What a security query usually covers in a law firm
A security query normally starts with one practical question: who can open a matter, edit a template, view evidence or export files. In a legal practice, the answer depends on role based permissions, matter allocation and the way your firm has set up access to each workflow. If your team is handling confidential correspondence, court papers or scanned evidence, the control settings matter just as much as the filing structure.
Questions also come up when a matter moves between teams, when a new user joins, or when an old user should no longer have access. In some firms the concern is a shared drive that has grown messy over time, in others it is whether an evidence queue is visible to the right reviewers and not the whole office.
- Who can see a matter from the start
- Which users can edit templates or fields
- Whether evidence folders are restricted by role
- How archived matters are handled
- What audit trail is available for review
How access controls are usually set up
Access controls in legal software are usually built around people, teams and matter status. A partner may need full visibility across a portfolio, while a paralegal only needs access to assigned matters and the documents tied to those files. Support teams often review the current settings before adjusting anything, because a small change can affect document assembly, task lists and evidence review.
In practice, the better setup is the one that matches how the firm actually works. That may include office based permissions, matter specific access, template rights for certain users and separate controls for admin functions. If your firm has branches in Sandton, Pretoria or Cape Town, the same rules can still apply across offices, provided the permissions are mapped cleanly.
- Check whether users are linked to the correct role
- Confirm which matters are open to each team
- Review admin rights before removing or adding users
- Test document access after a permission change
Hosting and where sensitive files sit
Hosting questions usually focus on where data is stored, how it is accessed and which safeguards are in place around login, backups and file handling. For law firms, that includes matter files, template libraries, evidence imports and any notes attached to a case. The aim is to keep the structure orderly and the access controlled, without making daily work a slog.
Many firms ask whether hosted systems can still support POPIA-aware handling. The short answer is that the controls, records and permissions matter more than the label on the server. You want clear sign-in rules, sensible user roles, careful handling of exports and a record of important changes. If your firm is moving files from a shared drive or scanning older evidence, the hosting setup should reflect that risk.
- Ask where the data is hosted and how it is protected
- Confirm backup routines and restoration options
- Review sign-in settings for each user group
- Keep evidence imports within restricted matter areas
POPIA-aware handling without the jargon
POPIA-aware handling is mostly about discipline. Only the right people should have access to the right files, and there should be a reason for that access. In a law firm this can include documents, client details, identity records, correspondence and case evidence. When a support question comes in, we usually look at the practical setup first: permissions, file visibility, audit logs and user roles.
There is no legal advice in a support query, but there is a useful operational check. If a matter contains sensitive information, ask whether the current access setting matches the team that actually works on it. If an old case has been closed, ask whether it should remain active, be archived or have access limited. Small changes in these areas can reduce avoidable exposure.
- Limit access to the people working on the matter
- Keep archived files separate from active work
- Review who can export or download material
- Use audit history for internal checks
When a security issue needs attention
Not every security question is a problem, but some signs need a closer look. If a user can see matters they should not, if a template is being edited by the wrong people, or if an evidence queue looks broader than intended, raise it through the support channel. That helps the team inspect the setting rather than guessing from symptoms alone.
It also helps to include the basics in your note so the issue can be traced properly. State the matter name, the user role involved and what you expected to happen. If the concern is about a hosting setting, say whether it affects one user, one office or the full firm. For confidentiality reasons, do not send unnecessary client details in the first message.
- Matter name or reference
- User role involved
- What should have been visible
- What was visible instead
- Whether the issue affects one user or a group
What support can review on your side
Support queries can cover a broad set of system checks. That includes access control settings, user permissions, hosting configuration, evidence import visibility, template edit rights and the structure of archived matters. If the issue touches more than one module, the support review may need a full pass through the matter pipeline and the related permissions.
For firms in Johannesburg, Pretoria, Durban, Cape Town and Bloemfontein, the process stays the same. The details in your message guide the review, then the team checks the setting against the current configuration. If a permission change is needed, it is handled with care so other matter controls do not shift by mistake. It is a steady kind of work, not flashy, but it keeps the system usable for attorneys and support staff alike.
- Access roles and user groups
- Matter visibility and editing rights
- Template ownership and approval paths
- Evidence queue access and review scope
- Hosting related security settings
