Secure document sharing for law firms
Legal work has an awkward requirement: privileged material routinely goes to people outside the firm who have no interest in learning the firm’s systems — clients, opposing counsel, experts, courts.
That is why client portals so often go unused, and why documents end up back in email attachments.
Why portals go unused
A client receiving three documents a year will not remember a portal password. They email and ask for the file, and the lawyer — wanting to be responsive — attaches it. The portal did not fail technically; it failed because it put the cost of security on the person with the least reason to accept it.
Per-document links instead of a destination
The pattern that holds up is attaching controls to each document rather than asking recipients to visit somewhere.
- Access expires on a matter-appropriate timeline, often when the engagement closes.
- Privileged material requires email verification, tying each view to a verified address.
- Every open is recorded, giving a defensible answer to when a document was received.
- Access is revoked immediately when a matter concludes or a relationship changes.
- The recipient clicks a link and reads. Nothing else is required of them.
The audit trail is the part clients notice
Delivery disputes are common and expensive. A record showing a document was opened on a specific date by a verified address settles arguments that otherwise become affidavits.
Worth checking in any tool you evaluate: whether that history survives the link expiring. Some systems delete access records along with the link, removing the evidence exactly when it becomes relevant. Capsule retains the record.
Common questions
- How should a law firm send privileged documents to a client?
- Send a link scoped to the matter with an expiry, require email verification so each view is attributable, and keep the access record. Avoid attachments, which cannot be revoked if misdirected.
- Do clients need an account or portal login?
- No. Recipients open a link in a browser. If the document is sensitive, they verify their email address with a one-time code, which takes seconds and requires no account.
- Can we prove when opposing counsel received a document?
- Yes. Each open is recorded with a timestamp, and on email-verified shares the verified address is recorded with it. The record remains available after the link expires.