Storing client files in the cloud: what your bar expects from you

Moving client files into cloud storage is not what creates the problem. Having nothing in writing to show what you checked before you moved them is.

The duty of confidentiality stays with the firm when a vendor is involved. What changes is where client information sits, who can reach it, and how many copies exist. When a firm's data handling comes up in a bar inquiry or a carrier review, the questions are narrow and consistent: what did you check before the data moved, who can reach it now, what happens when a matter closes, and what records can you produce.

The questions to answer before a tool holds client data

Where is the data stored, and in which country is it processed? Who at the vendor can reach it, and under what circumstances? Is client data used for any secondary purpose, including model training or product improvement? Is it encrypted in transit and at rest? If there is a breach, how quickly is the firm notified, and who tells the client? Which subcontractors does the vendor depend on? How do you take everything back out? What happens to the data when the contract ends? Can the vendor change its terms without telling you? Write the answers down with the date you received them, because the terms a vendor offers this year are not necessarily the terms it offered when you started using it.

A written answer is what makes diligence real. A vendor that cannot answer the questions in writing is telling you something useful. So is a vendor whose answer changes when you ask a second time.

When a vendor will not put answers in writing, the decision is still the firm's to make, and so is the record of it. Smaller vendors, self-hosted tools, and software bundled with a practice management platform often have no security addendum to hand over. In those cases, keep a short note in the firm's own file: what was asked, what was provided, what the firm decided, who decided, and the date. That note is what makes the decision reviewable a year later. The alternative, which is common, is a tool in daily use with nothing on file explaining why anyone believed it was acceptable to use on client work.

Access is where most of the risk sits

The common problems are ordinary ones. Matter folders open to everyone in the firm because permissions were set once and never narrowed. A share link created for one client that is still live a year later. A paralegal who left in March whose account is still active. Contract attorneys who kept access after the engagement ended. A file sync folder that mirrors client documents onto laptops nobody tracks.

The control is a list, and in a small firm it is one page: who can reach which matters, how that permission was granted, when it was last reviewed, and who can delete. Two things tend to be missing from that page. The first is permission to delete, which most people have and few should. The second is version history, which decides whether a bad edit is recoverable or permanent.

Closed matters, retention, and client requests

Retention periods are set by your jurisdiction, and they differ enough that copying another firm's schedule is risky. More useful is a written answer to four questions. Where does the file live once the matter closes? Who can still open it? How long is it kept, and who decides when it is deleted? What do you do if a former client asks for the file years later? Firms that have thought about this can produce a closed file in an afternoon. Firms that have not end up reconstructing one from email.

Client requests deserve an answer the firm has already rehearsed. A former client asking for their file should get a response with a defined path behind it: where the file sits, who assembles the index, how it is delivered, and who checks that nothing from another matter is included. That last step matters more than it sounds, because files get assembled in a hurry and shared drives hold more than one client. A firm that can produce a clean file within a few business days is in a very different position from one that needs a week to work out where the documents live.

The records worth keeping

• A vendor list, with the name of the person who approved each tool and the date of the approval.
• The diligence answers as they were recorded when the tool was approved, not the version you would write today.
• The contract, or at minimum the data terms and the security addendum.
• An access review log with dates, the reviewer's name, and what changed.
• An incident log that includes near misses: a document sent to the wrong person, a link left open too long, a laptop taken out of the office.
• The retention schedule, with the person responsible for each decision on it.
• The approved tool list your staff can see, so nobody has to guess what is allowed.

Where small firms get caught

The pattern is rarely dramatic. One attorney starts using a transcription service and nobody else hears about it. Client documents get pasted into a free consumer assistant because it was the only tool open at the time. Access is never removed for a lawyer who left over the summer. A vendor contract sits unread in a shared drive. Data ends up stored in a region nobody considered, because the default setting was the default. Each decision made sense on the day it was made. What was missing was anyone keeping the list.

A practical order of operations

• Start with the inventory, because you cannot assess a tool that nobody has listed.
• Sort the tools by whether client data reaches them. Most will not, and those need less attention.
• For the ones that do, pull the terms and record answers to the questions above.
• Fix the access list before adding the next tool, since adding a tool to a firm with stale access widens an existing problem.
• Set a review date on the calendar. Twice a year is workable for a small firm, and once a year is the minimum.

Someone has to own the list. In a small firm that is usually one named person, with a date on the calendar and an hour blocked for it. When the work belongs to everyone, it gets done after something goes wrong instead of before. If your firm has an office manager, this fits naturally into that role. If it does not, the managing partner keeps it, or an outside provider runs it on a schedule the firm can point to when the question comes up.