What to look for in a client portal: a checklist for law firms

A client portal is a small purchase that is annoying to reverse. The software is cheap, the migration is not, and the cost of getting it wrong is mostly paid in the six months afterwards, by whoever has to chase clients through a system they find confusing.

So it is worth an hour of structured scepticism before the demo. Here is the list we would use, grouped by who has to live with the answer.

Questions about your clients

Can a client use it without creating an account they have to remember? Some can, some cannot. Either answer is defensible, but you want to know which one you are buying, because it decides how many password-reset calls your front desk takes in January.

What does the client see first? Ask to be shown the invitation email and the first screen, not the dashboard. The dashboard is where your staff live. The invitation is where clients decide whether to bother.

Does it work properly on a phone? Not “is it responsive”. Ask to see a client photograph a document with their phone camera and get it into the system. That is how a large share of client uploads actually happen, and it is where badly built portals fall apart.

What happens when the client gets stuck at 9pm? If the answer is “they email you”, fine, but know that in advance and decide who reads that mailbox.

How many clicks from the email to the uploaded file? Count them during the demo. Anything over four and you will be doing it for them over the phone.

Questions about your staff

Where do files land, and who decides? A portal that dumps everything into one undifferentiated list moves the filing problem rather than solving it. You want folders, document types and assignments set up before the first upload, so that the structure is doing the work instead of a paralegal. Organizing with folders shows the shape of a filing structure that survives contact with real matters.

Can you tell at a glance what is outstanding? The single most valuable thing a portal does is turn “have we heard back from the Hendersons?” from a search into a glance. If you cannot see status without opening each file, that value is missing.

Who gets notified, and can they turn it off? Notifications are the difference between a portal that gets used and a portal everybody mutes in week two. Look for per-person control rather than a firm-wide on/off switch.

Since this is our own checklist, our own answer: Pertavo has the firm-wide switch, not the per-person control — email is on for everybody or off for everybody, and notification preferences says so plainly. Assignment is what routes work to the right people here. Ask every vendor this question, including us.

How do you get a file back out? Every system is happy to take documents in. Ask specifically about bulk export, format, and whether the folder structure survives. This is also the question that tells you how easy it will be to leave.

What does it do when two people open the same document? Not a common case, but the answer reveals how carefully the thing was built.

Questions about security

This is where demos get vague, so be concrete.

Is data encrypted in transit and at rest, and who holds the keys? Both should be yes. The keys question separates vendors who have thought about it from vendors who have read a blog post.

Is two-factor authentication available, and can you require it? Available is common. Required for everyone at your firm, enforced by the administrator, is the setting that actually matters.

Ours again: Pertavo has the first and not the second. Anybody can turn two-factor on for themselves, and nobody can be made to — there is no firm-wide requirement and no sign-in is refused for the want of it. Two-factor authentication covers what turning it on involves, and who at your firm should be told to.

Can you see who opened what, and when? An access log is boring right up until the afternoon you need one. Ask to see a real one, not a screenshot of one.

Our answer again, since it is the same checklist: Pertavo has no access log. Uploads and notifications are kept; views and downloads are not recorded at all — what is recorded about a document is the full list. If this item is a requirement rather than a preference for your work, it should rule us out, and we would rather you found that out here than in month three.

What certifications does the vendor actually hold? Ask for the certificate or the report, not the adjective. A great many products describe themselves as bank-level or enterprise-grade, and those phrases mean nothing in particular. A vendor holding a real SOC 2 report will send it to you under NDA without fuss. A vendor that does not hold one should say so plainly, and there are reasonable products in that category; what should worry you is a vendor who implies a certification they cannot produce.

Where is the data hosted, and what is the deletion policy? Both matter more than they used to, and both should have a specific answer with a number in it.

The three questions demos avoid

What is the total cost at our actual size? Per-user pricing is fine until you remember the seasonal contractor, the bookkeeper and the two partners who log in twice a year. Price it with your real headcount, including the people you forgot.

What does month two look like? Every portal is delightful in the demo, because the demo account has eight beautiful documents in it. Ask what the list looks like with four thousand. Ask what search does at that size.

What happens to our data if we leave, or if you are acquired? You want a clear export path and a clear answer on ownership. A vendor that gets uncomfortable here is telling you something useful.

Scoring it honestly

Resist the urge to build a weighted spreadsheet with forty criteria. In practice three things decide whether a portal succeeds at a small firm, and they are not the features.

The first is whether clients can use it without help. The second is whether your own staff prefer it to email on a busy day, because on a busy day people revert to whatever is fastest. The third is whether somebody at the firm owns it. Portals do not fail on capability. They fail because nobody set up the folders, nobody sent the invitations, and six months later half the matters are on it and half are not, which is worse than either.

Pick the product that clears the security questions, then pick between the survivors on those three. We have answered the three questions above about our own product on the client portal page, including the one where the honest answer is that we have not measured it. If you want to run the rest of this list against us, send us the list and we will answer it in writing, including the questions where the answer is no.