Firm Administrator & Partner Security

Managing Partners and designated Firm Administrators bear the primary governance duty for their firm's MtaaLex workspace. As a practice leader, your configuration choices determine how effectively client confidentiality is maintained across the entire organization.

---

1. The Principle of Least Privilege

In legal practice, the Principle of Least Privilege means:

"Every practitioner and staff member should be granted only the minimum level of access necessary to perform their professional duties."

• Avoid Granting Blanket Admin Rights: Do not assign the Managing Partner or Firm Administrator role to everyone. Administrative privileges allow changing billing rates, viewing all financial fee notes, inviting new users, and accessing firm-wide audit logs.
• Assign Specific Functional Roles:
  • Associates should be assigned Senior Associate or Junior Associate.
  • Registry clerks and secretaries should be assigned Paralegal.
  • Firm accountants should be assigned Finance (which grants billing access without exposing sensitive litigation strategies).

---

2. Staff Invitations & Identity Verification

Inviting an individual into your firm workspace grants them access to your firm's internal directory and client files.

• Verify the Recipient's Identity: Ensure that you only invite verified practitioners and employees of your chambers.
• Use Official Firm Email Addresses: Whenever possible, invite staff using their official corporate or firm domain email (e.g., advocate@yourfirm.co.ke) rather than personal webmail accounts.
• Never Forward One-Time Invitation Links: When an invitation is generated, it contains a secure, one-time token linked to that specific email address. Never forward an invitation link meant for one lawyer to another staff member.
• Revoke Stale Pending Invitations: If an invite was sent in error or remained unaccepted for more than 7 days, cancel the invitation from the Team & Organization settings.

---

3. Regular User & Access Audits

Firms change constantly: pupils complete pupillage, associates move on to other chambers, and temporary interns finish clerkships.

• Quarterly User Review: Every quarter, the Managing Partner should open Team & Organization and review the list of active users.
• Verify Case Collaborators: Periodically inspect high-profile or sensitive commercial matters to verify that only active counsel remain assigned as collaborators.
• Audit Log Review: Periodically inspect /audit-logs to monitor significant workspace events, such as unusual after-hours document downloads or unexpected role changes.

---

4. Former Employee Offboarding Checklist

When an advocate, pupil, or legal assistant leaves your law firm, immediate offboarding is essential to prevent data leaks, conflicts of interest, and breach of client privilege.

Follow this practical 5-Step Offboarding Checklist:

┌─────────────────────────────────────────────────────────────┐
│           DEPARTING EMPLOYEE OFFBOARDING CHECKLIST          │
├─────────────────────────────────────────────────────────────┤
│ Step 1: Deactivate Account Immediately                     │
│         Open Settings > Team & Organization, locate their   │
│         profile, and click "Deactivate Account".            │
│         → Their active session tokens are revoked instantly.│
├─────────────────────────────────────────────────────────────┤
│ Step 2: Reassign Lead Counsel on Active Matters             │
│         Open cases where the departing lawyer was Lead      │
│         Advocate and reassign the lead role to an active    │
│         partner or colleague.                               │
├─────────────────────────────────────────────────────────────┤
│ Step 3: Remove Collaborator Access on Sensitive Files       │
│         Remove the departing user from case collaborator    │
│         lists to ensure clean archive records.              │
├─────────────────────────────────────────────────────────────┤
│ Step 4: Revoke Linked Integrations                         │
│         Ensure any shared calendar links or shared email    │
│         delegations are disconnected.                       │
├─────────────────────────────────────────────────────────────┤
│ Step 5: Preserve Historical Work                           │
│         Do not worry about losing past filings: MtaaLex     │
│         permanently preserves historical case notes,        │
│         drafts, and filings with the original author's      │
│         timestamp for compliance and audit integrity.       │
└─────────────────────────────────────────────────────────────┘

PRESERVATION OF RECORDS

Deactivating a user in MtaaLex does not delete their past pleadings, case attendance notes, or uploaded documents. All historical work remains intact in your firm archive, while preventing the departed individual from logging in.