Encryption protects a document's contents, but access to the key determines whether it can be read.
In Bezpieczna Kancelaria, protecting stored original documents does not end with the account password.
Advocates and attorneys-at-law are required to protect information covered by professional secrecy.
Naczelna Rada Adwokacka recommends additional encryption of cloud data so that the provider cannot access its contents.
Clients entrust lawyers with documents they would often not show even to those closest to them. Medical records, private messages, financial information and evidence in a criminal case. They expect the law firm to protect their confidentiality even when it chooses electronic case files instead of a paper folder.
When choosing law firm software, it is worth asking: who other than authorized people at the law firm can read the stored documents?
At Bezpieczna Kancelaria, zero knowledge refers to the protection of stored original documents. What specifically protects the stored case files? Files are encrypted, and the platform operator, meaning its technical administrator, does not hold its own permanent key for decrypting them. Access to the database or encrypted file storage alone is not enough to open the documents.
What does zero knowledge mean?
For file storage services, zero knowledge means a model in which the provider has no technical means of decrypting the user's data. Decryption keys remain under the user's control, while the provider stores encrypted files. This protection model is described by Proton, among others.
This is a broader claim than protection against the theft of a database copy. Verifying it requires reviewing the entire document processing and key management model, not just file storage.
The easiest way to understand this is to imagine an external archive. You entrust it with a filing cabinet. The company secures the building, keeps everything in order and makes sure the cabinet does not go missing. But whether it also has a key to the cabinet is a separate matter.
If it has a spare key, it can open the cabinet. Policies, contracts and procedures determine when it is allowed to do so. If it has no key, simply entering the archive is not enough to read the documents.
For digital case files, encryption serves as the lock and key. It ensures that a copied file remains unreadable to anyone without the right key.
Why is the software password not enough?
A password is used to log in to an account. The software verifies it and decides whether to show the documents to the user. This does not mean that the files themselves are encrypted or that a server administrator cannot read them another way.
Internet connection security works in a similar way. Transmission encryption protects data as it travels between the computer and the server. However, it does not answer who can read a document after it has been saved.
Even the statement “data is encrypted” needs clarification. If the provider also holds the key needed to decrypt the data, it still has a technical means of accessing its contents. Protecting case files therefore requires checking both how they are encrypted and who controls the keys.
What happens without this protection?
Imagine that someone obtains a copy of the law firm's document storage. If it contains ordinary, readable files, they can open agreements, legal opinions and scanned correspondence. The password to the law firm's dashboard will not help because the attacker is using a copy, not the dashboard.
If the files are encrypted, another detail matters: can the keys needed to read them be obtained as well? Separating the keys from the stored data limits the impact of such theft. A copy of the archive alone is then not enough to access the contents of the case files.
The same question applies to the provider. If it has its own key to the documents, preventing unauthorized use also depends on the security of administrative accounts, staff permissions and compliance with procedures. This does not mean that anyone is reading the documents. It means that this possibility must be controlled.
For a law firm, what is at stake is the confidentiality of specific information: the client's negotiating position, evidence, private correspondence or planned defense strategy.
How does Bezpieczna Kancelaria protect stored case files?
In Bezpieczna Kancelaria, each version of a document is encrypted with a separate key. Each law firm has its own set of keys, so one organization's key cannot open another organization's documents.
The keys needed to read original files are not stored alongside them in a form that the operator could simply download and use. Persistent copies of the keys are also encrypted. The operator does not hold its own permanent key to the law firm's archive.
This provides specific protection for stored original documents: reading the database or copying the encrypted file storage does not open the case files.
We also separate account recovery from encrypted document recovery. Resetting account access alone does not replace the keys. The document recovery mechanism uses a recovery phrase held by the law firm. This is a set of words generated during registration. The system then asks the user to save it.
This prevents technical support from opening the entire archive simply by changing the password.
