Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For continuing matter work, a properly configured client portal or business file-sharing workspace is usually the safer default than ordinary email attachments. It can limit access to named people, organize documents by matter, provide an audit trail, and support revocation or expiration. Encrypted email remains useful when the client’s workflow is centered on email, but the firm must verify protection during delivery, recipient authentication, storage after opening, and what happens on shared devices.
Neither the word “portal” nor “encrypted” proves that a system is appropriate. The right choice depends on the information involved, client instructions, engagement terms, applicable law, the firm’s records workflow, and whether staff and clients will use the controls correctly. This U.S.-oriented guide explains how to compare the options and deploy them without treating security as a checkbox.
The short answer: use controlled access for ongoing matters
A portal is generally the better fit when lawyers and clients will exchange documents repeatedly, when several people need different permissions, or when communications must remain attached to a matter file. A business file-sharing workspace can provide similar controls if the firm creates separate matter areas, grants recipient-specific permissions, and reviews links and memberships. Encrypted email is practical for a small number of messages or for clients who cannot adopt another workflow, but it places more responsibility on the sender to verify the recipient, protect attachments, and understand the message’s entire lifecycle.
The American Bar Association’s Formal Opinion 477R, revised May 22, 2017, frames confidentiality as a risk-based professional judgment. It states that a lawyer generally may transmit representation-related information over the internet after making reasonable efforts to prevent inadvertent or unauthorized access. The opinion also notes that a client agreement, a law, or the nature of the information can require special precautions. Lawyers must apply the rules and ethics opinions governing their own jurisdiction.
#1 Best Overall
What a secure exchange must accomplish
Evaluate a tool by the controls it actually delivers in your configuration, not by its marketing label. The following questions expose the meaningful differences between a portal, a business workspace, and encrypted email.
- Who can access the item? Can the firm name individual recipients, apply least-privilege permissions, distinguish viewing from downloading or uploading, and revoke access without deleting the matter?
- How is the recipient authenticated? Does the recipient use a password, multifactor authentication (MFA), a one-time code, or another verification method? Is an unprotected link ever created?
- What is encrypted, and when? Confirm protection in transit and at rest. Determine whether content remains protected after a recipient opens or downloads it, and whether copies are created on local devices or synchronized folders.
- Can the firm see and control the lifecycle? Look for access logs, expiry dates, revocation, download records, retention rules, deletion controls, and incident-response procedures.
- Will the exchange become part of the matter file? A system that leaves communications in a separate mailbox or consumer folder can create a records gap even when the transfer itself is encrypted.
- Will people use it correctly? Count the steps for staff and clients, assess their technical ability, and identify points where a user could select the wrong matter, recipient, or link setting.
- Who administers it? Establish ownership for permissions, MFA enforcement, departing staff, vendor settings, audits, and updates.
Comparison at a glance
| Criterion | Client portal | Business file-sharing workspace | Encrypted email |
|---|---|---|---|
| Best use | Continuing, matter-centered exchanges with clients and teams | Controlled shared folders and collaboration across defined participants | Email-centered conversations and limited exchanges |
| Access model | Named users and matter-specific permissions; settings depend on the platform | Named users, groups, folder permissions, upload/download rights, and links; configuration is the firm’s responsibility | Recipient authentication and message controls vary; a protected message may become a local copy after opening |
| Organization | Documents and communications can stay attached to a client matter | Requires a deliberate folder and naming structure that separates matters | Mailbox threads and attachments can require manual filing |
| Revocation and expiry | Often available for portal items; verify the actual plan and settings | Business services may offer expiry and revocation; verify link and membership behavior | May offer expiry, recall, or forwarding limits; these are not universal and may not remove downloaded copies |
| Encryption lifecycle | Confirm in-transit and at-rest protection, plus behavior after download | Confirm in-transit and at-rest protection, synchronization, and local-copy controls | Confirm protection in transit and at rest, recipient authentication, and post-opening storage |
| Client effort | Initial invitation and sign-in; recurring access can be simple | Invitation, permissions, and possibly an app or synchronized folder | Usually familiar, but secure-message passwords or separate sign-in can add steps |
| Primary operational risk | Incorrect matter setup or clients ignoring invitations | Oversharing through broad membership or public links; mixed matter folders | Misdirected address, shared mailbox or device, and uncontrolled attachment copies |
Capabilities differ by edition and configuration. Treat a cell describing a common capability as a question to verify in the specific service, not as a guarantee.
