Choosing Between On-Premise and Cloud Legal Software

Aug 17

11 min read

The choice between on-premise and cloud legal software is one of the more consequential technology decisions a law firm makes, and it is frequently made for the wrong reasons. Some practitioners choose a server in the back office because it feels safer to hold client files physically within the premises. Others choose a hosted service because it is cheaper to start and requires no technical staff. Neither instinct is wholly sound. The proper approach is to treat the question as one of risk allocation: who is responsible for availability, security, backup, upgrades and continuity, what each model costs over the whole life of the system, and what the firm's professional obligations require of it in relation to confidential client information.

This article considers the on premise vs cloud legal software question from the perspective of the practitioner who must justify the decision to partners, to clients and, if necessary, to a regulator. It describes what each model involves, compares them against criteria that matter to a law firm, sets out due diligence questions to put to any provider, and identifies the particular risks of migration and exit. It does not recommend one model for every firm. A small number of firms, because of their clients, their location or their existing infrastructure, will have good reasons to retain local systems; the majority of small and medium firms will find that a well-chosen cloud service transfers operational burdens that they are poorly equipped to carry.

Throughout, the obligations relevant to a legal practice include the duty of confidentiality owed to clients, the rules on the safekeeping of client documents and client funds records, any applicable data protection legislation and the requirements of the firm's professional indemnity insurer. Those obligations vary among jurisdictions and the practitioner must consult her own regulator's rules, particularly on the use of third-party service providers and the storage of data outside the jurisdiction.

What on-premise and cloud actually mean

An on-premise system is software installed and run on hardware that the firm owns or controls, typically a server in the office or in a facility the firm rents. The firm buys or licenses the software, installs it, configures it, applies updates, manages the backup routine and bears the consequences of failure. Staff usually reach it across the office network, and remote access, if provided, is a separate arrangement that the firm must design and secure.

A cloud system, often described as software as a service, is run by the provider on infrastructure the provider controls and is accessed by the firm through a web browser or an application. The provider is responsible for hosting, maintaining the software, applying updates and, in most cases, backing up the data, while the firm remains responsible for how its own users behave, for the accuracy of what it enters, and for its obligations as the party responsible for client information. It is important to understand that outsourcing the hosting does not outsource the professional duty. The attorney remains answerable to the client for the protection of the information, and must satisfy herself that the provider's arrangements are adequate.

Hybrid arrangements

Between the two lies a range of hybrid models: a system installed on a server hosted in a third-party data centre but managed by the firm, a locally installed application that synchronises with a cloud store, or an on-premise core with cloud-based client portals. These can combine the advantages of each model, but they can also combine the disadvantages, because responsibility for failure may be divided among parties in ways that nobody has mapped. A firm considering a hybrid should insist on a written statement of who is responsible for each component.

The criteria that matter to a law firm

Technology comparisons often fall back on features and price. For a law firm, the following criteria are more helpful: confidentiality and security, availability and resilience, total cost, control over data, regulatory fit, flexibility for remote and mixed working, and the ease of leaving. The table below summarises the typical differences. It describes general tendencies, and an individual product or installation may depart from them.

Criterion	On-premise tendency	Cloud tendency
Upfront cost	Higher: hardware, licences, installation, configuration	Lower: usually a recurring subscription
Ongoing cost	Maintenance, upgrades, backup media, technical support, power and cooling, replacement cycles	Subscription that normally includes hosting, updates and support
Security responsibility	Rests entirely with the firm	Shared between provider and firm
Availability	Depends on the firm's hardware, power, connectivity and staff	Depends on the provider's infrastructure and on the firm's internet connection
Remote access	Requires deliberate configuration and security	Generally built in
Upgrades	Scheduled and carried out by the firm, often delayed	Applied by the provider, often continuously
Customisation	Can be extensive, at a cost	Usually configured within limits set by the provider
Exit	Firm already holds the data	Requires an export right and a workable format

Security and confidentiality

The intuition that data held in the firm's own office is safer than data held by a provider deserves scrutiny. A server under a desk in a small office is exposed to theft, fire, flood, power surges, unpatched software, careless staff and, increasingly, ransomware. Few small firms employ a person whose job is to monitor and defend it. A well-run cloud provider will typically operate dedicated facilities, redundant systems, monitored access, regular patching and a security team, which a small firm could not replicate at comparable cost. That is a general observation, not a guarantee. Providers vary enormously in quality, and a poor provider may be worse than a diligent firm.

