools-in-the-develop-menu-sfri20948/mac)
- [Clearbrief — Pricing and security (as published)](https://clearbrief.com/pricing)
- [Jurisage — Table of Authorities page (as published)](https://jurisage.com/toa-page/)
- [Legal Information Institute — Federal Rules of Appellate Procedure, Rule 28](https://www.law.cornell.edu/rules/frap/rule_28)