Access control
Access granted by role and reviewed periodically, so information reaches the people who need it and stops there.
Professional services
Your clients trust you with information. We help you keep it confidential.
Law firms, accountants, consultants and recruiters hold information that belongs to other people. IT for these firms is a confidentiality question before it is a productivity one.
- Confidentiality first
- Evidence for client due diligence
- EU & UK data locations
Technologies we work with
- Microsoft
- SOPHOS
- Acronis
- HPE
- 3CX
- UBIQUITI
- veeam
What we put in place
Security that a client can ask you about
Professional firms are increasingly assessed on their information security by clients, insurers and regulators. These are the controls that come up, and the ones we implement.
Identity security
MFA and conditional access on every account, with privileged access limited and monitored.
Microsoft 365
Mail, files and collaboration configured for confidentiality rather than left at the defaults.
Endpoint security
Encrypted, patched, managed devices with endpoint detection — the laptop is where confidentiality is most often lost.
Secure remote work
Working from home, a client site or abroad without weakening any of the controls above.
Data protection
Retention, deletion and sharing controls applied automatically, to the periods your advisers set.
Email security
Anti-phishing, impersonation protection and mailbox auditing — and secure options for sending sensitive material.
Backup
Independent, tested backup of mail and documents, retained for as long as your obligations require.
Business continuity
A plan for continuing to serve clients through an outage, and the evidence of it that insurers now ask for.
Audit trails
Logging of access and change, so a question about who saw what can actually be answered.
Joiners and leavers
Access granted and — more importantly — fully removed, on the day, every time.
Client questionnaires
Help answering the security sections of client and insurer due diligence, accurately and with evidence behind it.
Confidentiality in practice
Most confidentiality failures are access failures.
Serious breaches at professional firms rarely involve anything sophisticated. Far more often it is someone who could still reach a matter they left two years ago, a document shared with a link that never expired, or an account belonging to a leaver that nobody closed. All three are access management.
- Access built from roles, not from copying whoever seemed similar
- Sensitive matters restricted to the team on them, and reviewed as teams change
- External sharing scoped and time-limited rather than open-ended
- Leavers removed from every system the same day, with a record of it
- Access reviewed on a schedule, not only when something goes wrong
- Logging in place, so "who saw this" has an answer
Who can open which matter
example-firm · matter permissions
9Folder permissions
0Beyond the matter team
0Leavers who can still open
Clients ask
People
Matter team
Matter team
No access
Matter team
Matter team
Matter team
No access
Matter team
No access
No access
No access
Matter team
Matter team
No access
No access
No access
No access
No access
No access
No access
No access
No access
No access
No access
No access
No access
Time-limited
No access
No access
No access
“Who can see this file?”
Now the answer is a short, named list. Click any person or matter, or try a client’s question.
Illustration with sample data: fictional people and matters.
The challenge
Security and evidence your clients expect
Law firms, accountants and consultancies hold client information that has to be protected and shown to be protected.
Confidential client data spread across email and devices
Controlled storage, encryption and access based on role and matter.
People keeping access after changing role or leaving
Joiner, mover and leaver processes with regular access reviews.
Client and insurer security questionnaires
Clear documentation of the controls in place, ready to share.
Phishing aimed at finance and partners
Email security, MFA and practical awareness training.
How we work
Establish, secure, evidence, maintain.
-
Establish
What information you hold, where it sits, and who can currently reach it. The last of those is usually the surprise.
-
Secure
Identity, device, mail and document controls put in place in a planned order, without interrupting client work.
-
Evidence
Documentation of what is in place, ready for client due diligence and insurance renewal.
-
Maintain
Access reviews, patching, monitoring and backup testing as an ongoing service rather than an annual scramble.
Why CaminhoIT
Discreet, documented, and used to confidentiality.
We work with firms that cannot discuss their clients with us, and we do not need them to. Our access is scoped to what support genuinely requires, our actions are logged, and we are comfortable signing whatever confidentiality terms your practice requires.
- Scoped accessonly what support needs
- Everything loggedincluding what we do
- NDAs and DPAssigned as a matter of course
- EU and UK datalocations confirmed
- Portal visibilitytickets, changes, requests
- A named contactwho knows your firm
Questions
Questions from professional firms
Will your engineers be able to read our client files?
Administrative access to a Microsoft 365 tenant does, technically, make it possible to reach content — that is true of any provider, and anyone claiming otherwise is being imprecise. What matters is how it is controlled: our access is scoped to what support requires, privileged actions are logged and auditable, our staff are bound by confidentiality obligations, and we will sign your NDA and data processing agreement. If your practice requires stricter arrangements, such as break-glass procedures for privileged access, we can implement those too.
A client has sent us a security questionnaire. Can you help?
Yes, and this is now routine — particularly for firms acting for larger corporates or regulated clients. We can answer the technical sections accurately, identify anything you cannot currently evidence, and put those controls in place. What we will not do is help you answer a question in a way that is not true; the value of the exercise depends on it being reliable.
Does this make us GDPR compliant?
No. GDPR compliance is an organisational obligation covering lawful basis, policy, governance and legal interpretation as well as technology. What we provide is the technical measures underneath it — access control, encryption, logging, retention, backup and incident handling — designed and operated in line with GDPR requirements, with documentation you can point to. The rest needs your data protection adviser.
We use a practice management system. Do you support it?
We support the identity, devices, connectivity and integrations it depends on, and we liaise directly with its vendor over anything in between. Specialist practice and case management systems stay with their own vendor, which is where the expertise sits — but a good proportion of reported problems with them turn out to be sign-in, browser or network issues, which are ours.
Where would our data be stored?
In EU or UK data centres, selected to suit where you operate and any professional obligations you have about data location. We confirm the specific regions for your tenant and your backup service and record them in your documentation, so it is a fact you can cite rather than an assumption.
Our insurer is asking about cyber controls. Is that normal now?
Entirely. Cyber insurance for professional firms increasingly depends on evidencing specific controls — MFA, endpoint protection, tested backups, patching and incident response are the ones that come up most. We can help you demonstrate what is in place and close the gaps that would otherwise affect cover or premium.
Want to know what a client questionnaire would find? Run the IT Health Check →
Ready to get started?
Be able to answer the question.
When a client, an insurer or a regulator asks how you protect their information, the answer should be short, specific and evidenced. We will help you get there.