Law firms: privilege, encryption, and where client files really live

Ask a managing partner where the firm's client files live and you'll get a confident answer: the server, or the document system. Then pull the thread. There's the paralegal's laptop. The associate's personal cloud folder from that one weekend brief. Three years of attachments sitting in everyone's sent mail. A phone in a gym bag with the email app logged in. Privilege, it turns out, has a geography problem.

Confidentiality is an ethics duty, not an IT preference

You know the rules better than we do: competence and confidentiality now explicitly reach technology — Florida was the first state to require tech CLE for lawyers, and not on a whim. A breach doesn't just cost cleanup. It puts you in the miserable position of telling clients that privileged material walked out the door. And the uncomfortable part is that most firm data doesn't leak from the server everyone worries about. It leaks from the places nobody ever mapped: endpoints, mailboxes, and personal accounts quietly doing work duty. Email deserves particular respect here: for most firms it is the de facto document system, calendar, and client file all at once — which makes one phished password a firm-wide event.

First the map, then the locks

Step one is an honest inventory — every place matter data actually sits, flattering or not. Most firms have never made that list, and every firm is glad once it exists. Step two is unglamorous discipline:

• Encrypt every laptop and phone that touches matter data, so a stolen bag is an inconvenience instead of a notification event
• Matter-based access: the family-law paralegal doesn't need the M&A folder
• MFA on every mailbox and the document system — a password alone guards nothing anymore
• Email retention and archiving rules, because sent-mail-as-filing-system is how privileged documents end up everywhere
• Backups tested with real restores, verifiable by someone other than the vendor, probably

Notice that almost none of that requires buying new software. It requires decisions — who can reach what, written down, enforced by settings instead of trust. Firms are usually surprised how much of it is configuration they already pay for and never turned on.

Why Florida firms keep asking us about Proton

A growing slice of firms — solos up through boutique litigation shops — are moving email and file storage to Proton, the Swiss privacy-first platform built around end-to-end encryption. The pitch is simple: if your entire product is confidentiality, run your mail on infrastructure designed so even the provider can't read it. Cyber Alamo is a registered Proton Partner, and law firms are exactly who has been calling about it. We also run and secure firms happily on Microsoft 365 and Google Workspace. The point isn't one logo — it's that the choice should be deliberate, documented, and easy to defend to a client who asks where their file lives. That question is arriving more often, too: institutional clients now send security questionnaires to outside counsel before they send work, and we-encrypt-and-here's-how has quietly become a business-development answer, not just a compliance one.

And a lawyerly caveat for the lawyers: what your specific bar obligations require — engagement-letter language, breach notification duties, conflicts of tech and ethics — is between you and ethics counsel. Our job is making the technical answers true before anyone has to give them.

Cyber Alamo manages IT for Florida firms with encryption, MFA, monitored backups, and a 24/7 security watch, on Proton, Microsoft 365, or Google Workspace — plus the documentation for when clients or carriers audit you. Book the free assessment and we'll map where your client files really live. The map alone is worth the hour.