Shared platform, your data: separation, restore and erasure

How is your data kept apart?

Separation can be physical, with a database for each firm, or logical, with every record tagged to its firm inside a shared database. Both can be secure, but they behave very differently when something goes wrong, when you need a restore, and when you leave.

• Separate databases or shared? And what about documents, search indexes, AI services and reporting copies?
• Encryption keys: is your data encrypted with keys unique to your firm, and can you hold or revoke the key yourselves?
• Testing: does penetration testing specifically try to reach one customer's data from another customer's account?
• Location: where is your data, its backups and its disaster recovery copy held?

Could you restore your data to a point in time?

Vendor backups exist to recover the platform from a disaster. They are not necessarily designed to undo your firm's own mistake, such as a bulk update gone wrong, a deleted matter or a misbehaving integration. On a shared database, restoring one firm's data without affecting everyone else is genuinely difficult, and some vendors simply cannot do it.

• Can they restore just your firm, one matter or one document, to a chosen point in time?
• Can a restore go into a separate environment, so you can compare before anything is overwritten?
• How far back can they go, how long does it take, and what does it cost?
• Are restore times and backup retention written into the contract?

Could you erase someone completely?

Law firms often have good reasons to keep records: accounting records, regulatory obligations and the possibility of claims all limit the right to erasure. But when erasure is due, at the end of a retention period or on a valid request, the system has to be able to do it properly.

• Purge, not hide: many systems "delete" by marking a record as inactive. Can a person's data be permanently removed?
• Everywhere it has spread: documents and emails, search and AI indexes, reporting databases, data warehouse copies and connected systems.
• Backups: the ICO accepts that data may remain in backups until they are overwritten, provided it is put beyond use and you are clear with the individual about what happens. Ask how long backups are kept, and how the vendor makes sure a restore never brings erased data back.
• Evidence: a record of what was erased and when, without keeping the personal data itself.
• Retention schedules: can disposal at the end of a retention period happen automatically, by matter type?

When you leave

Ask for a complete export of your data and a written confirmation that your data, including backups, will be deleted within a stated period afterwards. Put both in the contract.

What to ask, and what to see

1. Explain how our data is separated from other customers', including documents, indexes and backups.
2. Restore a single test matter to an earlier point in time, into a separate environment.
3. Permanently erase a test person and show they are gone from search, documents, reports and the API.
4. Show how erased data is kept from returning after a restore from backup.
5. Put backup retention, restore times and deletion on exit in the contract.