Client Confidentiality and Cloud Software: Vet Vendors, Close the Intake Gap

Almost every firm already relies on cloud software for client information: email, practice management, document storage, e-signature, billing. The ethics question is no longer whether that is allowed. It is whether your firm made reasonable efforts to protect what is in those systems, and whether you can show it if a client, a bar or a court asks.

This guide covers the duty that governs the question, the vendor questions worth asking before you upload anything, and the two places confidentiality most often breaks in litigation practice: how evidence comes in from clients and how it goes out to others. The ABA Model Rules are the reference point. Your state’s rules and ethics opinions set the actual standard, so read them alongside this.

Can lawyers use cloud software for client files?

Generally yes. Ethics opinions across the country have treated cloud computing as permissible when lawyers take reasonable care in selecting and using the service, and the comments to Model Rule 5.3 expressly contemplate outside services such as internet-based storage of client information.

The governing duty is Model Rule 1.6(c), which requires a lawyer to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation. Two points follow. First, the standard is reasonableness, not perfection; a breach does not automatically mean a lawyer failed the duty. Second, the duty is ongoing. A vendor that was reasonable to choose three years ago may have changed its terms, its ownership or its AI practices since.

What counts as “reasonable efforts” under Rule 1.6(c)?

The comments to Rule 1.6 describe a balancing test rather than a fixed checklist. The factors include:

• The sensitivity of the information.
• The likelihood of disclosure if additional safeguards are not used.
• The cost of additional safeguards.
• The difficulty of implementing them.
• Whether they would make it unreasonably hard to represent clients.

A client can also ask for more protection than the rule requires, or give informed consent to less. In litigation practice, sensitivity varies sharply within a single matter. Family law files routinely include children’s school and medical information, financial account numbers, intimate images and safety-related addresses. Those categories justify stronger handling than routine correspondence, even inside the same system.

What should you ask a cloud vendor before uploading client data?

Ask specific questions in writing and keep the answers with your vendor file. A marketing page that says “bank-level security” is not an answer.

Data handling and access

• Where is our data stored and processed, and which vendor staff can access it, under what circumstances?
• Is data encrypted in transit and at rest, and who holds the keys?
• Which subprocessors handle our data, and will you notify us when that list changes?
• Do you support multi-factor authentication, role-based access and per-client separation?
• Are access and changes logged, and can we see those logs?

AI and secondary use

• Does any feature send our data to an AI model, and whose model?
• Are our inputs or files used to train or improve any model, yours or a third party’s?
• Can AI features be turned off for a matter or for the whole account?

Incidents, retention and exit

• What is your contractual breach notification commitment?
• How long do you keep deleted data and backups?
• Can we export everything, including metadata and hash values, in standard formats?
• Will you confirm deletion in writing when we leave?

The same questions matter even more for generative AI tools. ABA Formal Opinion 512 concludes that self-learning tools require informed client consent before client information goes in; see our breakdown of ABA Formal Opinion 512.

Where does confidentiality break most often?

In litigation practice, the weak point is frequently intake: the path evidence takes from the client to the firm. A well-secured document system does little good if the files reached it through channels nobody controls.

Common patterns:

• Clients email screenshots from a shared family computer or an account another household member can read.
• Clients text photos and documents to a staff member’s phone, where they sit outside any firm system.
• Clients share links to personal cloud folders that stay open indefinitely, sometimes to anyone with the link.
• Files arrive with filenames that reveal sensitive content to anyone who sees an email preview.

A request-based intake process fixes most of this. Staff ask for specific records, the request names who should respond, and submissions land directly in the matter instead of in inboxes. CourtBriefly’s client intake works this way, keeping submissions attached to the matter and tracking which records are still missing. For a fuller treatment, see why firms are adopting a client evidence submission portal.

How do you control access inside the firm?

Limit each matter to the people working on it, and separate internal discussion from anything a client or outside party can see. Confidentiality failures inside a firm are usually about convenience: everyone has access to everything because setting permissions felt like overhead.

• Need-to-know access by matter, with ethical screens enforced in the software, not just in a memo.
• Separate client workspaces where clients or co-counsel participate, so one client’s materials cannot surface in another’s view.
• Private firm discussion kept apart from client messaging, so strategy notes never sit one click from a client-visible thread.
• Scoped, revocable credentials for integrations and scripts; if your software offers an API, give each integration its own token with only the permissions it needs (an example of token-based access controls).
• Prompt offboarding when staff leave, including mobile devices and any personal accounts used for work.

How do you share files outside the firm safely?

Every external share should have a defined set of materials, named recipients, an expiry and a record of what was sent. Experts, guardians ad litem, mediators, co-counsel and opposing counsel all receive client information, and open-ended links are where control quietly ends.

1. Select deliberately. Choose the specific files for this recipient, not the whole folder.
2. Redact first. Remove personal identifiers that the recipient does not need, and verify that the redaction removed the underlying text.
3. Name the recipient and set an expiry. Access should end when the purpose ends.
4. Record acknowledgment. Keep a record of what was released, to whom and when, with a manifest if original files are included.

What about retention and leaving a vendor?

Confidentiality obligations outlast the matter, so plan the end of the data’s life at the start. Your retention policy should say how long closed litigation files are kept, where, and how they are destroyed. Confirm before signing that you can export everything you need in a usable form and that the vendor will delete your data, including backups, on a stated schedule after you leave. A firm that cannot get its data out has a confidentiality problem waiting for the day it changes vendors.

Finally, write down what you decided and why. A short vendor file for each system that holds client information should include:

• The vendor’s written answers to your questions and the date you received them.
• Copies of the terms of service, privacy policy and data processing terms you relied on.
• Which categories of client information the firm allows in the system, and any it does not.
• Who approved the vendor and when the review is next due.

That file is what lets you show reasonable efforts later, and it makes the annual review a comparison rather than a fresh project. If you are unsure how your jurisdiction’s rules apply to a particular system, your state bar’s ethics hotline or a licensed ethics attorney where you practice can help.