Appearance
Security & Data Protection Overview
As a legal practice, your law firm handles some of the most sensitive information in society: privileged communications, corporate trade secrets, litigation strategies, client identification records, and financial transactions.
Under the Advocates Act (Cap 16), common-law principles of Advocate-Client Privilege, and the Kenya Data Protection Act (2019), legal practitioners have an ethical and statutory duty to maintain confidentiality and protect client data from unauthorized access.
What Information Lives in MtaaLex?
When your law firm uses MtaaLex to manage its daily practice, the system stores:
- Client Records: National ID numbers, corporate incorporation certificates, contact addresses, and KYC documents.
- Litigation & Case Files: Pleadings, witness statements, court orders, case diary entries, and strategy notes.
- Commercial & Conveyancing Instruments: Contracts, title deeds, land search results, and lease agreements.
- Accounting & Billing Data: Itemized fee notes, retainer accounts, disbursement logs, and VAT invoices.
- Internal Firm Notes: Confidential discussions between partners, associates, and pupils.
- AI Research & Drafting Sessions: Legal research queries, precedent searches, and drafted submissions.
Because of this sensitivity, security is not an optional feature—it is the foundation of digital legal practice.
The Shared Responsibility Model
Security in MtaaLex is a partnership.
No matter how robust the software protections are, the system cannot protect your files if a user shares their login credentials, uses an easily guessable password, or leaves an unlocked computer unattended in a public court corridor.
To help your firm understand how security works, responsibilities are divided into three distinct pillars:
┌─────────────────────────────────────────────────────────────┐
│ SHARED RESPONSIBILITY MODEL │
├──────────────────────────────┬──────────────────────────────┤
│ 🛡️ What MtaaLex Protects │ • System authentication barriers │
│ │ • Workspace & firm data isolation│
│ │ • Transmission encryption (HTTPS)│
│ │ • Private cloud document vault │
│ │ • Role-based access controls │
│ │ • Internal activity audit logs │
├──────────────────────────────┼──────────────────────────────┤
│ 👤 What You Protect │ • Your password and login privacy│
│ │ • Locking your screen & devices │
│ │ • Recognizing phishing scams │
│ │ • Avoiding untrusted public PCs │
│ │ • Verifying recipient details │
├──────────────────────────────┼──────────────────────────────┤
│ ⚖️ What Your Firm Admin │ • Assigning appropriate roles │
│ Protects │ • Deactivating departing staff │
│ │ • Reviewing firm access & logs │
│ │ • Authorizing client matters │
└──────────────────────────────┴──────────────────────────────┘1. What MtaaLex Protects
MtaaLex implements technical safeguards within the software itself:
- Strict Workspace Isolation: Ensuring one law firm cannot view or access another firm's matters.
- Modern Authentication: Verifying cryptographic tokens on every single request through our identity provider (Clerk).
- Encrypted Transmission: Using modern TLS encryption so data cannot be intercepted between your browser and our servers.
- Private Document Storage: Storing court pleadings and evidence in secure object storage accessed only via time-limited, signed authorization links.
- Role-Based Controls: Restricting access within the firm so users only see what their role permits.
2. What You Protect (Every Practitioner)
As an individual advocate, paralegal, or staff member, you are responsible for:
- Choosing a strong, unique password that you do not use on any other website.
- Never sharing your login credentials with colleagues, trainees, or family members.
- Locking your computer whenever you step away from your desk.
- Signing out immediately when using shared office computers or court registry terminals.
- Remaining vigilant against phishing emails and deceptive messages claiming to be MtaaLex.
3. What Your Firm Administrator Protects
Managing Partners and designated Firm Administrators hold administrative oversight:
- Ensuring that only authorized staff members receive accounts in your firm workspace.
- Assigning the principle of least privilege (e.g., giving junior pupils access only to assigned files, rather than full administrative rights).
- Immediately deactivating accounts when an advocate, associate, or legal assistant departs the firm.
- Regularly reviewing firm activity and billing permissions.
Next Steps
Explore the following guides to understand how MtaaLex safeguards your files and how your team can uphold best security practices: