Security and compliance
Who can see your files, and how you prove it
Privilege is the firm's obligation and the Data Protection Act makes it a data controller, so the system keeps files from the wrong eyes and shows, afterwards, exactly who saw what.
Where it runs
Your own deployment, your own database
The firm subscribes and we run the system for it, but never on a platform shared with other firms.
One firm, one deployment
Each firm runs on its own deployment of the system, with its own address. Nothing about one firm's work passes through another's.
One database of its own
A firm's matters, clients and books sit in a database that holds nothing else, not a table shared with other practices and split by a column.
The data is the firm's
We host and operate the deployment and keep it current. The firm owns what is in it and is handed the whole of it on request, in formats it can read without us.
Controls
What protects the files
Encrypted in transit and at rest
Nothing travels or sits on disk in the clear, including the database and the document store.
Documents behind signed links
Files live in private storage and are reached only through a link that expires minutes after it is issued.
Ethical walls that actually hide
A walled matter does not appear in a search, a list or a report for anyone outside it. There is no refusal to explain away.
An append only audit trail
Every view and every change is written down with who, what and when, and no one can edit the record afterwards. It is the record of processing the Data Protection Act, 2012 (Act 843) expects a data controller to keep.
Two step sign in for everyone
Any user can turn it on, by authenticator app or by a code sent to their email.
Backups that have been restored
Backups run continuously and a restore is rehearsed weekly, so recovery is something we have done rather than something we assume.
Every upload scanned first
A file is scanned for viruses on the firm's own deployment before anyone can open it, and an infected one is kept out of reach and reported to the firm's administrators.
Sign in that resists guessing
Repeated failures lock an account for a time, and a password known from a public breach is refused when it is set.
Sessions each person can see
Everyone can see where they are signed in and end any session, and an administrator can see and end anyone's.
Our access is the firm's decision
Vendor support reaches a firm's deployment only when the firm grants it, for a time the firm sets, and every step is in the audit trail.
Nothing is destroyed by one person
A deleted record is marked, not removed, and can be restored. Destruction happens only at the end of a retention period, needs two people, and is refused under a legal hold.
Built to the rule
The laws it is built to
Where the law sets a figure or a period, the firm keeps it as a setting its own lawyer can change, and the change is audited.
- Legal Profession (Professional Conduct and Etiquette) Rules, 2020 (L.I. 2423)
- Conflict checks before a matter opens, with the decision and any waiver on the record; confidentiality through permissions, walls and a read trail; and client money kept apart from the firm's own.
- Data Protection Act, 2012 (Act 843)
- A record of who saw and changed personal data, and a register of data subject requests answered within the firm's own time.
- Anti-Money Laundering Act, 2020 (Act 1044)
- Customer due diligence at intake, beneficial owners and politically exposed persons recorded, a risk band confirmed, reviews on a cycle, and internal concerns read by the compliance function alone.
- Value Added Tax Act, 2025 (Act 1151)
- VAT, NHIL and GETFund computed at the tax point on a common base, from rates the firm keeps as settings rather than figures in the code.
- Electronic Transactions Act, 2008 (Act 772)
- Electronic signatures with a certificate of what each signatory did and when, for the classes of document the firm decides may be signed this way.
See it against your own matters
A 45 minute walkthrough using your own matters. No commitment, and nothing to install to watch it.