Client portals: why they work well for matter-based practice
A portal integrated with law practice-management software can keep documents and communications attached to the client matter. The ABA Law Practice Division explains that this can reduce the manual movement of messages between systems and make the matter record more complete (American Bar Association, 2023). A portal may also support more than file exchange, such as messages, requests, and status updates, so staff do not have to reconstruct a conversation from separate email accounts.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
Controls to configure
- Create a portal workspace for each matter and verify the client and matter identifiers before uploading anything.
- Invite named individuals rather than a generic household, company-wide, or public address. Remove people when their role ends.
- Give clients only the folders and actions they need. If a client must submit documents, enable upload without granting access to internal work product.
- Require MFA or an equivalent recipient-verification method where the service supports it, especially for sensitive matters.
- Set expiry or review dates for temporary participants, opposing-party production areas, experts, and vendors.
- Turn on access and download logging, and decide who reviews those records and how they are retained.
Where portals can fail
A portal does not correct a bad matter structure. A staff member who uploads to the wrong matter, grants a family member access to an entire workspace, or leaves a former employee active can cause a disclosure. Clients may also forward their credentials or download files to unmanaged devices. Use a short onboarding explanation that states what the portal contains, how to report a lost device, and whom to contact before forwarding a document.
Business file-sharing workspaces: flexible, but configuration-heavy
Business editions of Microsoft 365 services such as OneDrive and SharePoint, Google Workspace, Dropbox Business, Box, and Citrix ShareFile can provide controlled shared folders and collaboration features. They are not interchangeable with free consumer accounts for confidential legal work. The ABA’s file-sharing guidance emphasizes recipient-specific permissions, separate matter structures, and controls such as upload/download rights and link expiration (American Bar Association, July/August 2022).
Build a matter-safe folder design
- Create a top-level area for the firm, then a separate workspace or restricted root for each client matter.
- Use subfolders that reflect the work, such as “Client uploads,” “Filed pleadings,” and “Attorney work product.” Do not rely on a single folder with mixed audiences.
- Assign access to named users or controlled groups. Avoid “anyone with the link” and organization-wide links unless a documented risk review specifically approves them.
- Separate internal work product from client-visible material. Test the client view with a nonprivileged account before sending the invitation.
- Set upload, download, editing, and sharing rights independently where the service allows it.
- Apply expiration to temporary links and calendar a review of standing memberships at matter milestones.
The ABA Law Practice Division recommends considering both data at rest and data in transit and establishing a file structure that separates client matters (American Bar Association, 2023). Also determine whether synchronization places files on personal computers or phones, whether local copies are encrypted, and how the firm can remove data when a device or employee leaves its control.
Encrypted email: useful when email is the real workflow
“Encrypted email” covers several designs. Some services encrypt transport between mail systems; others place the message in a protected web portal and send the recipient a notification; some encrypt an attachment with a password. Ask which design is in use and what the recipient experiences.
Recommended Free Tools
Questions to answer before relying on it
- Is the message encrypted in transit and at rest on the provider’s systems?
- Must the recipient authenticate before viewing the body and attachments, and how is identity verified?
- Does protection continue after the recipient opens the message, or can the content be copied, forwarded, printed, or synchronized without control?
- Are expiration, revocation, forwarding restrictions, and download records available, and do they apply to attachments as well as the message?
- What happens when the recipient uses a shared mailbox, family computer, public workstation, or a phone without a screen lock?
- Where is the firm’s retained copy stored, and can staff associate it with the correct matter?
Safer attachment practice
If an attachment is sent, protect the file itself when appropriate and send its password through a different channel, such as a verified phone number. Do not put the password in the same email thread. Confirm the address using a trusted source rather than replying automatically to a newly supplied address. Explain to the recipient that downloading the file creates a copy outside the firm’s control.
How to choose for a particular matter
Use a documented decision rather than a firm-wide slogan. The following sequence keeps the risk factors visible.
Rank #4
- Classify the information. Note whether it includes identity data, health information, financial records, trade secrets, litigation strategy, or material subject to a protective order or contractual handling rule.
- Read the engagement and client instructions. A client may mandate a portal, prohibit certain services, require a geographic storage location, or impose retention and deletion terms.
- Map the participants. List every person who needs to view, upload, edit, or download material, including co-counsel, experts, translators, and client administrators.
- Choose the workflow. Select a portal for recurring matter exchange and integrated records; select a business workspace where controlled collaboration is needed across defined folders; use encrypted email when email is practical and the message volume or participants do not justify another system.
- Test the lifecycle. Send a non-sensitive test, verify authentication, inspect logs, download on the intended device, and confirm what the sender can revoke or delete afterward.
- Record the rationale. Note the tool, settings, participants, review date, and any client-specific requirement in the matter’s administrative record.
Implementation procedures
Portal launch checklist
- Verify the matter number, client legal name, and approved contact addresses against the engagement record.
