A client is asking us to demonstrate confidentiality. What do they want to see?

Evidence, not assurances: who can access which matters, how departures are closed, and which vendors touch client data. If producing that takes more than a day, that is where the work starts.

Email is effectively our document system. Is that fixable?

Yes, but the problem is ownership, not tooling. Someone has to own the architecture; access per matter, retention, and the document system follow from there.

Professional services

Law firms, accounting practices, and corporate and fiduciary services in both markets.

How this business actually runs

The product is confidential judgment delivered in documents. Email is the real document management system, whatever else was bought, and the architecture belongs to nobody.

The systems and the data

Email, document management, case or tax systems, e-signature. Privileged and confidential data spread across all of them, with access accumulated by habit.

What most firms think they need, and what comes first

Most think they are too small to be a target. Industry surveys of law firms have reported for years that a substantial share have experienced a security incident: small is not invisible; it is unwatched. What comes first is an access review, because it is the cheapest control with the largest effect.

Obligations and local texture

Professional confidentiality duties apply in both markets, whatever the technology. In the United States, Florida's 30-day breach notification applies to client data, and accounting practices doing certain financial work may fall under the FTC Safeguards Rule. In Trinidad & Tobago, the Data Protection Act is partially proclaimed, and corporate and fiduciary services are touched by the FATF-driven obligations of the Miscellaneous Provisions (FATF Compliance) Act 2025, in full force since 17 November 2025.

What excellent looks like here

Privileged data is mapped; access is granted per matter, not per person forever; departures are closed the same day; and confidentiality is demonstrable to a client who asks, not assumed.

Where this work has held

We have written and maintained the information security program for a Florida tax practice that had to show its controls, not describe them. That work is the pattern these pages describe.

How you’d start

Whatever the industry, the entry point is the technology diagnostic: this page's systems and obligations, assessed on your operation.

Questions owners ask

Small is not invisible; it is unwatched. Attacks are automated, and a firm holding privileged data behind weak access is a better target than a bank with a security team.

Customer Success Team

Itaca Technologies

Your question isn't here?

Ask it as you'd ask it across the table. The team that does the work reads it and answers with a concrete next step.