Law Firm IT, Built Around Client Confidentiality
California holds lawyers to one of the strictest confidentiality duties in the country: to “maintain inviolate the confidence, and at every peril to himself or herself to preserve the secrets,” of the client. Today almost every client secret lives in email, a document system or a laptop. We run IT for law firms and legal departments with that duty as the starting point, not an afterthought.
The State Bar’s guidance is consistent: lawyers don’t have to be technology experts, but they do have to understand the risks or bring in someone who does. That’s the role we fill.
Your duties in plain English
Who this applies to. California law firms of every size, solo practitioners and in-house legal departments: every lawyer who keeps client information on a computer, a phone or in the cloud.
| The source | What it asks of you |
|---|---|
| Bus. & Prof. Code § 6068(e)(1) | Maintain client confidences inviolate and preserve client secrets “at every peril” |
| Rule 1.6 | Don’t reveal protected client information without informed consent or a permitted exception |
| Rule 1.1, Comment [1] (since 2021) | Competence includes keeping abreast of “the benefits and risks associated with relevant technology” |
| Rules 5.1 and 5.3 | Managers and supervising lawyers make reasonable efforts to ensure lawyers, staff and outside assistants handle client information in line with the lawyer’s duties |
| Formal Opinions 2010-179 and 2012-184 | Before using a technology, weigh its security, the sensitivity of the information and client instructions; with cloud vendors, use reasonable due diligence at selection and throughout the relationship |
| Formal Opinion 2020-203 | Take reasonable steps to secure systems, consider a written breach response plan, act quickly to stop a breach and investigate it, and tell clients when their confidential information is compromised |
| Formal Opinion 2023-208 | Remote work doesn’t change the duties; firms need policies, secure tools, vetted vendors and supervision for people working from home |
| State Bar Generative AI Practical Guidance (2023, updated May 2026) | Don’t put confidential client information into an AI tool without adequate confidentiality and security protections; review how the tool uses inputs; consult IT or security professionals; set firm AI policies |
| SB 574 / Bus. & Prof. Code § 6068.1 (signed September 30, 2026; effective January 1, 2027) | Among other duties, don’t enter confidential, personal identifying or other nonpublic information into a generative AI system unless access is restricted to the attorney and people the attorney authorizes |
Reasonable, not invulnerable. The State Bar has said the standard is reasonable efforts calibrated to the risk, not perfection. But some protections, like the ability to locate and lock down a lost device, are so easy that skipping them may be unreasonable. Reasonable keeps moving as threats do, which is why it has to be run, not set once.
What we do, and what we don’t. CRC Cloud does not give legal advice, and we don’t decide your ethical obligations — that judgment belongs to you, your ethics counsel and the State Bar. We don’t certify compliance either. What we do is run IT that gives you a strong, documented answer when a client, an insurer or a regulator asks how you protect confidential information. Align, implement and prepare — never certify or guarantee.
The confidentiality controls we implement and operate
Access Control & MFA
Multi-factor authentication on email, document systems and remote access; least-privilege permissions; and matter-level restrictions where you need ethical walls. Client files, email and backups stay in systems we manage and secure, with access limited to the people who need it.
No AI on Client Matters Without Your Approval
We never put your firm’s data into a generative AI service unless your firm has approved that service in writing. When you’re ready to adopt AI tools, we help you evaluate how a tool stores, retains and uses what you enter, and configure access so it’s restricted to the people you authorize.
Email & Document Security
Encryption at rest and in transit, protection against phishing and impersonation, and secure ways to share documents with clients and opposing counsel instead of unprotected attachments.
Device Encryption & Monitoring
Encrypted laptops, plus continuous security monitoring so unusual access is caught early, at the office or at home.
Incident Response & Prompt Notice
A written incident response plan and containment included in your plan, plus help, quoted as project work, finding out which files were accessed — the fact that drives your duty to tell clients. Our agreement commits us to tell you of a breach within 72 hours, and within 24 hours on Secure IT.
Backups You Can Recover From
Encrypted backups with the most recent 30 days locked against change or deletion, so ransomware means a restore, not a lost case file. And when you vet us, as the State Bar expects, we complete your security questionnaires and document the controls we run.
What stays your responsibility
- Your ethical judgments: what counts as confidential, when client consent is needed, and whether and how to tell a client about an incident
- Firm policies on confidentiality, remote work and AI use, and supervising the lawyers and staff who follow them
- Deciding which AI tools your firm approves, and how lawyers use and verify their output
- Client communication and engagement terms, including any disclosure about the technology providers you use
- Legal questions of any kind — for those, talk to your ethics counsel
Where law firm IT lives in our plans
MFA, encryption, monitoring, email security and backups are the substance of Secure IT, built on Core IT’s foundation, and Secure IT carries our 24-hour breach-notice commitment. Have an IT person or a practice-management vendor already? Co-Managed IT adds the security depth alongside them. See every published rate →
For how we support law firms day to day, see IT for law firms, or start at the compliance hub →
Law firm confidentiality, asked and answered
Is the cloud allowed for client files?
The State Bar has said yes, provided you use reasonable due diligence in choosing the provider and keep checking it over time. We give you the documentation to show you did.
Can our lawyers use AI tools?
That’s your firm’s decision, and the State Bar’s guidance and a new statute, effective January 1, 2027, set the conditions. On our side, we never put your firm’s data into a generative AI service unless your firm has approved that service in writing, and we help you evaluate and lock down the tools you do approve.
Do we have to tell clients if we’re hacked?
The State Bar’s Formal Opinion 2020-203 says a breach that compromises confidential client information must be communicated to the client, and California’s data breach statute may also apply. That decision is yours and your counsel’s; our job is to get you the facts about what was accessed, fast.
We’re a three-lawyer firm. Is this overkill?
The duty is the same for a solo practitioner and a large firm; what changes is the scale. Reasonable security for a small firm is affordable, and most of it is what we run every day.
What happens on the free assessment?
Thirty minutes with the owner. We look at where client information lives, who can reach it, and where the gaps are. A written quote follows within one business day. No pitch deck, no obligation.
Priced openly, like everything else we do. Law firm confidentiality work carries a published uplift of +10% on the per-user plan and per-server management fee — documentation, evidence and audit support are real recurring hours, so we price them instead of hiding them in a quote. Secure IT is the starting point for compliance work — Core IT is not an option for a regulated environment, because the frameworks lean on the monitored layer it adds. On Secure IT that is $275 per user per month — covering the confidentiality documentation, AI controls and client security questionnaires. Backup, private cloud resources and add-ons stay at their flat published rates. See the full compliance uplift table →
