A practical guide to collecting client documents securely

Secure document collection sounds like a technical subject. It is mostly a procedural one. Encryption is the easy part, it is a setting, and any serious system has it switched on before you arrive. What decides whether a client’s information is actually safe is a series of ordinary decisions about who asks for what, where it lands, who can see it afterwards and when it goes away.

This is the sequence, in the order the work actually happens.

Decide what you are asking for, before you ask

Most document chases are self-inflicted. The firm sends a vague request, the client sends the wrong thing, the firm asks again, and now there are three rounds of correspondence and two stray files where there should have been one exchange.

Write the request as a list of named items, not a description. “Photo ID, two most recent pay slips, and the letter from the insurer dated in June” gets the right documents. “Anything you have relating to the claim” gets a phone call and a shoebox.

Say what format you need, and say what you do not need. If a photograph of a document taken on a phone is acceptable, say so explicitly, because a surprising number of clients will otherwise drive to a library to use a scanner and take four days doing it.

Then ask for it in one place. A request that arrives split across a letter, an email and a phone call gets answered in three channels, and two of those channels are ones you did not want to use.

Give it one front door

Every additional route into your firm is another place a document can arrive, sit, and be forgotten. Portal, email, fax, the shared inbox, a text message to the paralegal’s personal phone. Firms rarely decide to have five channels. They accumulate them.

Pick one and mean it. Clients follow the path of least resistance, and the path of least resistance is whichever one you answer fastest, so closing the others is not a policy announcement, it is a habit on your side.

Where it lands matters as much as how it arrives. Set up your filing structure first, so an incoming document has an obvious home. Uploading documents covers what a single upload involves, and document rules and types is how you make the categories yours rather than generic.

The reason this is a security topic and not just a tidiness one: an unfiled document is an unreviewed document. Nobody has decided who should see it, so the answer defaults to everyone with access to wherever it landed.

Limit who can see it, deliberately

The instinct at a small firm is to give everybody access to everything, because everybody covers for everybody and restrictions get in the way. That is a reasonable instinct and it is worth partially resisting.

You do not need elaborate rules. You need the default to be considered rather than accidental. A junior who covers reception does not need standing access to the partner’s sensitive matters; they need it on the two days they are covering that matter. That is a role, not a restriction on a person, and it is much less socially awkward to set up that way.

Two documents worth reading before you configure anything: user roles and permissions for how the roles are shaped, and who can see a document for tracing access on a specific file, which is the question you will actually be asked one day.

Protect the account, not just the file

Nearly every real-world breach at a small professional firm starts with a credential, not with cryptography. Somebody reused a password, it appeared in a breach of an unrelated service, and an attacker walked in through the front door with a valid login.

This makes the unglamorous controls the important ones. A password that is long and not reused anywhere else. Two-factor authentication turned on for every person at the firm, not just the partners. An account removed the day somebody leaves, rather than the quarter they leave.

Two-factor authentication covers setting it up, and password requirements covers the rules worth enforcing. Neither takes long. Both do more for your actual risk than any amount of discussion about encryption algorithms.

On encryption itself, the thing to verify is simple and binary: data encrypted in transit, so it cannot be read on the wire, and encrypted at rest, so a stolen disk is not a stolen file. Data encryption and security sets out what that means in practice and, just as usefully, what it does not protect you from.

Keep a record of who did what

An activity log is the least interesting feature in any system until the one day you need it, at which point it is the only thing that matters. It answers the questions that get asked after something goes wrong: when did this document arrive, who opened it, was it changed, who changed it.

You want it to exist, you want it to be readable by a human rather than by a support engineer, and you want to know it is on before you need it.

Ask the question of us too. For most of this product’s life the honest answer was that Pertavo did not have one, and this paragraph said so. Since October 2026 it does: who opened a document, every download, changes and deletions, read on the matter and across the firm. What it is still not is attested — nothing signs those rows and no audit has examined them, so it answers your questions and not a regulator’s. What is recorded about a document is the whole list, including that limit. If an evidential access log is a requirement for your work rather than a preference, weigh that before you choose anything — including us.

Decide when things go away

Retention is the step firms skip, and it quietly undoes everything above. A file you no longer hold cannot be leaked. A file you kept for eleven years because nobody made a decision is pure liability sitting on a disk.

You do not need a sophisticated schedule. You need a written one, with a number of years in it, that accounts for your jurisdiction’s requirements and your own malpractice insurer’s expectations. Then you need somebody to actually run it once a year.

Two practical notes. Deleting from the portal is not deleting from everywhere if the same file also sits in three inboxes and on a desktop, which is the argument for having collected it in one place to begin with. And a document you are obliged to retain for a period is a document you are obliged to keep findable for that period, so export matters: download and export options covers getting things back out in bulk.

The short version

Ask for named items. Use one channel. File it on arrival. Make access a decision. Protect the login harder than you protect the file. Log everything. Delete on schedule.

None of that is technically difficult, and none of it requires a security consultant. It requires somebody at the firm to own it for a fortnight and write it down. If you want a second pair of eyes on how your current process handles those seven steps, get in touch.