Running a Law Firm on Open-Source Software

Law firms operate under confidentiality obligations that are more stringent than most businesses. Client-attorney privilege means email, documents, and communications must be provably secure. Self-hosting addresses this by keeping everything on hardware the firm controls.

The Confidentiality Requirement

Client-attorney privilege is not a checkbox. It requires that communications between lawyer and client remain confidential and that the firm can demonstrate the measures taken to protect them. When email goes through Google's servers, the firm cannot demonstrate that only authorised parties accessed it. When documents sit on Dropbox, the firm cannot prove that Dropbox employees did not view them. Self-hosting eliminates these gaps. The server is in the firm's office or a controlled data centre. Access is logged. Encryption is managed by the firm, not a third party.

The Stack for a Law Firm

• Document management: Paperless-ngx for scanning, OCR, and organising case files. Every document becomes searchable text. Metadata tagging links documents to cases and clients.
• Case management: EspoCRM customised with matter types, court dates, and document associations. Track deadlines, statute of limitations, and client communications in one system.
• Email: Docker Mailserver with enforced TLS. Client communications stay on firm-controlled hardware. Email archiving for compliance and discovery.
• Secure file sharing: Nextcloud with client-specific shared folders and expiration dates. Share case documents with clients without using unencrypted email attachments.
• Internal communication: Mattermost for lawyer-to-lawyer chat. Separate channels per case. Full message history for case review.
• Billing and time tracking: Kimai for time tracking. Invoice Ninja or ERPNext for invoicing. Billable hours tracked to the minute, invoices generated from tracked time.

Document Versioning and Audit Trails

Legal documents go through multiple revisions. Knowing who changed what and when is critical for case management and, in disputes, for evidence. Nextcloud provides automatic versioning for every file. Every edit is saved as a new version. The full history is viewable and restorable. Combined with server access logs, the firm can demonstrate exactly who accessed each document and when.

Privilege Logs and Discovery

In litigation, the firm must produce a privilege log listing documents withheld on grounds of privilege. A well-configured document management system generates this automatically. Paperless-ngx with custom tags for privilege status enables paralegals to tag documents during review. The privilege log is generated from the tags. What takes days with paper files takes minutes with a properly configured digital system.

Is It Ethically Compliant?

Bar associations in most jurisdictions have issued guidance on technology competence and cloud computing. The consensus is that using cloud services is ethically permissible if the lawyer takes reasonable steps to protect client data. Self-hosting with encryption, access controls, and audit logging meets a higher standard than most SaaS platforms because the firm retains direct control over the security measures. The firm can answer questions about data protection with specificity, not with a vendor's generic security white paper.

VPS1 builds secure, compliance-ready stacks for law firms. Confidentiality is not a feature. It is the foundation.