Trust & Professional Standards
Security is not a product we sell; it is the discipline we practice. The pages below describe what we actually run — ours and yours — in terms you can put in front of a client.
Our Security Posture
A law firm evaluating an IT provider is really asking two questions: what protects my matter files, and how would you know if something went wrong? Those are the questions this page answers.
We describe controls rather than credentials, because a control is what actually stands between a client’s data and an intruder, and because a control can be demonstrated on request.
We run our own shop on the same stack
DP3’s own endpoints sit inside the same managed detection and response platform, under the same monitoring and the same escalation path, as the client environments we manage. There is no separate, lighter internal standard. Ask and we will show you.
Zero trust, internally
We operate on a verify-explicitly model. Access is granted least-privilege rather than by default, and audited rather than assumed — an engineer’s access to your environment is scoped to the work, not standing and permanent.
Detection, not just prevention
Managed endpoints run continuous detection and response, reviewed around the clock by a third-party security operations team staffed with human analysts — not alerting that waits for someone to check a console on Monday.
Evidence, when it matters most
Telemetry from managed environments feeds centralized log collection. If you ever have to tell a client what happened, on which machine, and when, the answer should be evidenced rather than reconstructed from memory.
Why Detection Is the Part That Gets Overlooked
Most security conversations focus on prevention, which is the easier half. The ABA’s Formal Opinion 483 contemplates an ethical violation where lawyers fail to employ reasonable efforts to avoid data loss or to detect a cyber-intrusion — and it obliges a firm to notify clients of a breach in sufficient detail to keep them reasonably informed.
Those two duties combine into a technical requirement that is easy to miss: you cannot notify a client about a breach you never detected, and you cannot describe it in sufficient detail without records of what happened. A firm can have strong preventive controls, satisfy Rule 1.6(c), and still be unable to answer the only question that matters afterwards.
We wrote about those obligations in detail in ABA Data Security Obligations, and about how to evaluate a provider in how to choose an MSP.
Compliance & Documentation
Your clients send you security questionnaires. When the answers depend on us, we answer them — directly, in writing, and about the environment we actually run.
Send security questionnaires, insurance applications, and client due-diligence requests to our Service Desk and your Account Manager.
We would rather tell you plainly what we do and do not have than leave you to discover it during a client’s diligence. If a question touches something we cannot evidence, we will say so.
Does DP3 run the same controls internally that it deploys for us?
Yes. Our own endpoints are monitored by the same platform, under the same escalation path, as the environments we manage for clients.