Start With Who Can See What
Access control is the first place to look because most security slips begin with broad permissions. A useful review starts with user roles, matter groups and document visibility. If every user can open every folder, export every list and change every workflow, the system is carrying more risk than it should.
Check whether access is tied to the person’s job. Attorneys may need full matter views, paralegals may need editing rights on specific files, and admin staff may only need limited reporting or billing access. In a busy office it is easy to leave old access in place after a team change, and that can expose client records long after the need has passed.
- List all active users and their current roles.
- Confirm that departed staff are fully removed.
- Review temporary access for consultants or outside support.
- Check whether shared logins are still in use, which should not happen.
If your practice handles sensitive litigation, make sure matters can be segmented by team or department. A clean structure cuts the risk of accidental access and keeps the file trail easier to follow.
Test the Export Paths Before They Become a Problem
Exports matter because they move data out of the system and into spreadsheets, downloads or shared folders. A security review should show exactly what can be exported, who can do it and whether those files are protected once they leave the platform. If exports are wide open, the control is weaker than it looks.
Look at document bundles, matter lists, evidence queues and audit reports. Ask whether exports can be limited by role, whether sensitive fields are excluded, and whether the system records each export event. In practice, the safest setup is the one that gives staff just enough detail for the task without handing over the full record set.
- Check which file types can be exported.
- Confirm whether exports include hidden notes or internal comments.
- Review whether export activity appears in the audit trail.
- Test if a user can download more than they need for their role.
Where shared folders are still used, add a rule for named access and short retention. A loose export process can undo good security elsewhere very quickly, especially when multiple people work on the same matter. That kind of leak is avoidable but it often goes unnoticed untill something goes missing.
Read the Audit Trail Like a Case File
Logging should tell a clear story. A sound audit trail shows who opened a matter, who changed a template, who uploaded evidence, who altered permissions and who exported information. If the log is sparse or hard to search, it will not help when a file is questioned later.
Review whether the platform records time stamps, user names, IP details where relevant and the action taken. You also want logs that are difficult to alter. If logs can be edited by ordinary users, they stop being evidence of anything useful. For firms with many matters running at once, searchable logs are often the fastest way to spot unusual activity.
- Check that log entries are readable without specialist tools.
- Confirm that failed logins are captured.
- Review whether permissions changes are logged.
- See if evidence downloads and bulk exports appear in the record.
Useful logging is not only for incident reviews. It also helps with day-to-day discipline, because teams tend to work more carefully when actions are visible and traceable. That is not about watching people, it is about keeping the record straight.
Inspect Hosting Safeguards and Backup Habits
Hosting controls need the same attention as the application itself. A review should cover where the data lives, how it is protected in transit and at rest, and what happens if a server or storage area fails. For South African firms, POPIA considerations should sit in the background of every hosting discussion, especially where client files and evidence are stored off-site.
Ask whether the environment uses encrypted connections, controlled admin access and separated backup copies. Backups should be tested, not just assumed. If the restore process has never been checked, the firm may only discover the gap when a file has already been lost. It is also worth confirming how long backups are kept and who can touch them.
- Check whether data is encrypted in transit and at rest.
- Confirm that backups are stored separately from live data.
- Review restore testing records, not just backup schedules.
- Ask who can access the hosting admin tools.
Where hosting is managed for a firm with offices in Johannesburg, Pretoria or Cape Town, consistency matters more than polished wording. Each site should follow the same access and backup rules so one branch does not drift away from the rest.
Treat Evidence Imports as a Controlled Job
Evidence often arrives from multiple sources, and that is where control can slip. A proper review should cover how files enter the system, how duplicates are handled, and whether the source of each item is kept clear. If evidence is imported from loose folders without a naming rule, later review becomes slow and messy.
Check whether import rights are limited to named staff, whether the system tracks file origin, and whether sensitive attachments can be tagged or grouped for later review. It also helps to look at file size limits and accepted formats because a badly handled import can be as risky as a missing file. In a real matter, the chain of custody matters and the software should help preserve it.
- Review who can import evidence.
- Confirm that imported files keep source details where needed.
- Check duplicate handling and version control.
- See whether review queues can be restricted by matter or team.
If your review queue is full of mixed files, the security question is not only about access. It is also about order, because disordered evidence is easy to mishandle.
Use a Short Control Checklist Every Quarter
A regular control check keeps small issues from becoming heavy clean-up work. For many firms, a quarterly review is enough to catch weak permissions, unclear exports, stale accounts and hosting changes that were never documented properly. The point is to look at the system the way a matter team would, not as a general IT exercise.
Use the same checklist each time so changes are visible. If the same problem appears more than once, treat it as a process issue rather than a one-off mistake. That is usually where the real fix lives. A short, repeatable review also gives partners and ops staff a clearer view of how the platform is being used.
- Remove users who no longer need access.
- Check recent exports and unusual downloads.
- Review the audit trail for permission changes.
- Confirm backup status and restore testing.
- Look at evidence queues for stray or misfiled items.
Security controls only work when people keep checking them. A firm does not need a dramatic overhaul to stay safer, it needs consistent habits and clean records.
