When a firm chooses practice-management software, it is choosing who will hold client files, trust records, and personal information. LawPractica treats that as a legal and professional duty, not only an IT preference. We do not shop for the cheapest global region. We select only in-country hosting providers that hold the certifications a law firm is entitled to demand, and we will not put a market live until that infrastructure is in place.
Physical, network, application, and data controls are there so the file remains private, available to the people who are authorised to see it, and recoverable if something fails. Business continuity is planned for the same reason: the practice still has to open the matter the every morning.
Certified in-country hosting — no exceptions
A provider is eligible only if it is physically in the host country and independently certified. We require ISO/IEC 27001 (information security management), ISO/IEC 27017 (cloud security controls), ISO/IEC 27018 (protection of personal data in the cloud), and AICPA SOC 1, SOC 2, and SOC 3 Type 2 reports. Uncertified or offshore-by-default infrastructure is not used.
Primary data centre — Canada
Canada production runs on OVHcloud Canada in Beauharnois, Quebec. OVHcloud holds ISO/IEC 27001, 27017, and 27018 for its Canadian datacentres, together with SOC 1, SOC 2, and SOC 3 Type 2 reports. Operations and automation stay in Central Canada. Further country products use a certified local host of the same standard before that market goes live.
Data-transfer policy
Residency is incomplete if transit leaves the country. Client data residency and data transit stay inside the host jurisdiction. Support tooling and operational systems are chosen on the same basis, so a routine transfer does not become an unplanned cross-border disclosure.
Encryption
Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher, using automatically managed SSL/TLS certificates issued via the ACME protocol. Backups are stored encrypted. The purpose is to protect client files and personal information against unauthorised access while they sit on disk or move between authorised systems.
Disaster recovery — Canada
Disaster recovery runs on a separate Sable Servers Inc. infrastructure in Montreal, not on the same OVHcloud production site. Sable Servers Inc. provides Canadian-hosted infrastructure with security and compliance controls, including ISO/IEC 27001 and SOC 2 Type II assurance. Automated backups run twice daily. Retention keeps the last five days of backups for recovery. Backups are for recovery purposes and are not a substitute for the firm’s own retention duties.
Private cloud and on-premises
Firms that must keep the database and application inside their own boundary can run LawPractica on-premises or with a provider they already trust. That hosting boundary does not have to leave the country either. Those arrangements are discussed directly with IT.
Independent testing & audit
Hosting certifications are the floor, not the whole programme. LawPractica performs penetration testing annually and operates against ISO/IEC 27001 Information Security Management System guidelines for our own application, access, encryption, and recovery controls.
Access control
The product is built for multi-user firms. Access is limited to people the firm authorises, so a matter, a trust ledger, or a personal record is not open to the whole office by default. The firm remains responsible for who it invites and what those users may do.
Support security & compliance
Legal accounting is specialised work. LawPractica support staff and consultants are people who already know how a law firm’s books are kept. They do not enter a workspace unless the firm authorises it. Access is limited to the request in hand, granted through a secure channel, and transparent to the firm — there is no standing, undocumented way into another practice’s records.
Architecture
Each practice has its own workspace and its own data store. A high-volume firm does not share that store with a sole practitioner or a two-lawyer office, so one practice’s load is not allowed to crowd the other. Larger firms can be placed on dedicated servers when volume requires it. Access to each store is scoped to that firm’s workspace - not a single shared store across all firms.