Storage & custody

Legal document storage: where client files should live

Every firm stores client documents somewhere — a consumer sync folder, a purpose-built legal system, the storage inside its practice-management platform, or a server in a closet down the hall. This guide is about that choice, not about which product has the best feature list: the four realistic venues, what changes when the bytes are client property rather than company files, and the questions most firms only ask once it's too late — who holds the encryption keys, which country the data sits in, and how you get everything back if the relationship ends. Vendor-neutral, and not legal advice.

By Lucas Barnes, Founder · Last updated July 24, 2026

The framing

Storage is a custody decision

Legal document storage is usually discussed as a software decision — which product, which feature list, which price per user. That framing misses the thing that makes it different from every other storage decision a business makes. The documents aren't the firm's; they're held on behalf of clients. Confidentiality attaches to them, retention obligations outlive the matter, and the client generally has a claim on the file itself, on terms your jurisdiction sets. Where those bytes sit is a question about custody, and the software is only the instrument.

That distinction changes what you evaluate. A generic storage comparison ranks capacity, sync speed, and price. A firm has to ask a different set of questions: who else can technically read this, what happens when a lawyer leaves, whether the provider will sign the agreements a corporate client demands, which country the data sits in, how a decade of closed matters gets disposed of. And then the one that gets asked last and matters most — how everything comes back out if the relationship with the vendor ends badly.

This guide is vendor-neutral, and it's deliberately not a feature comparison. If you're shopping for a document management system and want the capability checklist, that's the job of the legal document management software buyer's guide. This page is about the layer underneath: where the files actually reside, who holds them, and what that custody obligates. It's general guidance, not legal advice — retention periods, destruction rules, and the treatment of original documents are governed by your jurisdiction's rules and your malpractice carrier's guidance, and should be confirmed there.

The options

The four places firm documents actually live

Strip out the branding and four venues remain. Most firms end up in two of them simultaneously — a primary system of record, plus a secondary place where things accumulate by accident. The accidental one is usually where the risk sits.

01 · General cloud storage

Mainstream sync-and-share services. Cheap, familiar, excellent at getting a file from one device to another. Organized around folders and people rather than matters, with sharing links that outlive their purpose. The business and enterprise tiers close much of the gap on admin control and audit logging; the free consumer tiers don't.

02 · A legal DMS

Storage built for law firms — matter-centric organization, version history, full-text search, privilege-aware permissions, and records support. The strongest custody posture of the four, and the most expensive to license and administer as a separate platform.

03 · Practice-management storage

The document storage inside the platform the firm already runs for matters, calendars, and billing. Documents stay attached to the matter, there is one vendor relationship to vet, and it is bundled into a subscription you already pay. Depth on document-specific features varies by platform.

04 · On-premises

A server or network-attached drive the firm owns and hosts. Physical custody stays with the firm, which some clients and regulators require. Everything else — backups, patching, disaster recovery, secure remote access — becomes the firm's standing responsibility.

The venue most firms should worry about is the fifth one nobody lists: email. In a lot of small firms a meaningful share of the document estate exists only as attachments in somebody's inbox, in a personal cloud account created for a single client transfer, or on the desktop of a laptop that goes home every night. None of that is a storage strategy. It's also invisible to whatever system you did choose, so before comparing venues it's worth asking honestly how much of the firm's document estate currently lives outside the answer you'd give a client.

These aren't four competitors bidding for the same job. General cloud storage is genuinely good at collaboration and at holding firm-operational material that has nothing to do with any matter; a DMS or a practice-management platform is where the matter file belongs; on-premises is a custody choice made for a reason rather than a default. A firm running two of them on purpose, with a written rule about what goes where, is in a much better position than a firm running two of them by drift.

Who holds the bytes

Your servers, or someone else's

Underneath the four venues sit two custody models, and almost every downstream question resolves differently depending on which one you're in. Either the firm physically holds the storage, or it delegates that holding to a provider and manages the relationship by contract and configuration. Most firms today delegate — the operational burden of self-hosting is real and unrelenting. But delegation is a decision that should be made deliberately, not absorbed.

Figure A · Two custody models

Hold the data yourself, or hold the vendor accountable

Neither model removes the firm's obligation. One discharges it through operations you run; the other through diligence, contracts, and configuration you can prove.

Firm-held storage

On-premises server or firm-owned hardware

Control: Physical custody stays with the firm — no provider holds a routinely readable copy, though outside IT and backup vendors usually still can.
Burden: The firm is its own security operation: whatever monitoring, recovery, and patching capability exists is what the firm has staffed for.
Failure mode: Quiet neglect — an unpatched box, a backup nobody has ever restored from, one departure away from nobody knowing how it works.

