Any tool that holds client information becomes part of how the firm protects it. Providers describe security in many ways, and the descriptions are hard to compare.
This article lists questions to ask and how to read the answers. It names no provider, and it does not replace your attorney's judgment about confidentiality duties.
The problem
Security descriptions are often broad: encrypted, secure, protected. Without specifics, the firm cannot tell what is really covered.
A firm that does not ask also cannot show later that it looked at the question before choosing the tool.
What is known
We cite no figure on breaches or on provider security, because we have not verified one from a primary source.
What is certain is that a provider can answer specific questions in writing. Whether a provider holds an independent certification or audit report is a fact to ask for and read, not to assume. This article makes no claim about any certification.
What to do
- Ask where client information is stored, in which country, and who at the provider can read it
- Ask how access is controlled: individual accounts, extra verification at sign-in and a record of who opened what
- Ask how information is protected when it is stored and when it travels
- Ask what is kept after the firm leaves, how it can be exported and how it is deleted
- Ask which other companies handle the information on the provider's behalf
- Ask what happens if something goes wrong: how the firm is told, how soon and what the provider does
- Ask for the answers in writing, and for any audit report or certification the provider says it holds
- Give the answers to your attorney, who decides whether they fit the firm's confidentiality duties
How to read the answers
- A specific answer with a document behind it is stronger than a general reassurance
- An answer that changes when the question is asked in a different way needs a follow-up
- A claim of certification should name the standard, the scope and the date, and the firm should ask to see it
- A refusal to put an answer in writing is a reason to pause
- A provider who promises that nothing can ever go wrong is not describing real systems
What to look for when you implement it
- Whether every person who uses the tool has their own account, and whether former staff are removed
- Whether privileged material is shared with more people than before
- Whether the tool can limit what each person sees, matter by matter
- Whether the firm keeps its own backup of the information, as our article on backups describes
- Whether staff are trained in safe use, such as recognizing suspicious messages
- Review the answers again when the provider changes its terms or its subcontractors