Security Best Practices

Why Security Matters for Law Firms

Law firms handle highly sensitive client information — case facts, financial records, identity documents, and privileged communications. A breach can expose clients to legal harm and damage your firm's professional reputation. The practices below are simple to implement and significantly reduce risk.

Strong Passwords

AdlDesk enforces a minimum of 8 characters for all passwords. For meaningful protection, follow these guidelines when setting passwords for yourself or team members:

• Use at least 12 characters — longer is always stronger.
• Mix uppercase letters, lowercase letters, numbers, and symbols (e.g., @, #, !, %).
• Avoid dictionary words, names, or dates that can be guessed.
• Never reuse a password across multiple services.
• Use a password manager (LastPass, 1Password, Bitwarden) to generate and store strong passwords.

Do Not Share Accounts

Every team member must have their own individual account. Sharing a single login between multiple people makes it impossible to track who performed which action in the audit log and removes individual accountability. If a user needs different permissions, create a new account with the correct role rather than sharing credentials.

Deactivate Departing Users Immediately

When a team member leaves the firm — whether due to resignation, dismissal, or end of contract — deactivate their account the same day. Go to Settings → Users, find the user row, and toggle their status to Inactive. This immediately blocks login access while preserving all records they created. Do not delete the account as this would break the historical audit trail.

Regular Permission Audits

Review role permissions at least once per quarter. As your firm grows and roles evolve, permissions can drift beyond what is actually needed. For each role, ask:

• Does this role truly need Create/Delete access, or is Read sufficient?
• Should paralegals see Financial data?
• Do all lawyers need access to Settings?

Navigate to Settings → Roles and review each role card. Reduce permissions to the minimum necessary for each role to perform its job (principle of least privilege).

Browser Security

• HTTPS enforced: AdlDesk is only accessible via HTTPS — all data in transit is encrypted using TLS. Never proceed if your browser shows a certificate warning.
• Shared computers: If you use a shared or public computer, always click Sign Out before leaving. Do not save passwords in the browser on shared machines.
• Auto-logout: AdlDesk sessions expire after a period of inactivity. This is intentional — do not disable this feature.

Data Encryption

All data stored in AdlDesk is encrypted at rest on the server side. Document files stored in the cloud are encrypted using AES-256. You do not need to take any additional action — encryption is automatic and always on.

Audit Log

Every action performed in AdlDesk — case edits, document uploads, payment records, user changes — is logged in the Audit Log. As a firm admin, access it via Settings → Audit Log. The log shows:

• Timestamp of the action
• User who performed it
• Type of action (Created, Updated, Deleted)
• The specific record affected

Review the audit log periodically to spot unusual activity, such as large numbers of deletions or exports initiated by a single user.