The firm should therefore evaluate security on the facts, not on the model. For on-premise systems, it should ask whether the server is physically secured, whether the operating system and software are patched promptly, whether administrative access is limited and logged, whether data is encrypted at rest and in transit, whether backups are stored off site and tested, and whether remote access uses strong authentication. For cloud systems, it should ask the provider for a clear account of how data is encrypted, how access is controlled, how its personnel access customer data, how incidents are detected and notified, and how the provider is itself assessed. Where a provider states that it holds an independent assurance report or an accreditation, the firm should ask to see the document and read its scope, rather than accepting the statement as sufficient.

Confidentiality and legal privilege

Placing privileged material with a third party raises the question whether privilege or confidentiality is endangered. The usual analysis is that a service provider who stores data under a duty of confidence, without a right to read or use it, does not destroy confidentiality, in the same way that a firm's use of an offsite document store does not. The contract must support that analysis. It should limit the provider's use of the data to the provision of the service, prohibit disclosure other than as required by law, bind sub-contractors to equivalent terms, and require the provider to notify the firm if a third party seeks access to the data. A firm that cannot obtain such terms should not hold client files with that provider.

Location of data

Some jurisdictions and some clients impose restrictions on the transfer or storage of personal data outside a territory, and certain regulators publish guidance on outsourcing. Where data protection legislation applies, such as the UK GDPR in relation to personal data of persons within its scope, transfers to other countries must satisfy the relevant conditions. The firm should ask where its data will be stored and processed, whether copies or backups are held elsewhere, and whether the provider may change the location without notice. Where a client's instructions or the law require data to remain within a particular territory, the contract should say so.

Availability, resilience and continuity

Law firms operate against deadlines. A limitation period, a filing date or a completion cannot be postponed because a server has failed. Availability is thus a professional issue and not merely a convenience.

With an on-premise system, availability is determined by the firm's own hardware and arrangements. A small firm that runs a single server with no redundancy is exposed to a single point of failure. Restoration after a hardware fault depends on the quality of the backup and the speed with which replacement equipment and technical help can be found. With a cloud system, availability depends on the provider's infrastructure and also on the firm's internet connection. A reliable provider will often offer a stated service level, but the firm should read it carefully, since a commitment to a percentage of availability may be accompanied by exclusions and by remedies limited to a credit against fees. A credit does not compensate for a missed deadline.

Both models therefore need a continuity plan. The firm should identify how it would continue working if its principal system were unavailable for a day or a week: whether it holds a recent local export of key records, whether staff can reach critical documents and calendars by another route, whether there is a secondary internet connection, and who decides what to do. The plan should be written, tested and known to the staff. A firm that has never rehearsed a restoration does not know whether it can restore.

Cost: looking beyond the licence fee

Cost comparison is often misleading because the models present costs in different shapes. On-premise costs are front-loaded and partly hidden, while cloud costs are recurring and visible. A sound comparison considers the total cost of ownership over a realistic period, commonly five years, and includes all of the following for on-premise: server hardware and its replacement, software licences and upgrade fees, installation and configuration, backup systems and off-site storage, security tools, remote access infrastructure, power and environmental provision, the cost of an external support provider or an internal technician, and the cost of downtime. For cloud, the comparison should include the subscription at the expected level of use, any charges for additional storage, integrations, training and data migration, and the cost of the internet connection upgrades that may be needed.

The licensing model is a separate point and often decides the economics. Many products, in either model, are priced per user, so that the cost rises with every fee earner, assistant or part-time contractor who needs access. A firm that has fluctuating headcount, uses seasonal support or wishes to give clients and external advisers limited access should compare the effect of per-user pricing against pricing per firm with unlimited users, because the difference may be substantial as the firm grows. The comparison should be made on the firm's own headcount projections.

The following arithmetic is illustrative only and is not market data. Suppose, hypothetically, that a firm is considering a cloud subscription priced at a flat annual fee for the firm, against an alternative priced per user per month. If the firm has four users, the per-user model may appear competitive. If it expects to grow to twelve users, including administrative staff who need only occasional access, the per-user total will triple while the flat fee is unchanged. The lesson is not that either model is cheaper in general, but that the firm should model its own expected growth over the contract period and not compare a headline price at current headcount.

Control, customisation and integration

On-premise systems are sometimes preferred because they allow deeper customisation and tighter integration with other locally installed software. That advantage is real but it is often over-valued. Customisation creates a dependency on the person who built it, complicates upgrades and can leave the firm on an old version that is no longer supported. Cloud products normally offer configuration within defined limits, with standard connections to email, calendars, document tools and payment systems. For most small firms the discipline of working within a standard configuration is an advantage, since the firm's workflows are brought into line with a tested design.

