Your case management system is on your server,
or on somebody else’s
Managed IT and cybersecurity for solicitors and conveyancers across London, Kent, Essex and the South East. We support firms running ALB from OneAdvanced in-house and firms on the Access platform, we keep the system up on the days it cannot go down, and we protect the client account from the fraud aimed at it.
Where it lives changes everything
Some firms run ALB on their own server in a comms room. Others work on the Access platform, where the application belongs to the vendor. The risks are completely different, and most providers treat them the same.
ALB from OneAdvanced, on your own server
That server is ours to look after properly: patched, monitored, backed up and tested. We know what the restore actually looks like rather than assuming a green backup job means something. We watch disk, SQL and performance so a slow afternoon gets investigated before your fee earners complain, and we plan for the day the hardware fails — because at some point it will. For a firm doing residential conveyancing that server is the single point of failure on the days money actually moves, and “we'll deal with it then” is not a plan.
LawFusion on the Access platform
Here the application is Access's, not ours. What we own is everything between your desk and it: the internet connection and its failover, the endpoints, the identity and MFA, and the local print and document setup around it. When it's slow, that's usually where the fault lives — and when it isn't, we take it up with Access rather than leaving you to translate between two suppliers. We'd rather be clear about that boundary than imply we run systems we don't.
Two things make conveyancing the sharpest end of legal IT
The system cannot be down — a completion doesn't slide because your server did. And the client account is a target. Payment diversion fraud rarely involves anything being technically hacked; it involves a convincing email arriving at exactly the right moment. The controls that genuinely reduce it are the ones firms skip:
Email authentication — SPF, DKIM and DMARC configured properly, so nobody can send mail that appears to come from your domain
Impersonation detection — and lookalike-domain blocking, not just spam filtering
Enforced MFA — on every mailbox, with no standing exceptions for partners
Mailbox rule monitoring — the quiet auto-forward on a fee earner's mailbox is usually the first sign of compromise
Phishing simulation and training — with per-user results, because the attack targets people
Dark web monitoring — for credentials tied to your domain
None of this replaces your own procedure for verifying bank details with the client. What it does is make the fraudulent email far less likely to arrive, and far more likely to be noticed when it does.
These controls sit on top of a support agreement rather than inside it, and we will price them separately and plainly. Keeping your systems patched, backed up and monitored, and planning changes around your diary, is the support agreement itself.
The question nobody asks first
Ask most IT providers for a quote and the first question is how many users you have. For a law firm the first question should be where your case management system lives, because that single answer changes almost everything about the support you need.
Beyond it, the pressures are particular. Court deadlines don't move because a server did. Your matter files carry retention obligations measured in years after the file closes. And every year your PII renewal asks about multi-factor authentication, backups, patching and staff training, where a vague answer costs you money.
Day to day
Backups you have actually seen restored
For an in-house ALB server this is the difference between a bad afternoon and a catastrophe. Tested, verified restores — not a backup report nobody reads.
File retention and archiving
Matter files have to outlive the matter, be retrievable when a complaint or negligence claim arrives, and be disposed of on schedule rather than kept forever by accident.
Microsoft 365 for a law firm
Mailboxes, document storage, retention policies and the controls your accreditations expect, configured for how a firm works rather than left on defaults.
Remote and hybrid fee earners
Working from home or at court needs the same controls as working at the desk: managed devices, encrypted endpoints, enforced MFA, and no client data sitting on a personal laptop.
Telephony
We install and manage 3CX, including call handling for firms where a missed call is a lost instruction.
PII renewal and accreditations
When your broker sends the questionnaire, or you are preparing for Lexcel or CQS, send us the IT sections and we will complete them with the supporting evidence. It is part of supporting a firm, not a chargeable extra every time an insurer asks.
Four steps, around your diary
We look at what you've got
The server or the platform, the backups, the mailboxes, and what an insurer would make of it.
You get the findings in writing
Costed and in order of what actually matters, with no pressure attached.
We move you across
Around your court dates and your diary, never through a deadline week.
Then it goes quiet
Monitoring, a named person who knows your firm, and a review each quarter.
What firms ask us
Can you support our case management system?
We support firms running ALB from OneAdvanced on in-house servers, and firms working on the Access platform. For an in-house server we look after the whole thing — patching, monitoring, backups and restore testing. For a vendor-hosted platform the application is theirs; we look after the connection, endpoints and identity underneath it, and we deal with the vendor when the fault is at their end.
Is security included in your support agreement?
No, and be careful of providers who imply it is. Endpoint detection, phishing simulation and training, dark web monitoring and penetration testing are priced separately from day-to-day support. What is included is keeping your systems patched, monitored, backed up and documented, and completing the IT sections of the questionnaires your clients and insurers send you. We would rather you knew the shape of that before a quote lands than after.
Can you stop payment diversion fraud?
No one can promise that, and be wary of anyone who does. What we can do is make a spoofed email from your domain very hard to send, catch lookalike domains before they reach a fee earner, enforce MFA so a stolen password isn't enough, and watch for the mailbox rules that signal a compromise in progress. The last line is always your own verification procedure with the client, and we would rather reinforce that than pretend to replace it.
Our ALB server is getting old. What are our options?
That's a conversation worth having before it becomes urgent. We will tell you honestly whether replacing the hardware, moving to the vendor's hosted option, or leaving it alone for another year is the right call for your firm — including when the answer is to do nothing yet.
We're a small firm. Are we too small for you?
No. Several of our clients are small practices, and they get the same service desk and the same monitoring as everyone else.
Do you understand the SRA Accounts Rules?
We are an IT provider, not a compliance consultancy. What we do is make sure the systems and controls around your client account support the obligations your COFA and COLP are accountable for — and that you can evidence them.
Are you certified?
We hold Cyber Essentials and renew annually. We're a Microsoft 365 specialist and provide licensing as a Cloud Solution Provider.
Where are you based?
Croydon, supporting clients across London, Surrey, Kent, Essex and the South East.
Let's look at what your insurer would find
Twenty minutes on the phone and a free look at your environment. You'll know where your firm stands afterwards, whether you hire us or not.
Book your call — hello@starma.it