How to Vet a Legal Tech Vendor's Security Claims: A Practical Checklist

Every legal tech website says some version of “bank-grade security” and “we take your privacy seriously.” The ABA’s 2023 Cybersecurity TechReport found that 29% of respondents reported a broadly defined security incident and 19% did not know whether their firm had experienced one. The survey category included events such as a lost or stolen device, so it should not be read as saying that 29% suffered a confirmed data breach. It still shows why precise questions matter more than slogans.

You don’t need a technical background to vet a vendor. You need the right questions, asked in writing, and the discipline to treat a non-answer as an answer. Here’s the checklist we’d use — and since we build practice software ourselves, at the end we’ll hold our own product to it.

1. Where does the data actually live?

Get a specific answer: which cloud provider, which country, and whether your data is segregated or pooled with everyone else’s. Follow-ups that separate serious vendors from marketing departments:

• Which employees and contractors can access customer data, and under what controls?
• Which subprocessors (analytics tools, support platforms, AI services) also receive it? Ask for the list — reputable vendors publish one.
• If data is stored or processed outside your country, does anything about your practice (immigration clients, government contracts, protective orders) make that a problem?

2. “Encrypted” is not one thing — ask who holds the keys

Almost every vendor truthfully says data is “encrypted in transit and at rest.” That’s table stakes, and it protects against far less than lawyers assume. Encryption at rest with vendor-held keys means the vendor — its employees, its compromised systems, and anyone with legal process against it — can still read your files.

The question that matters is: can the vendor itself read my client data? Only end-to-end encryption with keys you hold answers “no.” Very few practice tools offer it. A vendor that answers this question straightforwardly, including the honest “yes, we can technically access it, and here are the controls around that,” is showing you more respect than one that repeats “bank-grade encryption.”

3. What SOC 2 proves — and what it doesn’t

SOC 2 is an audit of whether a company follows its own stated controls. It’s meaningful: it shows the vendor invested in process and let an outsider check. But know its limits. A SOC 2 report doesn’t mean your data is encrypted end-to-end, doesn’t mean the product is free of vulnerabilities, and says nothing about what the terms of service let the vendor deliberately do with your data. Type I (“controls existed on this date”) is much weaker than Type II (“controls operated over a period”). Ask which one, and ask for the report — many vendors will share it under NDA.

No SOC 2 at all from a cloud vendor holding client files? For a solo practice that’s not automatically disqualifying, but it shifts the burden: they should be able to explain concretely what they do instead.

4. Read the terms of service like opposing counsel drafted them

The security page is marketing; the ToS is the contract. Clauses that should stop you cold:

• Broad content licenses — “you grant us a worldwide, royalty-free license to use, reproduce, and create derivative works from your content” beyond what’s needed to operate the service.
• AI training rights — any right to use customer content to train or improve models, however hedged. After ABA Formal Opinion 512, feeding client data to a self-learning system without informed consent is your ethics problem, not just theirs.
• Unilateral amendment — terms that can change with notice consisting of a blog post.
• Silent breach clauses — no committed notification timeline, or notification only “as required by law.” You may have your own duty to notify clients after a breach; a vendor that tells you late makes you late.

5. Plan the divorce before the wedding

Vendor lock-in is a security issue wearing a business suit. The legal software sector has consolidated rapidly under private equity, and products get acquired, repriced, and sunset. Before adopting anything, get answers to: What export formats exist, and do they include everything — documents, notes, custom fields, or just a contacts CSV? Does export require the vendor’s cooperation or does it work self-serve? What happens to your data after you cancel — deleted when, certified how?

If leaving is painful, every future conversation with that vendor happens with your client files as leverage on their side of the table.

6. Don’t grade on a curve because you’re small

Solo and small firms consistently show the weakest security posture in the ABA’s data — only 19% of small firms have an incident response plan, and fewer than a third of solos carry cyber insurance. Attackers know this. The uncomfortable corollary: the vendor’s security and yours are a system. MFA on every account that touches client data, full-disk encryption on your machines, and tested backups are the parts you control regardless of vendor.

Holding ourselves to it

We build Usus, a local-first practice manager, so here’s the disclosure: our answers to the questions above are structurally different — client data stays on your machine, so there’s no vendor cloud to vet, and our AI features are built to run locally so there’s no training question. That architecture is precisely why we built it this way. But local-first isn’t a security exemption: your disk encryption, your backups, and your verification of everything an AI drafts still matter, and any vendor who tells you their product removes the need for judgment is selling something. Our full answers are on the security page — in writing, the way you should demand them from everyone.