Provider-held storage

Cloud service, legal DMS, or practice-management platform

Control: Exercised through vendor selection, contract terms, access configuration, and periodic review.
Burden: Diligence and documentation — knowing where data sits, who can reach it, and what an exit looks like.
Failure mode: Assumed diligence — a vendor chosen years ago on reputation, never re-reviewed, with terms nobody at the firm has read.

Delegating the storage doesn't delegate the duty. It changes what discharging it looks like.

Firms that self-host for a stated reason do fine; firms that self-host because nobody ever revisited it usually carry the worst of both models.

The on-premises case is narrower than it used to be, but it hasn't disappeared. Firms that still hold their own storage generally have a stated reason for it, most often a client contract or a regulatory obligation that rules out third-party hosting. The hosting-model trade-off itself — what you gain and give up either way — is worked through in the buyer's guide. The custody point that belongs here is what isn't a reason: the intuition that data on a machine you can see is inherently safer than data in a professionally operated data center. A server in a firm's back office is usually protected by less monitoring, less redundancy, and less patching discipline than a major provider applies as routine. And the question a client would actually ask isn't who owns the box — it's whether anyone at the firm could restore from it after a flood, a theft, or a ransomware incident.

If you delegate, the diligence has to be real and it has to be written down. Read the provider's security documentation and the parts of the terms that describe data handling, deletion, and breach notification. Find out whether they'll sign the agreements your clients require. Note which subprocessors touch the data. Then put the answers somewhere retrievable, because the moment a client asks — and sophisticated clients do ask — reconstructing it under time pressure is miserable. The question set for evaluating any outside service that touches client files is laid out in the vetting checklist; the storage provider deserves at least that much scrutiny, since it holds everything rather than passing files through.

What custody obligates

The obligations that follow the documents

Four obligations travel with client documents wherever you put them. They're the reason a firm can't simply pick the cheapest capacity and move on, and they apply identically to the server in the closet and the platform with the polished marketing site.

Confidentiality, and reasonable efforts to protect it. The professional-conduct rules in many jurisdictions require a lawyer to make reasonable efforts to prevent unauthorized access to, or inadvertent disclosure of, information relating to a representation. Reasonable is a moving standard, not a fixed one — what counted as reasonable a decade ago is thinner than what's expected now. Alongside it sits the duty of technology competence: many jurisdictions have adopted some version of the comment asking lawyers to keep abreast of the benefits and risks of relevant technology. In this context that means understanding, at least in outline, how your storage protects data and where it can fail.

Access control that reflects the firm, not the folder tree. Storage is where privilege gets exposed in practice. It usually happens in one of three ways: a sharing link created for one recipient that's never revoked, a departing team member whose access is disabled in the email system but not everywhere else, and privileged or conflict-sensitive material sitting in a location every user can open. The controls that address these are unglamorous — matter-level or folder-level permissions, mandatory multi-factor authentication, an administrator who owns onboarding and offboarding as a routine, and periodic review of who can reach what. The mechanics inside one platform are walked through in the document permissions guide, but the principle is portable: access should follow the matter, and it should be removable in one place.

Encryption, understood rather than assumed. Encryption in transit and at rest are both baseline expectations of any credible provider, and any candidate that can't describe both should be eliminated on that basis alone. The distinction worth internalizing is who holds the keys. In nearly every mainstream service the provider manages them, which means the provider is technically capable of reading your data and you're relying on their internal controls, their contractual commitments, and their track record rather than on cryptography. That's a normal and widely accepted arrangement. But it's a different sentence from "only we can read our client files", and it's worth being precise when a client asks.

Retention, and eventually disposition. Storage has to support keeping documents for years after a matter closes, and it also has to support disposing of them defensibly when the retention period ends. It also has to support not disposing of them: a preservation obligation overrides the schedule while it's live, so a venue where a set of documents can't be held back out of a disposition run has a gap the schedule itself can't close. Those are different capabilities: the first is just durability, the second requires knowing what you hold, applying a consistent rule, and being able to show that you did. A retention schedule nobody opens isn't a retention program — the practical shape of one, tied to the matter-closing step, is covered in the retention and records guide. What belongs here is the storage consequence. If your chosen venue makes it impossible to see what a closed matter contains or to act on it as a set, retention becomes manual forever. And one property worth adding to the venue comparison while you're in it: how long a deletion stays reversible, and who is allowed to use that window. Defensible disposition assumes the deletions you meant; the recovery window is what covers the ones you didn't.

The exit

Getting the documents back out

Ask about the exit before you sign, because the answer is never better later. A storage decision is only as good as its reversal. Firms change platforms, merge, dissolve, and occasionally fall out with vendors, and in every one of those situations the question becomes the same: what exactly comes back, in what form, and how fast.

