Where does your clients' data live? One question to ask before choosing a system
Before the price, before the features, before the demo: the question every partner should ask a software vendor, and why CaseFlow's answer is architecture rather than a promise.
When a law firm chooses a management system, the conversation usually starts with price and moves on to features. But there is one question that should come before both, and most vendors would rather it were not asked: where, physically, does my clients' data live?
Why it is the first question
A client's file is the most sensitive thing a firm holds. It contains what the client said behind a closed door, documents that must never see daylight, and a strategy the other side would love to read. The duty of confidentiality belongs to the lawyer, not the vendor. When the data sits on a vendor's server, the lawyer has entrusted that confidentiality to someone else, usually without knowing exactly where, or who else can reach it.
There is also a question of concentrated risk. One server holding the files of a thousand firms is one address. A breach there exposes all of them at once.
What CaseFlow answers
Our answer is architecture, not a promise in a contract:
- The data is on the office computer, encrypted. The database lives on the firm's computer. A copy of the file taken to another computer does not open.
- In the firm's cloud — only if you choose. The backup is encrypted and kept on the computer. Syncing it to the firm's own cloud — Google Drive, OneDrive or Dropbox, in your own account — is a choice, off by default.
- On our servers: nothing. No server of ours holds case files. Our servers handle licensing and updates, and that is all.
This does not mean there is no internet. The courts system, e-mail, WhatsApp and Zoom are connected to the system. But the connections go from the office computer straight to the service, not through us.
What to ask any vendor
If you are evaluating a system, three short questions:
- Where is my firm's database stored, and who can access it?
- If I leave, how do I get the data back, and in what format?
- What happens to my data if the vendor is breached?
A vendor who answers all three clearly has passed the first test. Then you can talk about price.