"Is Clio secure enough?" is one of the first questions a BC lawyer asks when choosing practice-management software, and it deserves a more careful answer than yes or no. A mainstream, well-run cloud platform can be appropriate for client files, but the Law Society of BC does not certify or approve any product. Whether your use of it is defensible depends on the vendor's controls, how you configure it, and the diligence you can show you did. This article is general information, not legal advice. Confirm current requirements with the Law Society of BC, your professional liability insurer and your own counsel. The same questions apply to Clio, PCLaw, Actionstep, LEAP or any other system that holds client information.

What the Law Society expects, in plain terms

The Law Society of BC's Code of Professional Conduct requires lawyers to keep client information confidential. The Law Society has also published guidance on cloud computing for lawyers, which treats cloud storage as acceptable when the lawyer takes reasonable steps to understand and manage the risks. In practice, the question is not "is the software on an approved list" (there is no such list) but "can I show I took reasonable care?"

Reading that guidance directly is worthwhile, and it is updated from time to time, so check the current version rather than relying on a summary, including ours.

Separately, a law firm is an organization handling personal information, so BC's Personal Information Protection Act (PIPA) applies to how you protect it, and PIPEDA may apply in some situations. Both expect reasonable security safeguards appropriate to the sensitivity of the information. Client files are sensitive by any measure.

Two layers of security: the vendor's and yours

Most breaches in small firms do not come from a cloud vendor's data centre. They come from a phished password, a reused login, a laptop with no encryption or a former employee whose access was never removed. So think of "secure enough" as two layers:

  • The platform's layer. How the vendor protects data centres, encryption, access, backups and incident response.
  • Your layer. Who has accounts, how they sign in, what devices connect, what gets exported or emailed out of the system, and what you do when something goes wrong.

A strong platform with weak firm-side practices is still a risk. A modest firm with good practices on a reputable platform is usually in a far better position.

Vendor due diligence: questions to ask and record

Rather than trusting marketing pages, ask the vendor, read their security and privacy documentation, and keep a short written record of what you found and when. Useful questions include:

  • Where is data stored? Which country and region, and does the vendor use sub-processors? Data location matters for PIPA and for client expectations, especially for clients who ask.
  • Is data encrypted in transit and at rest?
  • Independent assurance. Does the vendor publish third-party audit reports or certifications (for example SOC 2 or ISO 27001)? Ask for the current documents rather than assuming.
  • Access controls. Does it support multi-factor authentication and single sign-on, role-based permissions, and an audit log you can review?
  • Backups and export. How does the vendor back up data, and can you export everything, in a usable format, if you leave?
  • Incident response. How and how quickly will the vendor notify you of a breach affecting your data?
  • Contract terms. Who owns the data, what happens at termination, and how long does the vendor keep data after you cancel?

None of these answers makes a product "approved." Together they let you show a thoughtful decision, which is what a regulator, insurer or client will ask about if something goes wrong.

Configuration: where firms usually fall short

Whatever platform you pick, the settings are your responsibility. A practical baseline:

  • Multi-factor authentication for everyone, with no exceptions for partners. Prefer an authenticator app or security key over text messages where possible.
  • Individual accounts only. No shared logins for the front desk, a bookkeeper or a student.
  • Least-privilege permissions. Assistants, articled students and outside bookkeepers see what their work requires, not every file.
  • Prompt offboarding. A checklist that removes access on the last day, including mobile apps and connected integrations.
  • Review of connected apps. Calendar, email, e-signature, payment and document tools each get access to client data. Keep only what you use.
  • Audit logs reviewed periodically, and after any suspicious event.

Trust accounting needs extra care

Trust accounting is a distinct risk. Law Society rules set out how trust funds must be handled and recorded, and fraudsters specifically target law firms with wire and payment-redirection scams. Whichever system holds your trust ledgers, restrict who can post and approve transactions, keep online banking on protected devices where practical, and require a call-back to a known number before acting on any change to payment instructions. Check the current Law Society trust-accounting rules and your accountant's advice for the specifics.

Email, devices and everything around the platform

Client information does not stay inside the practice-management system. It travels by email, sits on laptops and arrives on phones, and those paths need attention too:

  • Email security. Strong filtering for phishing and spoofed senders, MFA on every mailbox, and a clear way to send sensitive documents through a secure link or encrypted channel instead of a plain attachment.
  • Encrypted devices. Full-disk encryption on laptops and phones, with the ability to lock or wipe a lost device.
  • Remote work. Lawyers work from home, courtrooms and clients' offices. Use managed devices, current updates and no confidential work on unmanaged personal computers.
  • Backups beyond the vendor. A cloud platform is not a substitute for your own plan for email, local documents and the data you export. See our guide to why backups quietly fail.

So, is Clio (or any similar platform) secure enough?

A reputable, mainstream platform can reasonably meet a small firm's needs when you do four things: complete and document the due diligence above, configure the platform with MFA and least-privilege access, secure the email and devices around it, and keep your own recovery plan. If a vendor cannot answer basic questions about data location, encryption or breach notification, treat that as a signal to keep looking.

What we do not claim is that any single product is "Law Society approved," or that using one removes your professional obligations. Those stay with the lawyer. If you want a second set of eyes, a short review of your configuration and the surrounding IT is exactly what an IT provider can help with.

A one-page checklist

  • Read the Law Society of BC's current cloud computing guidance and note the date.
  • Record the vendor's answers on data location, encryption, assurance reports, breach notification and exit.
  • Turn on MFA for every user and remove shared accounts.
  • Set role-based permissions and review them twice a year.
  • Write and test an offboarding checklist.
  • Lock down trust accounting approvals and add call-back verification.
  • Encrypt devices and secure email.
  • Keep an independent backup and test a restore.
  • Tell your insurer about any material change, and check what its cyber coverage requires.

Frequently asked questions

Does the Law Society of BC approve specific software?

No. It does not certify or endorse products. Lawyers are expected to take reasonable steps to protect client confidentiality, and to be able to explain those steps.

Can a BC law firm store client files in the cloud?

Generally yes, when the lawyer takes reasonable care in selecting and configuring the service. Review the Law Society's current guidance and your insurer's requirements.

Does the data have to stay in Canada?

We are not aware of a blanket rule for law firms, but data location affects privacy risk and client expectations, so ask the vendor where data is stored and decide with your own counsel.

What is the biggest practical risk?

Stolen or phished credentials without MFA, followed by payment-redirection fraud. Both are largely preventable with configuration and process.

Clearpine Technologies is an Abbotsford-based managed IT provider serving law firms and clinics across the Lower Mainland. See our IT support for law firms page, or the IT setup checklist for a new BC law firm.