An email from the firm's risk team
A firm has decided not to renew. Their risk team writes: under the contract, please return all firm data in a usable format and then delete it, and confirm in writing when deletion is complete, including from backups and sub-processors. Your founder forwards the email to engineering, who realise they have never done this before.
The firm's documents are in file storage. Matter data is in the database. Extracted text sits in a search index. AI prompts and outputs are in logs. Usage data is in an analytics tool. Support tickets with screenshots are in the help desk. Backups contain everything. Nobody is sure what else.
Why a firm's data is harder to remove than to add
Products are built to store data, not to remove it cleanly. Over time, a firm's data spreads to places nobody planned.
- Data is copied into search indexes, caches and AI retrieval stores for performance.
- Logs and error trackers capture fragments of documents and prompts.
- Analytics and support tools hold user details and sometimes content.
- Backups keep data for a period after it is deleted from the live system.
- Shared tables mix firms' data, so deletion needs care to avoid touching other firms.
What an uncertain deletion costs
A firm leaving is already a loss. A firm leaving unhappy with how its data was handled is worse, because law firm risk teams talk to each other and to their clients. If you cannot confirm deletion properly, the firm may escalate, and your answer affects every other firm's view of you. Future security reviews will ask how you delete data at contract end, and a vague answer counts against you. And any data you keep by accident remains a risk you carry.
How we build clean exit for law firms
What we build makes a firm's data findable, exportable and removable, with a record of each step.
- A data inventory mapping every store that holds firm data: database tables, file storage, search indexes, AI stores and logs, analytics, help desk and sub-processors, with how data is identified by firm in each.
- A per-firm export in usable formats: documents in their original form with folder structure, matter data as structured files, and AI outputs with their records, with a manifest listing everything included.
- Deletion jobs per store, run in order, each verified by checking that no firm data remains.
- Handling of logs and third-party tools, with deletion requests sent to sub-processors where they support it.
- Backups handled according to your written policy, for example allowed to expire on their normal schedule and never restored for that firm, stated clearly in the deletion record.
- A deletion record for the firm: what was exported, what was deleted from where and when, how deletion was verified, and how backups are handled.
| Where firm data sits | How it is handled |
|---|---|
| Database | Firm-scoped deletion, verified by query |
| File storage | All objects under the firm removed, verified |
| Search index and AI stores | Firm entries removed, index checked |
| Logs and analytics | Deleted or allowed to expire per your policy |
| Backups | Handled per written policy, stated in the record |
What your contracts require, and what must be kept for your own legal reasons, is for you and your advisers to decide. The system makes whatever you decide possible to carry out and to evidence.
The next firm that leaves
The next departing firm's risk team sends the same request. Your team starts the export, which produces the firm's documents, matter data and AI records with a manifest. The firm confirms receipt. The deletion jobs run across every store in the inventory, each verified. Deletion requests go to the sub-processors that hold firm data. The firm receives a deletion record explaining exactly what was removed and how backups are handled. They file it, and the relationship ends on good terms.
Could you delete a firm's data today?
- You have no map of every place a firm's data is stored.
- You have never done a full export for a firm.
- Search indexes, logs and analytics are not included in deletion.
- Your approach to backups at contract end is not written down.
- You could not give a firm a written record of deletion.