Help leadership and internal IT teams protect client information, strengthen assurance and make practical technology decisions. Cloud Agile offers cyber security, risk and compliance consultancy alongside scoped co-managed support for law firms and legal practices.
Issues that commonly arise for organisations in this sector. The assessment always follows your actual environment.
The practice management platform is fine; the infrastructure, storage or remote access underneath it is not, and every document open takes ten seconds too long.
Criminals target completion funds with convincing email interception. One redirected transfer can exceed a firm's excess and its reputation.
Fee earners working from home, court and client sites on a mix of devices, with privileged material moving through channels the firm cannot see.
Insurers and corporate clients ask increasingly detailed technical questions, and answering them accurately takes evidence the firm may not hold.
Long retention obligations, files that must be produced years later, and inboxes doing a job an archive should be doing.
Unlike most businesses, a legal practice cannot simply catch up tomorrow when a filing deadline falls today.
One senior team covering support, infrastructure, security, governance and AI, so nothing falls between suppliers.
Responsive support for fee earners who cannot afford to wait, with senior engineers owning issues end to end and priority handling for anything affecting a deadline or a completion. Explore our business IT support services.
Impersonation and domain protection, email authentication, multi-factor authentication and Conditional Access, plus monitoring that detects mailbox rule tampering, the classic precursor to payment fraud. Explore our managed cyber security services.
Microsoft 365 and Azure or hybrid hosting designed around your practice management platform, with performance, secure remote access and document handling that fee earners do not have to work around. Explore our cloud and infrastructure services.
Changing provider, merging with another firm or moving matter files off an ageing server? We plan the migration around client confidentiality, permissions and a cutover window that does not collide with court deadlines. Explore our Microsoft 365 migration services.
Immutable backups, tested restores and retention aligned to your file destruction policy, so matter files are recoverable years later and a ransomware event does not become a closure event. Explore our backup and disaster recovery services.
Cyber Essentials, ISO 27001 alignment where corporate clients expect it, and a ready-made pack of answers for Lexcel audits and professional indemnity renewals. Explore our governance, risk and compliance services.
Legal practices carry both regulatory and contractual obligations around information security. These are the ones that most often drive the technical work.
Confidentiality, client money safeguards and the ability to demonstrate proper systems and controls, including around payment authorisation.
Information management, risk management and business continuity sections all require documented, evidenced technical controls.
Strict access control over matter files, defensible retention, and clarity about where privileged material is stored and processed.
A baseline expected by many corporate clients and increasingly reflected in professional indemnity pricing.
Technical and procedural controls around bank detail changes and completion funds, evidenced rather than assumed.
A tested plan covering ICO notification, SRA reporting and client communication if data is compromised.
Immutable, encrypted backup of case management data, matter files and email, with retention configured to the practice's approved policy for each record type, which is often longer for wills, probate and conveyancing. Retention policies, legal holds and tested restores are documented for SRA, Lexcel and insurer review.
Legal file retention varies by matter type, jurisdiction and the practice's approved policy. The settings below are example backup configurations for a UK practice, not legal advice or a universal standard.
| Record type | Typical retention | Why |
|---|---|---|
| General matter files and closed correspondence | Per the practice's approved policy (commonly 6 to 7 years from closure) | Set by the practice with reference to limitation periods, complaints and any longer requirements that apply. |
| Conveyancing files | Per approved policy (often 15 years or longer)Beyond 7 years | Latent defect and negligence claims can surface long after completion, so property files are held far longer. |
| Wills, deeds and probate documents | Per approved policy (often held long term)Beyond 7 years | These are custody documents rather than ordinary matter files and are never routinely destroyed. |
| Client account and accounts-rules records | At least 6 years (SRA Accounts Rules, rule 13.1); 7 years where that is the practice's approved policy | For SRA-regulated practices in England and Wales, rule 13.1 requires accounting records to be kept for at least six years. This applies to accounting records, not to matter files generally. |
| Microsoft 365 email, files and Teams | 7 years, longer for linked matter types | Matter correspondence is retained in immutable, encrypted backup on the same clock as the file it belongs to. |
These are example backup settings, configured to the practice's approved retention policy for each record type and jurisdiction, not a provider default. Restores are tested rather than assumed. Periods above are typical UK reference points, not legal advice. Your approved policy must also meet any mandatory legal, regulatory or contractual requirements that apply. Talk to us about your retention requirements.
Practice areas, headcount, case management platform, current provider arrangements and any insurer or client requirements coming up.
A review of infrastructure, Microsoft 365 configuration, backups, email security and identity controls, benchmarked against what an insurer or Lexcel assessor will ask.
Fraud and confidentiality risks first, performance improvements second, with clear per-user pricing and any project work costed separately.
Deployed outside billable hours wherever possible, with case management supplier coordination handled by us and no interruption to filing deadlines.
Ongoing support with quarterly reviews covering incidents, risk changes and the evidence pack for your next renewal or audit.
Both models are priced the same way per user. The difference is how much you keep in-house.
Typical for practices up to around 60 fee earners with no internal IT.
For larger firms with an IT manager or small internal team who need depth rather than headcount.
Legal AI has moved quickly, and so has the risk of privileged material ending up somewhere it should not. We help firms adopt it deliberately.
Copilot working inside your own tenant on your own documents, so bundles and correspondence can be summarised without material leaving your control.
Automation of conflict checks, client due diligence chasing, engagement letter generation and file opening steps that currently consume fee-earner time.
Automated capture prompts from calendar and email activity, recovering time that is routinely written off because it was never recorded.
Explicit rules on privileged and client-identifiable material, approved tools only, and human review before anything reaches a client or a court.
More detail on how we approach this is on our AI consultancy and automation services page.
Managed support is priced per user per month: Agile Core at £45 per user and Agile Fortify at £75 per user. Most legal practices choose Agile Fortify, because the managed detection, response and identity controls it includes are the same controls insurers and corporate clients ask about.
Servers are £100 each per month and network devices £10 each per month. Project work, migrations, Cyber Essentials preparation and consultancy are quoted separately at £120 per hour.
AI adoption needs clear rules for client information, approved tools and human review. We help connect the technology configuration to the policy and responsibilities your practice has agreed. AI does not guarantee professional compliance or reliable legal output, and conflict checks stay with your people.
Explore AI consultancyDiscuss your technology risk, assurance requirement or internal IT priorities with Cloud Agile.