There are three quality tiers, and the difference between them isn't visible from a pricing page. The good outcome is a self-service export that returns ordinary files in a folder structure mirroring how they were organized, so the exported set is as navigable outside the system as it was inside. The mediocre outcome is a proprietary archive that only the vendor's software can meaningfully open, which converts your documents into a hostage with a countdown. The one that surprises firms is an export that returns structured records — matters, contacts, notes, time entries — but not the document files, or one that returns only the current version of each document and silently drops the revision history. Version history is among the first things a storage move loses, and it's lost quietly.

Four questions cover most of the risk. What does an export actually contain — files, folder structure, metadata, versions? Who initiates it and how long does it take, given that a decade of matters isn't a thirty-second download? Does the vendor offer a scheduled backup or escrow arrangement so a current copy exists outside their platform without a manual project? And what's the account's status during a billing lapse or a dispute — is the data still readable, is there a grace period, and what triggers deletion? A vendor with clear answers to all four is telling you something about how they think about custody generally.

The obligation is the part that doesn't move. Your duty to preserve client files, to return them on request, and to dispose of them properly at the end of the retention period belongs to the firm, and it survives any vendor relationship — including one that ends because the vendor did. That's the strongest argument for periodically producing a full copy of the document estate and keeping it somewhere you control, even when the primary storage is excellent. A backup you've never tested is a hypothesis; one you've restored from is a plan.

The physical half

Paper, scans, and originals

Most firms still hold paper. It's the part of the storage question that software vendors have no reason to raise. Closed-file boxes in a storage unit, a wall of cabinets holding matters from before the practice went digital, and the steady trickle of mail and hand-delivered exhibits that arrive on paper every week. Paper is storage too, and it has custody properties of its own — who can open the room, whether the offsite vendor logs access, what happens to your boxes if that vendor is acquired or fails, and whether anyone could produce a specific 2014 file this week if a client asked.

The default answer is to digitize, and to do the processing at the point of capture. Legal document processing — scanning, running text recognition so the result is searchable rather than a picture of a page, naming the file to the firm's convention, and filing it into the matter — is cheap when it happens once at intake and expensive when it becomes a project years later. A scanned archive is findable, backed up, reachable from anywhere, and far cheaper to hold than square footage. The firms that regret digitizing are almost always the ones that scanned without indexing and ended up with tens of thousands of files named after the scanner's serial counter.

Digitizing isn't a license to shred everything. Some documents should stay physical: original wills and codicils, instruments whose signed original carries independent legal force, items the client has asked the firm to hold as their property, and anything a court or a statute requires in original form. Rules on retaining originals, on destroying client files, and on notifying clients before destruction vary by jurisdiction and by document type — precisely the territory to confirm against your own bar's rules rather than a general article. What's portable is the method. Write the categories down once, apply them the same way every time, and keep a record of what was destroyed and when.

Where the digital copy lands matters as much as the scanning. A scan that goes into the matter file inherits the permissions, search, and retention handling of everything else; a scan that lands in a shared network folder called "to file" inherits none of it and quietly becomes a second, unmanaged document estate. The point of digitizing is to bring paper under the same custody regime as everything else. Not to create a parallel one.

Putting it together

Where documents live is a decision you revisit

Four venues, two custody models, and a set of obligations that follow the documents into all of them. For most small and mid-size firms the practical answer is a cloud system built around matters — either a legal document management system or the storage inside the practice-management platform the firm already runs — with general cloud storage kept for firm-operational material and a deliberate, written rule about what goes where. On-premises remains the right call for firms with a specific reason. It's the wrong call for firms who simply never revisited it.

Whatever you choose has a shelf life. Providers change their terms, their subprocessors, and their security posture; firms grow, take on clients with stricter requirements, and accumulate document types nobody anticipated — deposition video and the media a case in suit generates being the usual thing that breaks a capacity assumption made back when everything the firm stored was pleadings and correspondence. A storage choice made carefully in 2019 and never re-examined isn't a considered position, it's an assumption. Re-reading the terms and re-asking the residency, access, and export questions every year or two is unglamorous work that costs an afternoon and occasionally saves a great deal more.

One last gap worth naming: deciding where documents live does nothing to get them there, and that gap is where the fifth venue grows. A download or an attachment stays wherever it landed until somebody moves it. So the intake path is what decides whether the venue you chose is the venue your documents are actually in. A platform's own uploader will take multiple files and whole folders at once; a desktop drive maps the matter file to a folder on the machine; browser extensions like Send to Case file a download into the matter without the round trip. Choose the storage for custody, then make the filing step short enough that nobody has a reason to leave the file in their inbox instead.

Document storage FAQ

Legal document storage FAQ

Got more? Email [email protected].

Q.01

Where should a law firm store client documents?

