Confidentiality: Rule 1.6(c) and Opinion 477R
This page explains how Legal Friendly supports a firm's own confidentiality efforts. It is general information, not legal advice. Each firm decides for itself whether a technology meets its professional obligations under its state's rules.
What the rule asks
ABA Model Rule 1.6(c): “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”
ABA Formal Opinion 477R (2017) explains what ‘reasonable efforts’ means for technology. It asks lawyers to weigh the sensitivity of the information, the likelihood of disclosure without added safeguards, the cost and difficulty of those safeguards, and whether they make a tool too hard to use. It lists seven practical steps, including understanding how client information is stored and sent, using reasonable security measures, training staff, and doing due diligence on technology vendors.
Most states have adopted Rule 1.6(c) or a close version. Check your own state's rule and ethics opinions.
How Legal Friendly maps to the seven steps in Opinion 477R
| Step | What Legal Friendly does |
|---|---|
| 1. Understand the nature of the threat | Family-law records are highly sensitive. Legal Friendly treats every case as confidential by default, with safeguards for shared households and shared devices (Quick exit, private email subjects, nothing readable left on the device after sign-out). |
| 2. Understand how client information is transmitted and stored | Data is stored on Base44, which reports SOC 2 Type II and ISO 27001 certification, and is encrypted in transit and at rest. Files are kept byte-for-byte with a SHA-256 fingerprint. |
| 3. Understand and use reasonable electronic security measures | One-time codes on new devices, a required authenticator app for law-firm accounts (optional for parents), lockout after repeated failed sign-ins, inactivity sign-out, server-side permission checks on every file request, and timing-safe handling of codes and tokens. |
| 4. Determine how electronic communications should be protected | Messages and files stay inside the case rather than in email. Share links expire, can require an access code, and can be revoked. Emails carry neutral subject lines and no case details. |
| 5. Label client confidential information | Files can be marked privileged; privileged files are visible only to people with edit access. |
| 6. Train lawyers and nonlawyer assistants | Each team member has their own sign-in and role. Firm staff accept a confidentiality notice before accessing client information. |
| 7. Conduct due diligence on vendors | A one-page security summary, this page, and answers to your firm's security questionnaire are available. AI helpers are off unless you turn them on, and Legal Friendly never sells your data. |
Related rules firms often ask about
- Rule 1.1, Comment 8 (technology competence): Lawyers should understand the benefits and risks of the technology they use.
- Rule 5.3 (nonlawyer assistance): Applies to outside vendors. Legal Friendly keeps an activity record of every access, download, share and access change so the firm can supervise how client information is handled.
- Formal Opinion 483 (data breaches): If a security incident ever affects a firm's clients, Legal Friendly will notify the firm and affected clients promptly and follow state breach-notification laws.
Who controls the information
The client owns their case. They decide who can see it, including their firm, and can remove access in one step. Legal Friendly staff can't open a case unless the client turns on 24-hour support access, and every page viewed under it is recorded in the client's activity log.
Questions or a security questionnaire
Email info@legalfriendly.com. We'll answer your firm's questionnaire and walk through anything above.
General information, not legal advice. Confirm your obligations under your state's rules of professional conduct.