How granular is the security inside the system?
"Yes, we support ethical walls" is a common answer in a demonstration. The question that matters is where the wall stops. Security inside a legal system can work at several levels, and a gap at any one of them is a gap in all of them.
The levels that matter
- Module: who can use billing, accounts or reporting at all.
- Function: who can approve, write off, authorise or delete.
- Client and matter: who can see a particular client or matter.
- Document: who can open a particular document, even on a matter they can see.
- Field: who can see sensitive values, such as rates, costs or personal data.
Where walls leak
A matter can be restricted on its main screen and still appear in global search, in a report, in an email filing suggestion, on the mobile app, through the API, or in an AI assistant's answer. The test of an ethical wall is whether it holds everywhere the data can be reached.
Open by default, or closed?
Many firms let everyone see most matters and restrict the sensitive few. Others restrict by default. Either can be right, but it should be a decision, and new matters and documents should inherit the right security automatically rather than relying on someone remembering.
What to ask, and what to see
- Restrict a matter, then search for it, report on it, open it on a phone and ask any AI feature about it, as someone outside the wall.
- Can access be controlled at document and field level?
- Do new documents inherit the matter's security?
- Are views recorded as well as changes, so you can see who looked?
Technical notes: small decisions, big consequences
Start with the overview: The details that decide the project
Accounts and finance
- Core accounting is still the gold standard
- One-way or two-way sync? Connecting your legal system to Xero
- Units or minutes? How time is recorded
- Your matter and nominal structure
- Making Tax Digital: the firm and its clients
Workflow, data and documents
- Workflow: deep, basic or none?
- Client onboarding and matter inception: portal, e-signature and ID checks working as one
- Custom data: what you rely on, and how you move it
- Precedents, merge codes and macros: your document bank in a new system
Your types of work
- Legal aid: your records, not just the Legal Aid Agency’s
- Litigation: Precedent H starts with time recording
- Family: Form E and financial disclosure
- Private client: where does the tax software fit?
Security and access
- Roles or individuals? How user permissions are set up
- Why manage security twice? Linking application security to Microsoft Entra
- How granular is the security inside the system? (you are here)
- Who can see what in reporting?
- Shared platform, your data: separation, restore and erasure
- When the supplier is the target: where your data lives, who can reach it, and your real risk
Microsoft 365
- How does it connect to Outlook?
- What did you just give it permission to do?
- What happens behind the scenes? Background integrations with Microsoft 365
- OneDrive is not a document management system
- Microsoft 365 is not a backup
Data and decisions
Where does your firm stand?
Our free practice management review shows how much of your current system you really use and, if you are thinking of moving, builds an independent requirements specification that takes your reasons into account. Nothing is sent to us.
Start the free review Talk to us