Jump to section
A client emails at 4:50 on a Friday. She wants to know where her file "actually lives" now that your firm has moved off the old server in the back room. It is a fair question, and a lot of lawyers freeze on it. Here is the honest, practical version of the confidentiality issues that cloud tools raise for Canadian practice, laid out as the questions people really ask.
Does Storing Files in the Cloud Break Confidentiality?
No, not on its own. Your duty of confidentiality does not say the file has to sit on a hard drive you can touch. It says you have to take reasonable steps to protect the information a client entrusts to you. Every law society in Canada now accepts that cloud storage can meet that standard when the tool is chosen and configured with care.
The word that matters is reasonable. Reasonable depends on the sensitivity of the matter. A residential lease file and a high-conflict custody file with a safety concern are not the same risk. The steps you take should scale with what is at stake. A tool that is fine for one may not be fine for the other.
Note. Your obligation does not transfer to the vendor. If a provider mishandles client data, you are still the one answering to the client and the law society. Choosing the vendor is part of the duty, not a way around it.
Why Data Residency Matters in Canada
Data residency means where the servers holding your files physically sit. This matters for two reasons. First, foreign servers can put client data within reach of foreign law, including access requests that neither you nor your client would ever hear about. Second, some client work carries residency requirements of its own. Government files, health information, and certain regulated industries may require that data stay in Canada.
Ask the vendor a direct question: in which country are our files stored, and where are the backups? A serious provider answers plainly and often lets you pick a Canadian region. A vague answer is itself an answer. If you are weighing this against on-premise storage, our note on choosing a document management approach walks through the trade-offs.
| Question | What a good answer sounds like |
|---|---|
| Where is our data stored? | A named country or region, with a Canadian option |
| Where do backups go? | Same region, encrypted, with a stated retention period |
| Who holds the encryption keys? | The vendor, on your behalf, with access logged |
| What happens if we leave? | A full export in a usable format, then deletion on request |
Who Can See Your Data at the Vendor?
Encryption protects files in transit and at rest, but someone at the vendor almost always has a path to the underlying systems. That is normal. The question is how that access is controlled and recorded. You want to hear about least-privilege access, staff who cannot read customer files as a matter of routine, and audit logs that capture who touched what.
On your side of the line, access control is entirely yours to manage. Give people the access their role needs and no more. Turn on multi-factor authentication for everyone, not just the partners, which is the single cheapest security upgrade most firms can make. We made the case for that in rolling out MFA across the whole firm.
The breach that hurts a small firm is almost never a sophisticated intrusion. It is a shared password and a stale account nobody closed. A recurring pattern in small-firm incidents
Close accounts the day someone leaves. Review who has access every few months. Tools like metadata hygiene and a habit of spotting phishing matter here too, because most cloud exposures start with a credential, not a cracked server.
How to Read the Security Section of a Contract
The security section is where the marketing stops and the commitments begin, or fail to. You do not need to be a data lawyer to read it. You need to look for a few specific things and note what is missing.
- Encryption: in transit and at rest, stated as a fact, not a hope.
- Breach notification: a promise to tell you, within a defined window, so you can meet your own reporting duties.
- Sub-processors: a list of the other companies the vendor hands your data to, because their servers become your servers.
- Data ownership and export: plain language that the data is yours and you can take it with you.
- Deletion: what happens to your files, and their backups, after you cancel.
Tip. If a term is silent on something above, treat silence as a red flag and ask in writing. A vendor's willingness to answer is data too. Our fuller checklist lives in vetting a software vendor.
When you evaluate a platform, the security posture should be documented, not folklore. A practice tool built for legal work, such as A1 CMS, should tell you where data lives and how it is protected before you ever ask. If you have to dig, keep digging or move on.
What to Do When a Client Asks Where Their File Lives
Back to that Friday email. The right answer is short, calm, and specific. Tell the client the file is held in a secured, encrypted system hosted in Canada (if that is true), that access is limited to the people working on the matter, and that the firm reviews its safeguards regularly. You are not promising perfection. You are showing that you have thought about it.
Many firms now put a plain line about this in the retainer or on the website, so it is answered before it is asked. If you want to go further, a short internal security checklist and a written firm policy give your staff a consistent script and give you a record that you took reasonable steps.
Confidentiality in the cloud is a series of small, checkable decisions: pick a vendor who tells you where the data sits, control who can open it, read the contract for what it actually promises, and keep a plain answer ready for the client. Do those four things and the cloud is safer than the unlocked filing cabinet it replaced. When you are ready to look at the moving parts of running a modern practice, the wider legal tech and AI archive and our knowledge base are good next stops.
