Law Firms & Trusts

What the obligation actually requires of your systems

• Access that follows the matter, not the job title. Information barriers and conflict screening enforced by the system rather than by everyone remembering. Where a firm needs an ethical wall, it should be technical, not a policy note.
• A record of who saw what. Access to client material logged, to records that cannot be quietly altered, and retained long enough to answer a question raised years later.
• Data in the places you have agreed. Cross-border matters carry residency and transfer obligations. Storage configured so material cannot move is more reliable than asking people to remember that it must not.
• Continuity that survives a bad week. Court deadlines and completion dates do not move because a server failed. Recovery has to be tested, not assumed, and the test has to be recent.

What we do about it

Insight establishes where you are exposed: identity and email, matter access, devices, backups, vendor connections, and where confidential material is leaving through tools nobody approved, increasingly AI assistants. It ends in a ranked list and a report written for partners rather than engineers.

Fortify then runs the continuing side: monitoring, alerts triaged by us rather than sent to you, incident response to playbooks agreed in advance, hardening that is re-applied and re-checked, and backup restores actually performed. Guardian covers the senior advice and day-to-day support where you have no internal IT function, or not enough of one.

For matter files and archives that must outlast the software that created them, Ark holds them on your own hardware, in open formats, searchable, with role-based access and an export you control.

Evidence, and the limits of it

What we can produce: control documentation, access and change records, backup and restore results, incident reports, and a mapping of your controls to the framework you are measured against. That is usually what an insurer's renewal questionnaire and a client's due-diligence request are actually asking for.

What we cannot do, and will not imply: we are not a law firm, we do not certify compliance, and nothing we do makes a report privileged. Where you want findings covered by privilege, instruct us through your counsel and we will work to that instruction. Our engineers are engineers; if anyone calls them counsel, correct them.

On confidentiality of your material from us: client data is encrypted, access is limited to the named people working on your matter and recorded when it happens, and for archives and document stores we can hold keys so that our staff cannot read the contents. Where we run monitoring or support across your estate, our people necessarily can reach systems that hold client material, so that access is named, logged and reviewable, which is the honest position rather than a claim that we cannot see anything.

Regulatory reporting stays yours

An incident is handled quietly in the sense that it is not announced to people who do not need to know, and that containment does not disrupt matters more than it must. It is not handled quietly in the sense of avoiding a notification you owe: if your regulator or your data-protection authority has to be told, that duty is yours and we will help you evidence it, not help you defer it.

Where to start

The configurator shows indicative starting prices by service. A first conversation is a scoping discussion under confidentiality. Contact us, or write to legal@montshield.com if your first questions are about the contract, the entity or our own controls. We will answer those before asking anything about your systems.