Rules
Client files in Microsoft 365 or Google Workspace: a small US law firm's test plan
A small US law firm's test plan for client files in Microsoft 365 or Google Workspace: retention clocks, redaction limits, audit logs and legal holds under US rules.
What to take away
- A suite such as Microsoft 365 or Google Workspace can store a law firm's client files, but neither one decides how long a file must be kept. In the United States the periods in the two examples below come from state rules, and court rules add duties of their own.
- Two state examples show how the clocks differ. California's Rule 1.15 counts five years from final appropriate distribution of client funds or property. Maryland's records rule counts five years from the date each record was created. Both concern records of client funds and property, not the whole client file.
- A black box drawn over text is not redaction. The US National Security Agency warned in 2005 that covered information in a computer document can almost always be recovered, so it has to be deleted from the document.
- Audit logs expire. Microsoft Purview Audit (Standard) keeps records for 180 days, and Audit (Premium) keeps Exchange, SharePoint, OneDrive and Microsoft Entra records for one year by default.
- Run the four tests below on a copy of real documents before you move a firm's files. The software offers settings; keeping, protecting and proving remain the firm's own job.
Why this belongs in a software review
A small firm often looks first at the email and file tools it already pays for. The useful question is whether that suite can hold client files without creating a problem later.
This article covers United States rules only, not Canadian law societies or Canadian privacy law. It sets out four tests: does the retention clock match the rule, does redaction remove content, does the audit trail last as long as the file, and can you freeze everything when a dispute starts. For the general business side, see US email retention rules.
One caution first. The two retention examples below come from different authorities: California's rule was approved by the California Supreme Court, and Maryland's comes from an order of the Court of Appeals of Maryland. A firm licensed in several states may therefore face several sets of text. The examples show how rules are worded, not what your state requires, so read your state's current text or ask your state bar before you set a deletion date.
Test 1: Does the retention clock match the rule?
What the rules say
California's Rule 1.15, effective January 1, 2023, requires a lawyer or law firm to maintain complete records of all funds, securities and other property of a client that come into the lawyer's possession. It also requires the firm to preserve those records for no less than five years after final appropriate distribution of the funds or property. The clock starts at distribution, which may fall years after a matter opened.
Maryland words it differently. Under the text in a March 2007 order of the Court of Appeals of Maryland that created Rule 16-606.1, month-end financial institution statements and the account records the rule requires must be kept for at least five years after the date the record was created. That clock starts when each record is made. The rule also says that where records are kept electronically, a paper copy must be printable on reasonable request. The order dates from 2007, so confirm the current wording and numbering with the Maryland courts.
California's rule covers records of client funds, securities and other property, and Maryland's covers attorney trust account records. Neither is a rule for every document in a closed matter. Editorial suggestion: record, for each state where the firm is licensed, the source of every retention period you configure, so you can show where the number came from.
What the software lets you configure
Microsoft Purview retention policies and labels can retain content, delete it, or retain it for a period and then delete it. Microsoft's documentation says that when content under a policy is edited or deleted, a copy is kept in a protected location: the Preservation Hold library for SharePoint and OneDrive, and the Recoverable Items folder for Exchange. Two details matter to a firm. Where several settings apply to one item, retention takes precedence over permanent deletion and the longest retention period wins, unless priority cleanup is used. And the retention period can start when an item is created or, for files, when it was last modified. Labels can also start the period at an event, so test whether a matter-closed event can be fed into the system.
Google works differently. Google's Vault overview says Vault is not a data archive and does not retain data until you set up retention rules. Without a rule, users can delete data and services can purge it under their own protocols. Vault covers Gmail, Drive, Chat, Meet and other services, and it can place holds on accounts, organizational units and groups.
Editorial suggestion: create a test matter with a known closing date and check what the tool does on that date, not what the settings page says it will do.
Test 2: Does redaction remove the content?
The legal duty
Federal Rule of Civil Procedure 5.2(a) says that, unless the court orders otherwise, a filing that includes a Social Security or taxpayer-identification number, a birth date, the name of a known minor or a financial-account number may show only the last four digits of the numbers, the year of birth, or the minor's initials. Rule 5.2(h) adds that a person waives this protection for their own information by filing it without redaction and not under seal. That is federal civil procedure. State courts have their own rules, so check each court you appear in.