- Enable MFA and administrator alerts; restrict administrative rights to staff who need them.
- Create client-visible and internal-only areas, then upload a harmless test document.
- Invite one authorized client contact and confirm that the invitation goes to the verified address.
- Ask the client to sign in and confirm that the visible folders and actions match the intended permissions.
- Upload the first real document only after the client view has been tested; log the exchange in the matter.
- Schedule periodic reviews and a closure procedure that revokes access and applies the firm’s retention policy.
Business workspace launch checklist
- Select the business edition governed by the firm’s contract and administrator console, not a personal free account.
- Turn on MFA, sharing alerts, version history, and audit logging where available.
- Build a unique matter root and prohibit cross-matter inheritance when the platform supports that setting.
- Assign named users and test viewer, uploader, editor, and administrator roles separately.
- Disable public links by default. If an external link is unavoidable, require a named recipient, password or sign-in, an expiration date, and a review owner.
- Document synchronization and local-copy behavior for every device type the firm permits.
- At matter close or personnel change, remove memberships, expire links, and preserve records according to the firm’s policy.
Encrypted-email procedure
- Confirm the recipient’s address using the engagement record or a previously verified channel.
- Choose the service’s protected-message option and require recipient authentication; do not assume ordinary TLS delivery provides end-to-end control.
- Use a clear subject that does not reveal unnecessary confidential information.
- Minimize the attachment set and apply file-level protection when the sensitivity warrants it.
- Send any password or one-time code through a separate, verified channel.
- Check the delivery and access record, then save the message and attachments in the correct matter location.
- Tell the recipient how long the protected message remains available and what to do if the message arrives unexpectedly.
Records, retention, and matter integration
Security and records management are connected. A portal that automatically associates messages and documents with the matter can reduce filing omissions, but only if staff use the correct workspace. A business folder may require a separate step to capture the conversation, permissions history, and final version. Email often requires the most manual work: staff must preserve the message, attachments, and relevant access information without creating unnecessary duplicate copies.
Before selecting a service, obtain its current documentation for retention and deletion, audit-log availability, data location, incident notification, subcontractors, export, and account closure. Check the contract against client requirements and the firm’s ethical obligations. A security certification or encryption feature alone does not establish compliance with a particular client mandate or law.
Common failure modes and fixes
A link was sent to the wrong person
Revoke or expire the link immediately, preserve the access log, notify the supervising lawyer under the firm’s incident procedure, and assess whether the recipient viewed or downloaded the material. Do not assume changing a filename or deleting the local shortcut removes a copy.
A client cannot sign in
Use the vendor’s verified recovery process, confirm the client’s address independently, and avoid sending credentials or confidential attachments in an unprotected workaround. If the problem persists, document the decision to use a different protected channel and revisit the portal’s usability.
A matter folder contains another client’s files
Stop sharing, remove the incorrect material, preserve relevant logs, and escalate under the firm’s confidentiality and incident policies. Rebuild the folder from a clean matter root and require a second-person check before resuming exchange.
A recipient opened an attachment on a shared device
Ask the recipient to sign out, remove downloaded copies, and secure the device. For future messages, require stronger authentication and use a portal with named access and expiry where the risk justifies it.
Staff keep using ordinary attachments
Make the approved workflow easier than the exception: provide a short decision tree, templates with the protected-send option preselected, and periodic audits. Explain which matters require a portal or workspace and who can authorize an exception.
Governance checklist for a law firm
- Maintain an inventory of approved portals, business workspaces, and encrypted-email services.
- Assign an owner for each service’s configuration, vendor review, and incident response.
- Require MFA for staff and appropriate recipient authentication for external users.
- Review memberships, links, synchronization, and administrator accounts at matter milestones and when personnel change.
- Separate client-visible material from internal work product and test permissions before each new matter’s first exchange.
- Train staff to verify recipients through a trusted channel and to treat public or broadly accessible links as exceptions requiring approval.
- Retain access records and communications in a way that satisfies the firm’s records policy and client instructions.
- Reassess vendor terms for data location, retention and deletion, incident notice, logging, export, and subcontractors before renewal or a material change.
- Document the risk assessment when a client’s instructions, the information’s sensitivity, or a jurisdiction-specific rule requires controls beyond the firm’s default.
Bottom line
For most ongoing legal matters, start with a client portal or a business file-sharing workspace configured for named access, MFA, least privilege, separated matter folders, logging, and controlled expiry. Use encrypted email when it genuinely fits the client’s workflow, but verify protection before delivery and after opening, authenticate the recipient, protect attachments appropriately, and file the exchange in the matter. The defensible choice is the one whose controls, records, and usability match the specific risk—not the one with the most reassuring label.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
