Security & Compliance
Trust funds require trust. Here's how we protect both.
We work with settlement funds, IOLTA accounts, and client financial data every day. Security isn't a policy page for us - it's built into how check writing, trust accounting, and reconciliation actually get done, down to the physical setup our team works on.
Data-Residency Options - Your Data Never Has to Leave Your System
For firms with data-residency requirements, we offer a setup where your data never leaves your own environment:
- Remote access to your own systems - Your firm keeps the desktop/system in your own office, and our team accesses it remotely to do the work. The data stays where it already lives.
- Virtual desktops in your name, in your location - Alternatively, we set up virtual PCs registered under your firm's name and hosted in your chosen location, which our team accesses remotely. Either way, the data doesn't move onto our infrastructure.
This setup is available to any firm that requires it - just raise it during onboarding, and we'll configure the option that fits your requirements.
How We Lock Down Our Own Systems
For engagements where this dedicated remote setup is requested, we go further on our end too:
- Desktops, not laptops - Team members working on that engagement use fixed office desktops, not laptops, so nothing is designed to leave the building.
- No USB access, no personal email, no personal cloud storage - These desktops are locked down to only the systems and platforms your firm approves. There's no path for data to be copied off, emailed out, or synced to a personal account.
- No mobile phones anywhere in our office - This isn't limited to the trust accounting team. Mobile phones are prohibited across our entire office, for every role, every day. There's no way for anyone to photograph a screen or a document.
- Separate laptops for general office work only - Staff do have laptops, but only for non-client tasks like email and general office work. These laptops never touch trust accounting data, and they're restricted as well - not open, unmonitored devices.
Between the desktop-only policy, the mobile phone ban, and locked-down systems, there is no practical path for client data to leave our office undetected.
Our Three-Level Review Process - Built for Control, Not Just Accuracy
Every check and every reconciliation entry passes through a Preparer → Reviewer → Closer process before anything is finalized. This isn't only a quality check - it's a control structure that means no single person can independently move funds, alter a ledger, or issue a check unreviewed.
Preparer - prepares the work based on documented instructions and supporting evidence
Reviewer - independently verifies the preparer's work against source documents
Closer - gives final confirmation before any check is authorized
This segregation of duties applies across check writing, trust reconciliation, and operating bookkeeping.
Staff Vetting
Every team member handling client financial data goes through:
- Police verification and background checks, completed before any access to client data is granted
- A signed confidentiality agreement, binding every team member to protect client and firm information
Audit Trail & Documentation
Every check, deposit, and reconciliation entry is supported by documented evidence - reduction letters, W-9s, medical bills, fee-sharing agreements, client confirmations - attached and retained as part of the record, maintained and accessible for your review at any time.
This means that if a firm or a Bar examiner asks "how was this number arrived at," the answer is already documented, not reconstructed after the fact.
Signing Authority
Our team never holds check-signing authority, on any engagement. We prepare and review, but authorization to sign always stays with your firm.
Insurance
We do not currently hold Errors & Omissions insurance or fidelity bonding as a standard part of our engagements. We'd rather tell you that directly than leave it unaddressed.
For firms that require coverage - particularly for larger or higher-value engagements - we can discuss setting up a dedicated arrangement specific to your engagement, including insurance coverage configured to your requirements. This isn't a standard part of every engagement today, but it's something we're glad to work through where it's needed.
If insurance coverage is a requirement for your firm, raise it during onboarding and we'll work through what that looks like together.
Rule 5.3 & Legal Review
Our model has not yet been formally reviewed by counsel against ABA Model Rule 5.3 (Responsibilities Regarding Nonlawyer Assistance) or related state trust-accounting outsourcing standards.
We understand that your firm's own attorneys carry responsibility for reasonable oversight of any outsourced provider under Rule 5.3, and that a documented, reviewed process helps your firm meet that obligation with confidence.
For firms that require it, we can discuss a dedicated arrangement specific to your engagement, including formal legal review of the engagement structure against Rule 5.3 and applicable state standards. This isn't a standard part of every engagement today, but it's something we're glad to work through where it's needed.
If formal legal review is a requirement for your firm, raise it during onboarding and we'll work through what that looks like together.
What Happens If Something Goes Wrong
If we identify an error, discrepancy, or suspected fraud, we don't sit on it. Our process is:
- Immediate notification - by phone and email, as soon as an issue is identified
- A formal, detailed report - documenting exactly what was found, so your firm has a complete record, not just a verbal flag
Our case studies include real instances where we identified fraud and double-compensation in historical records that predated our engagement - flagging these issues directly, even when uncomfortable, is part of how we work. See our case studies →
Data at the End of an Engagement
If an engagement ends, your data is deleted in the presence of your firm's representative - not quietly retained or held on our systems afterward.
Questions Firms Often Ask
Do you have signing authority on our accounts?
No. Checks are prepared and reviewed by our team, but signing authority always stays with your firm.
Can we require our data to stay entirely on our own systems?
Yes. We offer a dedicated setup - either remote access to your own desktop, or a virtual desktop hosted under your firm's name - specifically for this. See above ↑
Do you carry insurance, or has your model been legally reviewed against Rule 5.3?
Not as a standard part of our engagements today. For firms that require either, we can set up a dedicated arrangement specific to your engagement - including insurance and formal legal review - configured to your requirements. Raise this during onboarding and we'll work through it together.
Are your staff based in India, and does that affect data security?
Our team is based in India, working under a locked-down setup: desktops (not laptops) for client data, no mobile phones anywhere in the office, and background-verified staff under signed confidentiality agreements. For firms with specific residency requirements, we also offer a setup where your data never leaves your own systems at all.
What happens to our data if we end the engagement?
It's deleted in the presence of your firm's representative - not retained on our end afterward.
Talk to Us About Your Firm's Specific Requirements
If your firm has specific data-security, insurance, or compliance requirements - including questionnaires from your malpractice carrier or IT/security review - we're glad to walk through exactly how our setup works, and configure a dedicated arrangement if needed.