In a system the firm controls, organized by matter, from a provider the firm has actually vetted — in practice a legal document management system, the document storage built into the practice-management platform the firm already runs, or a business-tier cloud service configured deliberately. Self-hosting remains viable for firms with a reason for it and the IT capacity to carry it. The venue matters less than the custody posture behind it: encryption in transit and at rest, access control you can administer, an audit trail, a defensible retention path, and an export route that returns your documents in a usable form. A consumer file-sync account signed up with a personal address fails several of those at once, which is why it's the venue firms outgrow first.

Q.02

What is the best cloud storage for law firms?

There is no single answer, because it depends on what else the firm already runs and how document-intensive the practice is — comparing named products is the job of a buyer's guide rather than of this page. What belongs here is the standard to judge candidates against, which is custody rather than capacity or price: encryption in transit and at rest and who holds the keys, access control you can administer and revoke in one place, audit logging, retention support, where the data physically sits, and what an export actually returns. General business cloud storage — the business or enterprise tiers of the mainstream services, not the free consumer plans — clears that bar when it's configured with firm-controlled admin accounts, mandatory multi-factor authentication, and disciplined sharing settings; the same tiers used casually don't. Ask whether the vendor will sign the agreements your clients require before you commit rather than after.

Q.03

Is it ethical to store client files in the cloud?

Broadly, yes. The state bar opinions that have addressed the question generally allow a lawyer to store confidential client information with a third-party provider, provided the lawyer exercises reasonable care in selecting the provider and stays reasonably informed about how the data is protected. The duty of confidentiality doesn't prohibit outsourcing storage; it prohibits doing so carelessly. In practice, reasonable care means reviewing the provider's security documentation and terms, understanding where the data is held and who can reach it, using strong authentication, and revisiting the decision periodically rather than treating a vendor choice made years ago as permanently settled. The specifics differ by jurisdiction, so read your own state's guidance rather than relying on a general summary like this one.

Q.04

Does client data need to be encrypted at rest as well as in transit?

Treat both as table stakes. Encryption in transit protects documents while they move between your browser and the provider, and any credible service uses current TLS for this. Encryption at rest protects the stored copy on the provider's disks, which matters for physical compromise and for a certain class of insider risk. The harder question, and the one worth asking a vendor directly, is who holds the keys: in almost all mainstream services the provider manages them, which means the provider is technically able to read your data and you are relying on their controls and contracts rather than on mathematics. Some enterprise services offer customer-managed keys; few small firms need that, but it's worth knowing which model you're in before you tell a client that their file is encrypted.

Q.05

Does it matter which country our client documents are stored in?

Sometimes, and you should know the answer even when it doesn't. Data residency becomes a live issue when a client contract or an outside-counsel guideline specifies where their information may be held, when the matter involves personal data subject to a regime like the GDPR, or when a regulator or public-sector client imposes location requirements. Beyond compliance, the jurisdiction where data sits shapes which government can compel its production and under what process. Many providers let customers choose a storage region and publish the list of subprocessors that may handle the data; some legal platforms don't expose the choice at all. Ask before signing rather than after, and record the answer somewhere your firm can find it when a client eventually asks.

Q.06

What happens to our documents if we leave the storage provider?

It depends entirely on the export route, which is why that question belongs in the evaluation rather than the exit. Exports range from a self-service download that preserves the folder structure, through proprietary archives only the vendor's own software can open, to exports that return structured records but not the document files — or that keep the current version of each document and quietly drop its revision history. Ask what an export contains, how long it takes to produce at your volume, and whether the account stays readable during a billing lapse or a dispute. And treat the answers as a reason to keep an independent copy: a firm's obligations toward the file don't lapse because a vendor was acquired, went dark, or stopped serving the account.

Q.07

Should we scan paper files and shred the originals?

Scan almost everything; shred selectively. Converting closed paper files to searchable digital records makes them findable, backed up, and far cheaper to hold than boxes in offsite storage. But some documents should stay physical — original wills and codicils, instruments where the signed original has independent legal force, and anything a client has asked the firm to hold as their property. Rules on retaining originals and on destroying client files vary by jurisdiction and by document type, and some require notice to the client before destruction. That's territory to confirm against your own bar's rules rather than a general article. The defensible part is the method: decide the categories once, apply them the same way every time, and keep a record of what was destroyed and when.

Q.08

How much storage does a law firm actually need?

Less than most firms expect for ordinary documents, and far more the moment media enters the picture. Pleadings, correspondence, contracts, and scanned exhibits are small. Video and audio are not — bodycam footage, deposition recordings, surveillance exports, and forensic images, where a single matter can outweigh everything else the firm has ever stored. Raw capacity is rarely what should settle the decision. Organization, access control, and exportability are the constraints that bite in daily practice, and outsized media is usually handled as a deliberate exception rather than by buying a bigger plan for everything.

Related guides