The demo is going well. The dashboard is clean, the billing module does the thing your bookkeeper has been begging for, and the sales rep has just shown how a client can e-sign an engagement letter from her phone. Then the managing partner, who has been quiet for twenty minutes, asks the question nobody on the vendor side seemed to expect: "Where exactly is our client data stored, and who can see it?" The rep says he'll follow up. He does, three days later, with a PDF that answers a different question.
That moment is the one to pay attention to. Law firm software holds the most sensitive material a firm has: client confidences, privileged communications, trust account records, and the firm's own financials. Choosing it on features alone, without pinning down security, is a risk to clients, to the firm's reputation, and to the licenses of everyone in it. Here are the eight questions to ask before you sign, and what good answers look like.
Firms Are Moving to the Cloud Faster Than They're Securing It
The shift to cloud-based legal tools is well under way, and security practices are lagging behind it. According to the American Bar Association's 2024 Legal Technology Survey Report, 73 percent of firms now use cloud-based legal tools, with document and practice management software the most widely adopted, while only 60 percent of firms have formal cybersecurity policies in place.
Nearly three in four firms are trusting a vendor with their data. Four in ten haven't written down how they'll protect it. The questions below close that gap on the vendor's side.
1. Where Is Our Data Stored, and Who Controls It?
Ask for the specific hosting arrangement: which cloud provider, which regions, and whether data can be kept within a particular country for jurisdictional or client reasons. Ask who at the vendor can access client data, under what circumstances, and how that access is logged. A good answer names the infrastructure, explains access controls, and offers a data processing agreement. A vague answer about "secure servers" is a red flag.
2. How Is Data Encrypted?
Encryption should cover data in transit, between your browser and the platform, and at rest, on the vendor's storage. Ask which standards are used, whether encryption keys are managed separately from the data, and whether backups are encrypted too. The answer should be specific enough that your IT adviser can evaluate it.
3. What Independent Security Certifications Does the Vendor Hold?
Certifications such as SOC 2 Type II or ISO 27001 mean an outside auditor has examined the vendor's controls over time. Ask for the current report, not just the logo. Ask when it was last renewed and whether it covers the specific product you're buying rather than the company in general.
4. How Does the Platform Control Who Sees What?
Inside a firm, not everyone should see everything. Ask about:
- Role-based permissions down to the matter level
- Ethical walls for conflicts
- Multi-factor authentication, and whether it can be made mandatory
- Session timeouts and device management
- Audit logs showing who accessed or changed what, and when
A platform that can't restrict a paralegal from a partner's sensitive matter isn't ready for a law firm.
5. What Happens If There's a Breach?
Every vendor should have an incident response plan. Ask how quickly you'd be notified, what information you'd receive, who at the vendor is responsible, and whether the contract commits to notification timelines that let you meet your own obligations to clients and regulators. Ask whether the vendor has ever had a breach and how it was handled; a candid answer is more reassuring than a denial.
6. How Are Backups and Recovery Handled?
Ransomware and outages are as much a threat as theft. Ask how often data is backed up, where backups are kept, how long restoration takes, and whether the vendor tests recovery. Ask what the uptime commitment is and what happens if it isn't met. Firms need to know they can get to a client's file on the morning of a hearing regardless of what's happening at the vendor.
7. Can We Get Our Data Out?
Security includes the ability to leave. Ask what format data is exported in, whether documents, emails, time entries, and accounting records all come with it, how long the process takes, and what it costs. Ask what happens to your data on the vendor's systems after you leave and how deletion is confirmed. A vendor confident in its product makes leaving easy.
8. How Does the Vendor Handle Integrations and Third Parties?
Practice management platforms connect to email, document storage, payment processors, and other tools. Each connection is a potential weak point. Ask which integrations are native, how data flows between systems, whether third-party partners are held to the same security standards, and how the vendor vets them. Payment processing and trust accounting deserve particular scrutiny.
Putting the Questions to Work
The point of the list is to compare candidates on security as rigorously as on features. Firms evaluating law firm software can use the eight questions as a scorecard, asking each vendor the same things and comparing written answers rather than demo-room assurances.
CARET Legal, for instance, positions its cloud-based platform around end-to-end practice management, with matter management, billing and trust accounting, document management, a secure client portal, workflow automation, and dedicated mobile apps, integrations with Google, Microsoft, and Lawmatics, and a stated focus on identifying and preventing threats, with a separate data security page for the specifics a firm's IT adviser will want to review.
Whichever platform you evaluate, request the certification reports, the data processing agreement, and the incident response terms in writing, and have someone with security expertise read them before the contract is signed.
Don't Forget the Firm's Own Responsibilities
Even the most secure platform can't protect a firm that:
- Uses weak or shared passwords
- Doesn't enable multi-factor authentication because it's inconvenient
- Lets departed staff keep access
- Never trains lawyers and staff to spot phishing
- Has no written policy on devices, remote work, and client data
Security is a shared responsibility, and the vendor's answers to the eight questions only matter if the firm does its part.
Involving the Right People
Software decisions in law firms are often made by whoever is most frustrated with the current system. Security decisions should include the managing partner, whoever handles IT, and ideally outside counsel or a consultant familiar with the firm's regulatory obligations.
Ethics rules in most jurisdictions require lawyers to take reasonable steps to protect client information, and "the vendor said it was secure" is not a reasonable step on its own.
Conclusion
Whether your law firm software is secure comes down to eight questions: where data lives and who controls it, how it's encrypted, which independent certifications the vendor holds, how access is controlled inside the firm, what happens in a breach, how backups and recovery work, whether you can get your data out, and how integrations and third parties are managed.
With nearly three-quarters of firms now on cloud tools and far fewer with formal security policies, the questions matter more than ever, and the managing partner's quiet question in the demo is the right one. Get the answers in writing, have them reviewed, and choose the platform that answered them best, not the one with the prettiest dashboard.