Protecting case files is a lawyer's duty
Professional secrecy also covers documents stored on a computer and in the law firm's system. Moving case files to the cloud does not release an advocate or attorney-at-law from the obligation to protect them. This follows from statutory provisions and professional rules.
Legal basis - Practical obligation
- Art. 6 ust. 1 Prawa o adwokaturze and art. 3 ust. 3 ustawy o radcach prawnych: Keep confidential information obtained in connection with providing legal assistance. Prawo o adwokaturze, ustawa o radcach prawnych.
- § 19 ust. 1-6 Kodeksu Etyki Adwokackiej: Protect information from disclosure, secure electronic data, require staff to maintain confidentiality and transmit information with care. Kodeks Etyki Adwokackiej.
- Art. 23 Kodeksu Etyki Radcy Prawnego and §§ 3-5 Regulaminu wykonywania zawodu: Select safeguards appropriate to the risk, protect documents against loss and alteration, and control access to them. Kodeks i regulamin.
- Art. 25 and 32 RODO: Build data protection into processing operations, select safeguards appropriate to the risk and verify their effectiveness. Encryption is one of the measures specified. RODO.
- Art. 28 RODO: Entrust processing to a provider offering appropriate guarantees and govern it by contract. RODO.
The law firm owner should therefore determine how the chosen service protects documents and who can access them. A general security claim is no substitute for assessing the provider. UODO has already highlighted the responsibility of both the data controller and its service provider when appropriate safeguards and verification of the processor were lacking. UODO position of 27 July 2026
NRA recommends encryption that also protects against provider access
In the second edition of “Dobre praktyki dotyczące cyberbezpieczeństwa w działalności kancelarii adwokackich i pracy adwokata”, the Naczelna Rada Adwokacka recommends applying additional, independent encryption to data transmitted to and stored in the cloud. It explains the purpose as follows:
“to prevent the provider from accessing the contents of the data”
The recommendation can be found on page 36 of the publication, which is page 42 of the PDF file. On page 45 of the publication, the NRA also advises against processing data covered by defense counsel privilege in online services without additional encryption that prevents the provider from reading it. Dobre praktyki NRA, second edition, pp. 36 and 45
These are recommendations from a professional body, not a statutory requirement to purchase a system using a specifically named technology. They do, however, show why it is reasonable to ask whether the provider can read the data when protecting attorney-client privilege.
Why do we communicate zero knowledge explicitly?
We compared selected public security descriptions of competing law firm systems. We did not find the term “zero knowledge” in the materials reviewed on September 13, 2026.
Of the systems compared, we are the only provider that explicitly communicates zero knowledge for stored original documents. This conclusion relates to how protection is described in the materials reviewed.
One competitor states that it encrypts data in transit and at rest. It separately describes end-to-end encryption for data defined as the most sensitive and states that such data is inaccessible to its staff. User passwords are given as an example of data protected end-to-end. However, the provider does not define the full scope of this category or clearly state that it includes the contents of a law firm's documents and attachments. This description therefore does not confirm that the provider cannot read the case files.
Information about using AWS or encrypting the connection also does not establish who controls the document keys. Assessing the protection of case files requires a specific answer: which files are protected and who can decrypt them.
At Bezpieczna Kancelaria, we describe the specific mechanism used to protect stored case files. This allows lawyers to ask how documents are encrypted and how keys are managed, rather than settling for a general assurance of security.
What should you ask before entrusting case files to a system?
It is worth starting the conversation with the provider by asking a few questions:
- Are all documents and their backups encrypted, or only the connection to the software?
- Who holds the keys needed to read the stored files?
- Is administrator access to the database enough to read the contents of the case files?
- What materials does the stated protection cover: entire documents, selected data, or only passwords?
- Does account recovery by technical support also allow them to open documents?
The answers help assess what actually protects the confidentiality of case files. When choosing law firm management software, a lawyer also chooses how information entrusted to them by clients will be stored.
Sources for the answer to “Does Polish law require zero knowledge?”: RODO, Art. 32, NRA recommendations.