Law Firms
Doing it right is not the same as being able to prove you did. Only one of those survives a questionnaire.
Retention, encryption, access control and documentation built for firms that have to demonstrate how client information is stored and who can reach it. Our deepest area of specialism, and the one clients check hardest.
Already been quoted for a compliance project? Send us the scope and we will sanity-check it before you sign anything.
The Core Issue
You have to be able to prove it, not just do it
Confidentiality obligations are not satisfied by having good intentions and a password policy. They are satisfied by being able to demonstrate, after the fact, who could access a matter, what happened to a file, and that data which should have been destroyed actually was.
That is an architecture question. Access logging, retention rules with automatic enforcement, encryption at rest and in transit, and a documented chain for devices leaving the building all have to be designed in. Retrofitting them after a firm has built its systems costs several times what doing it correctly would have.
We build the technology around the obligations, then document it so that when somebody asks, the answer already exists in writing.
The question is never whether you meant well. It is whether you can show it.
Common triggers
A new matter type with stricter requirements. A client security questionnaire you cannot currently answer. Malpractice insurance asking harder questions. A partner leaving with a laptop. Moving to cloud practice management.
What We Build
For legal practices
Access control and logging
Who can reach which matter, enforced technically and recorded, so the answer to "who saw this" is a report rather than a guess.
Retention and destruction
Rules that actually execute. Files that should be gone are gone, on schedule, with a record.
Encryption everywhere
At rest on every device and in transit for everything that leaves the office, including the laptop that goes home each night.
Secure client communication
Encrypted email and file exchange clients can actually use. See secure email.
Device and departure control
What happens when a device is lost or a person leaves — decided and documented before it happens rather than during.
Audited backup and security
Backups and endpoint protection built on SOC 2 Type II audited platforms, with encryption, access control and retention configured to standard. See compliance.
Documentation for questionnaires
Written answers to the security questions clients and insurers ask, kept current so they are ready when asked.
Also relevant: networks and security and managed IT.
Built in from the start, or retrofitted at four times the price. Your call.
Questions
Questions from firms
We are a small firm. Does this apply to us?
Confidentiality obligations do not scale with firm size. A two-attorney practice holds the same duty toward its clients as a large one, and is more likely to be targeted precisely because attackers assume the defences are thinner.
Can you work with our practice management software?
Generally yes. We build the surrounding infrastructure — access, backup, encryption, retention — around whichever platform you use.
Our IT is handled by a friend of the firm. Is that enough?
It might be, for the day-to-day. The gap is usually documentation and provable controls, which only become visible when a client questionnaire or an incident arrives. We are happy to review and tell you plainly.
Our malpractice insurer asks whether our vendors are SOC 2 audited. What do we say?
That the backup and security platforms in use hold SOC 2 Type II reports, and that Chas Enterprise Group is not itself an audited service organization. We put that in writing for you rather than leaving you to phrase it. Full detail on the compliance page.
Do you provide legal advice on compliance?
No. We are an IT provider, not a law firm, and we do not advise on what your obligations are. We build and document the technology that meets the requirements you or your counsel identify.
Backup & Security Compliance
SOC 2 Type II platforms
The backup and security platforms we deploy are independently SOC 2 Type II audited.
HIPAA controls, BAAs signed
Configured to the HIPAA Security Rule, and we sign Business Associate Agreements.
PCI DSS aligned
Cardholder environments segmented, encrypted and logged to PCI DSS requirements.
Your One Stop I.T. Shop
Whenever You Are Ready
Let us review what your firm actually has now.
A plain assessment of where the technology meets your obligations and where it does not, written down so you can hand it to a client, an insurer or your counsel.
The next security questionnaire is already on its way. Be ready for it.
Chas Enterprise Group · Grafton, Ohio 44044 · (440) 364-3596 · charley.george@chasenterprisegroup.com