Why a black box fails
The NSA's information assurance report "Redacting with Confidence," I333-015R-2005, dated December 13, 2005, names three common mistakes: covering text with black rectangles, covering parts of an image or shrinking it, and overlooking metadata and document properties. It says black cover is effective for printed paper but not, in general, for documents distributed as computer files. Its core point is short: information hidden or covered in a computer document can almost always be recovered, so sensitive information must be removed through deletion. The report also notes that converting a Word file to PDF does not remove all metadata. It discusses Word 2000 to 2003 and Acrobat 5 and 6, so keep the principle, not the menu steps.
What the office tools offer
Microsoft's support page for Document Inspector says it can find and remove comments, revision marks and versions, document properties and personal information, hidden text, and hidden rows, columns and worksheets in Excel. Word's inspector detects text hidden with the hidden font effect but cannot detect text hidden by other means, such as white text on a white background. Microsoft warns that removal may not be reversible and advises running it on a copy.
Document Inspector is a metadata cleaner, not a redaction tool. To test a redaction tool:
- Take a sample document with a Social Security number, a comment and a tracked change.
- Redact it and save the result under a new name.
- Select all text and paste it into a plain text editor.
- Search for the number, then check document properties and comments.
- Check the file's preview and the document store's search results for the same number.
If the number appears in steps 3 to 5, the process does not redact. Editorial suggestion: keep the unredacted original in a restricted matter folder and share only the tested copy.
Test 3: Does the audit trail last as long as the file?
Microsoft says Purview Audit (Standard) retains records for 180 days. The default changed from 90 days, and records generated before October 17, 2023 keep the 90-day period. With Audit (Premium), Microsoft Entra ID, Exchange, OneDrive and SharePoint records are retained for one year by default, and audit log retention policies can extend that to 10 years. Ten-year retention requires a separate per-user add-on license, and the policy is not retroactive.
Google's Vault overview says Vault provides a complete audit log of user activity in Vault, including creating or editing retention rules, running searches and exporting data, and that the log cannot be edited. That describes activity inside Vault. It does not say the log records every file view in Drive, so check in Google's documentation which events your plan records.
If a matter file is kept for seven years but the audit log lasts 180 days, the log can describe last month and says nothing about who opened the file in year three. Editorial suggestion: set audit log retention at least as long as the longest file retention period you configure, then check which license reaches it.
Test 4: Can you freeze everything when a dispute starts?
Federal Rule of Civil Procedure 37(e) applies when electronically stored information that should have been preserved for litigation is lost because a party failed to take reasonable steps and it cannot be replaced. On a finding of prejudice a court may order measures no greater than needed to cure it. Only on a finding of intent to deprive may it presume the information was unfavorable, instruct the jury to do so, or dismiss the action or enter a default judgment.
Editorial suggestion: a firm needs a hold that overrides automatic deletion. Purview's rule that retention beats permanent deletion supports that for items under a retention policy, and Google says holds preserve data indefinitely for legal or other retention needs. Test it: hold a test mailbox and folder, delete items from both, and confirm search still finds them.
For the access side, the site's file sharing security review covers link expiry and guest accounts, and office suites security covers account controls. The best file sharing software list is a starting point for comparing products.
A one-afternoon trial plan
| Test | What to do | Pass looks like |
|---|---|---|
| Retention clock | Create a test matter with a known closing date and a rule written from your state's text | The tool acts on the date you computed |
| Redaction | Redact a sample with an identifier, a comment and a tracked change | The identifier is gone from text, properties and previews |
| Audit length | Find your plan's audit retention in vendor documentation | Log retention is at least as long as the longest file retention |
| Legal hold | Hold a test mailbox and folder, then delete items | Held items can still be searched |
| Evidence | Export the log entry for each test action | Entry shows user, time, action and item |
Keep the dated results with the policy.
Common questions
Does the software vendor decide how long we keep client files?
Is a trust account rule the same as a client file rule?
This article is general information, not legal advice. Rules change and states differ, so confirm the current text with your state bar or a lawyer.
Sources
- [National Security Agency, Redacting with ConfidenceHow to Safely Publish Sanitized Reports Converted From Word to PDF (I333-015R-2005)](https://www.ca7.uscourts.gov/assets/pdf/nsa-redact.pdf)
