Who Has the Keys to Your Law Firm’s Technology?
Why Lawyers Need to Maintain Control of Their Firm’s Accounts, Credentials and Data

By Julie Bays

Most lawyers would never allow an outside bookkeeper to be the only person who could access the firm’s bank accounts. The bookkeeper may handle the day-to-day work, but the lawyer understands that the accounts belong to the firm and that the firm must retain ultimate control. Technology should be treated the same way.

Your law firm may pay every technology bill. You may own the computers sitting on the desks. You may pay monthly subscriptions for Microsoft 365 or Google Workspace, practice management software, cloud storage, your telephone system and numerous other services. But if the person or company managing your technology disappears tomorrow, could you get into all of them? 

Paying for It Is Not the Same as Controlling It

Modern law offices depend on technology for almost every part of practice. Client intake, email, document management, calendaring, billing, telephone service, electronic filing and remote work all depend on systems that may exist somewhere outside the physical law office.

That arrangement is not inherently a problem. Most law firms need outside vendors and technology professionals to operate efficiently and securely.

The problem arises when the firm gives away control without realizing it. This often happens innocently. A lawyer opens a practice and hires someone to build a website. The web designer registers the domain name. An IT consultant sets up Microsoft 365. Someone else installs the telephone system. An employee creates the firm’s social media accounts. A vendor establishes a backup service.

Five or 10 years later, nobody remembers who created what.

The lawyer may be paying for the technology while someone else remains the registered owner, administrator or recovery contact. The firm still needs a way to regain control if ordinary access fails. Every law firm should know where the spare keys are.

Administrative Access Is the Spare Key

An administrator account has higher-level authority than an ordinary user account. Depending on the system, an administrator may be able to add or remove users, reset passwords, change settings, modify security controls or manage subscriptions.

Your IT provider may use administrative credentials every day. That may be entirely appropriate.

But your IT provider should not necessarily be the only party that possesses them.

The same principle applies to important technology accounts. The firm should retain a securely stored administrative or emergency-access account controlled by the firm rather than solely by an outside vendor.

If a relationship with a technology provider ends unexpectedly, the firm should not have to negotiate for access to its own systems.

Start With Your Domain Name

If you want to conduct a technology ownership audit, one of the best places to begin is your internet domain.

Many lawyers give little thought to domain registration after the firm’s website has been established. But the domain may be one of the most important digital assets the firm owns.

It controls more than the website. It may also control the firm’s email addresses.

If your firm uses addresses such as lawyer@yourlawfirm.com, a problem with the domain can potentially affect both the website and email.

Find out where the domain is registered. Determine who is identified as the account holder, what email address is associated with the account, who receives security and password-reset notifications, whether the firm has login credentials and who controls multi-factor authentication.

Ideally, the account should be registered to the law firm and connected to an address the firm controls. A web designer, marketing company or IT provider may manage the domain for you. That does not mean the domain should belong to them.

Look at Microsoft 365 or Google Workspace

For many law firms, Microsoft 365 or Google Workspace have become the center of the office. Email, calendars, documents, cloud storage, video meetings and other functions may all depend on that environment.

Yet lawyers sometimes have surprisingly little information about how it is configured. Ask a simple question: Does the firm have its own administrative account? If the answer is, “Our IT company handles that,” ask again. There is nothing wrong with the IT company handling administration. The question is whether the firm could regain control if necessary.

The firm should understand who owns the environment, who the administrators are and how emergency access would work. This matters especially when changing technology providers. The incoming provider should not have to persuade the outgoing provider to release credentials the firm should already control.

Check the Rest of the Firm’s Technology

Apply the same ownership and access review to the firm’s other essential systems:

• Telephone system: Who has administrative rights, and can the firm transfer its numbers to another provider?
• Practice management software: Who owns the account, and who can add or remove users?
• Social media and business profiles: Does access depend on an employee’s personal account?
• Password manager: Who controls the business account, and what happens if that person leaves?

The firm does not need a three-inch binder documenting every technical detail. It needs to know what it owns, where its essential systems are located and how to regain control.

“We Back Everything Up” Is Not Enough

Ask whether the firm’s data is backed up, and you may hear, “Yes, our IT person takes care of that.” But that answer raises more questions: What is backed up, how often, where is it stored, and how long is it retained? Can the firm access the backups, and who controls the account? Most importantly, has anyone tested whether the firm can actually restore its data?

Lawyers do not need to understand backup architecture, but someone responsible for managing the firm should periodically receive understandable confirmation that backups are occurring and that restoration has been tested.

Employees Can Walk Away with Keys Too

Technology control is not only about outside vendors. Employees leave. When they do, law firms should have a consistent process for removing access promptly and preserving information the firm still needs.

Email, document systems, cloud storage, practice management software, remote access, telephone systems and other accounts should be reviewed when an employee leaves. The same is true when responsibilities change internally.

A long-time office manager may have accumulated access to nearly every system in the firm. That may be entirely appropriate while the person is employed, but the firm should know what those systems are and make sure control does not rest solely with that individual.

Do not wait until an employee leaves to discover that only they know the password or receive the authentication code for an essential account.

Read the Exit Provisions Before You Need Them

Technology contracts naturally focus on the beginning of the relationship: what services will be provided, what they will cost and how quickly support will be available. Law firms should spend more time looking at the end.

What happens when the relationship terminates? Will the provider return administrative credentials? How will the firm receive its data? Will the provider cooperate with a replacement vendor? How long will access continue during the transition? Are there additional charges for offboarding?

These questions are particularly important with cloud services. Some cloud agreements provide only a limited period for retrieving data after termination and exit assistance may be limited or nonexistent unless it was addressed in the contract.[1]

A good technology provider should not be offended by questions about leaving. Planning for an orderly transition is not evidence of distrust. It is ordinary business planning. Lawyers routinely draft agreements that address what happens when business relationships end. Their own technology agreements deserve the same attention.

Delegation Is Not Abdication

None of this means lawyers should become technology professionals. Delegating technology management is often the smart decision. A good IT provider can make a law practice more secure, productive and resilient. Lawyers should take advantage of that expertise.

But delegation is not abdication. A law firm remains responsible for its operations, its client information and its ability to continue serving clients when something goes wrong. Maintaining appropriate control over the technology on which the practice depends supports competent law office management, protects client information and makes continuity far easier when employees, vendors or circumstances change.

Your technology professional can hold the working keys, and your office manager and vendors can use and maintain them. But the law firm should always know where the spare key is kept.

Because when it comes to your firm’s technology, the answer to the question, “Who has the keys?” should ultimately be, “We do.”

Ms. Bays is the OBA Management Assistance Program director. Need a quick answer to a tech problem or help solving a management dilemma? Contact her at 405-416-7031, 800-522-8060 or julieb@okbar.org. It’s a free member benefit. 

[1] Lisa R. Lifshitz, “Beyond the Fine Print: Four Risks in Cloud Agreements,” Business Law Today, American Bar Association, Sept. 12, 2025.

Originally published in the Oklahoma Bar Journal — October, 2026 — Vol. 97, No. 7