A firm that has a genuinely unusual requirement, such as integration with a specialised court filing tool or a client's secure environment that can only be reached from inside a network, should identify that requirement at the outset and test it during evaluation rather than assuming it can be met.

Due diligence questions for any provider

Whichever model is preferred, the firm should conduct documented due diligence. For a cloud provider, the following questions are a practical minimum.

Who owns the data, and is it expressly stated that the firm retains ownership of all content, with the provider having a licence only to operate the service?
Where is the data stored and processed, and will the firm be notified of any change of location?
How is data encrypted in storage and transmission, and who holds the keys?
Which of the provider's staff can access customer data, in what circumstances, and is that access logged?
What are the backup frequency, retention period and recovery time, and has restoration been tested?
What is the stated service level, how is it measured, and what remedy applies on failure?
How and when will the firm be notified of a security incident?
Which sub-processors are used, and are they bound by equivalent obligations?
What happens to the data on termination, in what format can it be exported, within what time, and at what charge?
What happens if the provider is sold, ceases to trade or becomes insolvent?

The answers should be recorded and, so far as they are material, reflected in the written agreement. Statements made in a sales presentation have no contractual force unless they appear in the contract. A firm should also check the agreement's limitation of liability, because standard terms often cap the provider's liability at a modest sum and exclude consequential loss, and the firm should consider whether its own insurance is adequate in light of that cap.

Migration and exit

Migration is where many projects go wrong. Moving from a legacy system, whether paper, spreadsheets or an older application, requires careful planning. The firm should decide what to migrate, since not every historical record deserves to be carried forward, cleanse the data before transfer, run a trial migration with a sample of matters, verify the result against the source, and keep the legacy system available in a read-only state until the firm is satisfied. Training and a phased go-live reduce disruption. Matters with imminent deadlines should not be moved in the middle of the critical period.

Exit planning should be done before the contract is signed. The firm should confirm that it can export its data in a usable, documented format, including documents, metadata, time entries, ledgers and audit information, and that the export is available on demand and not only after the termination of the contract. The right to retrieve data after termination, for a defined period, should be express. The firm should test the export during evaluation and not leave the discovery of its limitations to the day it needs it. An on-premise system has a parallel exit problem: if the vendor ceases to support the software, or the file format is proprietary, the firm may hold its data but be unable to read it.

Regulatory, insurance and client considerations

The firm should consider whether its regulator has issued guidance or rules on outsourcing and the use of cloud services, and should follow them. It should notify its professional indemnity insurer where the insurer's proposal form or policy conditions require information about the firm's data and security arrangements, and it should ask whether the policy responds to a data breach or to loss arising from the failure of a provider. Some institutional clients, including financial institutions and government bodies, require outside counsel to comply with their own security questionnaires and may restrict the use of certain providers. The firm should anticipate these and be able to answer them accurately.

The firm should also address the matter in its own documentation. Its privacy notice, engagement letter and internal policies should describe, in accurate terms, the use of third-party providers to store and process client information. Staff should be trained to use the system correctly, including the use of strong authentication, the avoidance of shared logins, and the careful handling of devices that access the system.

Practical next steps

The following steps provide a sequence for a firm that must make or review the decision.

Document the firm's requirements: users, matters, document volumes, remote working needs, integrations, and any client or regulatory constraints on data location.
Check the regulator's guidance on outsourcing and the use of third-party and cloud providers.
Calculate the five-year total cost of ownership of each option on the firm's own growth projections, including the licensing model and the cost of downtime.
Send the due diligence questions above to each candidate and record the answers in a comparison matrix.
Review the draft agreement for ownership of data, confidentiality, location, sub-processing, service levels, limitation of liability, termination and export rights.
Run a trial with real but low-risk matters and test the data export.
Prepare a written continuity plan and a migration plan with a rollback option before go-live.
Inform the insurer and, where appropriate, clients, and update the firm's privacy and security documentation.

How practice management software supports the decision

A cloud practice management platform such as Legalytech is one example of the hosted model discussed above, bringing matters, documents, billing and client communication into a single service that the firm accesses without maintaining its own servers. Each firm should test any product, Legalytech included, against the due diligence questions in this article, and should confirm for itself how the service meets its confidentiality, availability and exit requirements before committing client files to it.

This article is provided for general information only and does not constitute legal advice. Practitioners should consult the rules of their own jurisdiction and regulator.