Access control and permissions

If you are answering a client’s security questionnaire, or working out why somebody can or cannot see something, this is the model. It is short, and that is a feature: there are no hidden layers to discover later.

What decides access

1. Role. A client reaches documents assigned to them and documents they uploaded, and nothing else. An attorney, admin or owner reaches the firm’s documents. Roles are checked on the server on every request, so guessing a URL for a screen your role does not have gets a refusal rather than the screen.

2. Assignment. Which particular documents a client can see. Assigning is how a document reaches a client; there is no second mechanism. See Who can see a document.

3. Ethical walls, if your firm has turned them on. Off by default. On, an attorney reaches only the matters they are staffed on, and the documents filed on those matters. Owners and admins are not walled. See Ethical walls.

That is all of it. There is no per-document permission level, no view-versus-download distinction, and no per-folder sharing. Restricting one colleague from a file another colleague can open is the one thing on that list the product does do — but only through walls, and only as a whole-firm switch.

What this means in practice

By default, everyone at the firm sees everything the firm holds. That is the starting position, and for most firms it is the right one.

If a particular matter must not be visible to particular staff, turn ethical walls on. Every attorney is then held to the matters they are staffed on, and the restriction is applied to the query rather than to the screen — a walled-off attorney’s request is refused, not hidden. It is firm-wide: you cannot wall one matter and leave the rest open, and it does not apply to owners or admins. Read Ethical walls before switching it on, because documents filed on no matter disappear from most of the firm the moment you do.

Between firms, nothing leaks. Every request is narrowed to your own firm before it reaches the database. Two firms using Pertavo cannot see each other’s anything, and neither can their clients.

A client who can open a document can keep it. There is no view-only access. Assume anything a client has been able to see, they may have downloaded.

The settings that do exist

Under Settings → Organization → Documents, an admin controls three things that shape what people can do:

• Allow clients to edit their own documents — off by default.
• Allow clients to delete their own documents — off by default. See Deleting documents and folders.
• Require approval for client uploads — holds client uploads in a queue until somebody accepts them.

Leaving the first two off is the right starting position. Turn them on when a client asks, not in advance.

One more sits beside them, under Settings → Organization → Ethical walls, and it is the only setting here that changes what your own staff can reach rather than what clients can do. Owners and admins only.

Working out why somebody can see something

Start with the role. A colleague seeing a document is almost always their role rather than anything specific to that file — an attorney can already reach the firm’s documents. With walls on, add one condition: they are staffed on the matter it is filed under. A client seeing something means it was assigned to them, or they uploaded it.

Working out why somebody cannot

For a client, there is only one answer worth checking: the document is not assigned to them. Filing it in a folder named after them does not do it — folders are for your staff, and clients cannot reach the Folders screen at all.

For a colleague, there is one answer and it only applies if walls are on: they are not staffed on the matter the document is filed under — or the document is filed on no matter at all, which has the same effect and is the commoner cause. Staff them on the matter, or file the document. With walls off, a colleague is never refused a document the firm holds.

Withdrawing access

Reassign the document, or deactivate the account from Users. Both take effect at once; neither retrieves a copy already downloaded.