Protecting client data and confidentiality: practical steps for law firms

How do law firms’ secrets usually leak?

A law firm’s secrets rarely leak through a sophisticated attack. The usual causes are far simpler: a password written on a note beside the screen, an account used by two employees, a photo of a judgment sent from a personal phone to the wrong number, or an employee who has left the office while their account kept working for weeks. That is why protecting client data starts with the team’s habits; then the law firm management system plays its part by narrowing what each person sees, recording what they do and closing the doors that no longer need to be open.

• Shared accounts that make it impossible to know who did what, and when.
• Broad permissions granted “for now” that nobody ever reviewed.
• Documents sent through personal messaging apps instead of the office’s channels.
• Shared devices left signed in after their user has gone.
• Accounts of employees who have left and were never deactivated.

These details carry particular weight in a law firm, because clients hand over papers they might not share even with those closest to them: a family dispute, a criminal case, a company’s secrets and dealings. What protects those papers is not a general promise of confidentiality written into the contract, but small details the office lives with every day: who opens the file, where copies are sent, and when the account of someone who has left is closed. Those details are the subject of this guide, from the team’s habits to the system’s controls.

Daily habits no system can replace

These habits cost nothing, but someone has to keep reminding people of them until they become part of the office’s culture. It helps to write them on a single page that every new employee reads on their first day at work, and for the managing partner to go over them with the team every few months, especially after any near miss in which a document almost reached the wrong person. A rule explained once is forgotten; a rule recalled at every opportunity sticks.

1. Every employee has an account in their own name, with a password nobody else knows, and changes it at once if they suspect someone else has learned it.
2. “Remember me on this device” is for personal devices only, and you sign out of the system before leaving any shared device.
3. Client documents are sent only through channels the office has approved, such as the client portal or the office’s email.
4. Internal discussion about files takes place in the system’s internal chats, not in groups on personal apps.
5. Lock the screen whenever you step away from your desk, even for a few minutes.

Phones and devices outside the office

The system runs in the browser on computers, phones and tablets, installs on the home screen as an app, and delivers device notifications for alerts and chat messages even when it is closed. The flexibility that makes life easier for a lawyer in the corridors of the court also means the office’s files are now in their pocket, so security habits have to travel with them outside the office: to the waiting room, the car and home.

• Lock your phone with a passcode or fingerprint, and hide notification content on the lock screen in the phone’s own settings.
• Do not turn on “Remember me” on a tablet shared with family members or office colleagues.
• From your menu in the system, turn off device notifications on any browser you no longer use.
• If a phone with the system on it is lost, change your password immediately and tell the system administrator so they can review the audit log.

Permissions: access on a need-to-know basis

Permissions in Murafe are built on roles, and each role has specific rights in every section: view, add, edit, delete and print. The access scope then decides whether a user sees only the cases assigned to them or every case in the office. A single employee can be given or denied a permission without their role changing or their colleagues being affected. The practical rule: start with the narrowest access and widen it when needed, through a clear request whose reason everyone knows.

The right question when granting any permission is not “Do we trust this employee?” but “Does their work need it?”

• A confidential case is visible only to its team members and to anyone given the “View confidential cases” permission.
• Within any case, a particular document can be set to “Specific people only”, which hides it even from the rest of the case team.
• Viewing and downloading documents are two permissions, not one: “View and preview documents” is one thing and “Download documents” is another, so an employee can read a document inside the system without taking a copy of it.
• Seeing fees, amounts paid and balances outstanding, and seeing the office’s internal expenses, are separate financial permissions.
• Printing is a separate permission in every section that has printouts.

The audit log: a name and a time for every action

Permissions prevent what is not allowed; the audit log reveals what happened. The log keeps every addition, edit, deletion and merge — who made it, when and from which device — along with document views and downloads and the printing of vouchers. So if a client one day asks who has seen their document, or two employees disagree over who changed a hearing date, the office has a documented answer instead of a guess.

1. Give the job of reviewing the log to someone other than the person with the widest permissions in the office.
2. Review deletions and merges every month: they are the least frequent actions and the ones most in need of an explanation.
3. Keep track of document downloads in confidential files: viewing inside the system is one thing, a copy leaving it is another.
4. Ask about any activity at unusual hours, or from an account that does not normally work in that section.

Reviewing the log does not mean watching employees with suspicion or making them feel accused. It is enough for everyone to know that sensitive actions are recorded under their names for mistakes to become rarer of their own accord, and for disagreements to be settled by facts rather than memory. And if a mistake does happen, such as a deleted document or a changed date, the log shows when it happened and who did it, so it can be put right quickly and discussed calmly with the employee concerned.

An account’s life cycle: from first sign-in to departure

Protecting an account does not end with a good password. After several failed sign-in attempts in a row, the account is locked temporarily, and the system administrator can unlock it at once if it turns out the owner simply made a mistake. If the system is left open with no activity, the user is signed out automatically after the period the office sets, so no client file stays open on a screen left in the meeting room. Anyone who forgets their password does not borrow a colleague’s account; the system administrator sets a new temporary password for them, which they change when they sign in. The most delicate moment in any account’s life, though, is when its owner leaves the office, and it calls for steps that cannot wait:

1. Deactivate the employee’s account on the day they leave, not afterwards: their access stops while their records and work stay as they are.
2. Assign their files to a colleague, and review the case teams they belonged to.
3. Change the shared passwords of any other office service they knew.
4. Review their activity over their last days in the audit log.

What does the system provide on its side?

Alongside what the office manages itself, Murafe provides controls at the infrastructure level, and the managing partner should know them precisely to answer a client who asks: Where are my papers kept, and who can see them? Most of these controls work without any setup by the office, but they do not replace the habits and permissions discussed above; they complement them.

• A separate database for every office, with its own file storage, its own web address and its own sign-in, so one office’s data never mixes with another’s.
• An encrypted connection (HTTPS) for everything exchanged between the browser and the server.
• Passwords stored with secure hashing, not as readable text.
• A daily backup covering the office’s database and the files uploaded to it, plus a copy taken on request before major changes.
• Technical support access is in the office’s hands: the office can switch it off in the settings, and every support sign-in is recorded in the audit log under the name “Murafe Support”.

The route to the client: a portal instead of scattered messages

Many leaks happen on the way to the client rather than inside the office: a photo of a judgment on WhatsApp, or a file attached to an email sent to an old address. The client portal shortens that route. Clients sign in with their own account and see only what the office decides: the hearings and updates it allows, the document types it has chosen, and their financial account if they are allowed to see it. They can also be limited to viewing documents inside the portal without downloading them.

• Write to the client in the portal that the document is available instead of sending the document itself; if new-message alerts are switched on in the settings, the client receives a short notification by email and WhatsApp inviting them to sign in.
• Choose for each client the document types they can see, rather than opening everything to them by default.
• Keep the client’s phone number and email up to date in their file: a message sent to an old number may reach someone else.

When a client writes to the office from the portal, about their file in general or about a particular case, the responsible lawyer and the case team are alerted, and the message appears in the case file if it concerns that case. Correspondence with the client thus stays inside the system instead of being spread across employees’ personal phones, so if an employee leaves the office one day, the history of contact with their clients stays where it is.