Before the firm had a server, it had a room. Maybe it still does. A door off the back hallway, a key on the office manager’s ring, steel cabinets with matter numbers on the drawer fronts, and a clipboard on the wall where you initialed the file you took and the day you brought it back. Somewhere near the door, a sticker from the fire marshal. Nobody would have called any of that a security program, and all of it was one.
Most of what lived in that room lives in email now. The engagement letter, the medical records a client scanned on their phone, the draft settlement with your notes in the margin, the wire instructions for Friday’s closing. It all arrived as an attachment, and it all stayed, because nothing in an inbox ever asks to be filed.
So here is a slow walk through the room you used to have, one object at a time, and the question each one asks of the mailbox. Coffee is optional but recommended.
The key
The file room had one door and a known number of keys. When a paralegal left, the key came back on the last day, and if it didn’t, somebody called the locksmith.
A mailbox has as many doors as there are devices signed into it. The phone, the laptop at home, the iPad from three years ago that lives in a kitchen drawer and still syncs every night. Each of those is a key. First question of the morning: does anyone at the firm know how many keys exist, and whether the people who left took one with them? An account belonging to someone who no longer works there, still signing in, is the key that never came back.
A key alone shouldn’t open the door, either. That is the whole job of a second factor at sign-in. Don’t judge by whether your own phone asks. Ask whoever runs your email whether every account requires one, shared inbox and old accounts included. If nobody can say yes for certain, that is where to start.
The clipboard
What the clipboard bought you was an answer, later, to a question nobody planned to ask. Who had the file for matter 2214 on the fourteenth?
The mailbox keeps its own clipboard, and it is a better one. Microsoft 365, where a lot of firms keep their mail, turns mailbox audit logging on by default: what was deleted, when an inbox rule changed, when mail was read by something other than the usual app. Exactly what gets written down depends on the plan and the settings. Nobody reads it until something has gone wrong, and it only reaches back so far. Three questions for whoever runs your email: is the log on, what does it actually capture for your firm, and how far back can it answer? Get the answers on an ordinary Tuesday.
The chute nobody built
The file room never had a slot in the wall that quietly copied every page to an address outside the building.
A mailbox can. A forwarding rule set up once, for a perfectly good reason (the partner who wanted everything on a personal account during a long trial, years ago), keeps working long after the reason is gone. Rules set up for bad reasons work exactly the same way. Once a quarter, ask whether any mailbox at the firm sends copies anywhere outside the firm, and who decided that it should.
The fire code
The fire marshal’s interest was simpler than yours. Paper burns, and the code made sure that when it did, people got out and something survived.
Email feels fireproof because it lives in somebody else’s building. In Exchange Online, mail a user deletes and then empties from Deleted Items waits in a recovery folder for fourteen days by default, thirty at the most, unless someone has set up holds or retention policies. After that the user can’t get it back, and what an administrator can still recover depends on settings most firms have never looked at. A mailbox emptied by an attacker on the way out, or a deletion nobody notices until the following month, can easily outlast that window. Whether the firm keeps its own copy of the mail, and when anyone last restored from it, is usually the firm’s question to answer.
The boxes in the basement
Closed matters went into banker’s boxes, the boxes went to storage, and somebody kept a schedule that said when each box would be shredded. The schedule mattered as much as the boxes did.
Inboxes never close a matter. Mail from a case that ended a decade ago sits one scroll below this morning’s. Whatever schedule the firm follows for paper, ask whether the mailbox follows it too (with any litigation hold or preservation duty outranking the schedule, the same as it would for the boxes). Usually nobody told it to, and every extra year of mail is another year of client information waiting for whoever gets in. The professional rule asks for reasonable efforts to prevent unauthorized access; the easiest efforts are the ones that leave less in the room.
Before the coffee’s gone
None of this needs new software to begin. It needs an hour, and a list of who holds keys. The rest of the walk can happen another morning.
If you’d like a second person on that walk, we do this walk with Connecticut firms: book fifteen minutes.