Attorneys spend their days marking up other people’s contracts, then sign IT agreements that would never survive their own redline. The document governing access to every client file, every privileged communication, and every deadline-critical system in the firm deserves at least the scrutiny you bill for. Here is what to demand before signing with any provider, ours included.
One caveat up front, and you already know it: this is practical guidance from an IT provider that supports law firms, not legal advice.
Does the agreement define scope, or just gesture at it?
You would never let a client sign a services agreement where the services are “support.” Yet that is what most managed IT proposals amount to. The agreement should enumerate what the monthly rate covers:
- Which people, including of counsel, contract attorneys, and remote staff
- Which devices, and law firms should count carefully here, because attorneys often run a desktop plus a laptop that travels to court
- Servers and hosted systems, named
- Email tenants and mailboxes
- Network equipment, firewalls, and the office’s connection to the world
- Your practice systems, in the sense that matters: the servers and workstations they run on, the backups behind them, and coordination with their vendors when a problem sits inside the application
That last point deserves precision. No IT provider operates your case management or document system the way your paralegals do, and one who claims to should worry you. What the contract can and should commit to is the environment those applications depend on, and direct vendor coordination so your staff never plays telephone between a help desk and a software company while a filing waits.
Ambiguity in a contract favors the drafter. The provider drafted this one.
What response can you actually enforce?
“We’re very responsive” is puffery, and you would strike it from any agreement a client brought you. The document should state:
- Support hours, and what happens outside them
- How your people reach a human, not just a ticket portal
- How priorities are assigned, and where “the document system is down and our response is due at five” ranks
- A stated response expectation for each priority level
- The escalation path when the first response doesn’t resolve it
Be realistic about what you are asking for. Honest providers commit to response expectations and measured typicals rather than guaranteed fix times, because nobody can guarantee when a hardware failure resolves. What you should refuse to accept is a contract with no numbers at all. As a reference point, Braintek typically answers the phone in about 60 seconds and responds to emailed tickets in roughly 2 hours. Your provider’s numbers can be different. They cannot be absent.
How does the agreement protect client confidences?
Your duty of confidentiality does not pause because a third party administers your systems. The provider’s technicians can read anything on them, which makes the agreement’s confidentiality terms as important as any engagement letter your firm signs. Look for:
- A confidentiality obligation binding the provider and every employee who touches your environment, wherever they sit
- A commitment that firm and client data will not be used or disclosed outside of delivering the service
- Access controls and logging, so you can answer the question “who at the vendor can see our files, and when did they”
- Security on the provider’s own remote access tools, since those tools are a door into every matter you have
Then ask about breach notification. If the provider detects or suspects an incident touching your systems, the agreement should obligate them to tell you within a stated timeframe, describe what they know, and cooperate fully with your investigation, your insurer, and whatever notification duties fall on the firm. Those duties stay with you either way. What you are contracting for is speed and candor when it matters.
Ask any prospective provider where their support staff work and how access is governed. Braintek’s teams are in Houston, DFW, and the Philippines, and every technician operates under the same confidentiality obligations and logged access regardless of location. Whatever answer you get, it belongs in the contract, not in a reassuring email that binds no one.
Which security controls will they implement, and will they prove it?
Two forces now demand documentation from law firms: corporate clients sending outside counsel guidelines and security questionnaires, and cyber insurers whose applications double as audits. When either arrives, “our IT company handles that” is not an answer anyone accepts.
The agreement should name the controls the provider implements and maintains, at minimum MFA, encryption, endpoint protection, email security, patching, and monitoring, and should commit the provider to producing evidence: the reports and documentation showing each control exists and works. That paperwork is what fills out the client questionnaire and the insurance renewal. If supplying it is not a written deliverable, it is a future invoice.
This is one of the places two identically priced quotes quietly diverge, and one of the reasons to compare inclusion lists before rates. Our law firm IT support page describes how we structure these controls for a practice, and our pricing page shows the rate structure they live inside.
What do the backup and data return clauses actually say?
“Backups are included” would not survive your redline as a client’s counsel, and it should not survive as the client. The agreement should specify what is backed up, including email and the data behind your practice systems, how often, how long backups are retained, where copies live outside your office, whether restores are tested, and who is watching when a backup job fails. Check the retention window against your own file retention obligations; a provider’s default of 30 or 90 days may be far shorter than what your policies assume.
Then the clause that matters most on the worst day: data ownership and return. The agreement should state plainly that the firm owns all firm and client data, that administrative credentials and documentation belong to the firm, and that on termination everything comes back, in a stated format, on a stated timeline, at a stated cost, with the provider deleting its copies after handoff. You should leave with everything you arrived with plus everything created since, and the outgoing provider should be obligated to cooperate with the incoming one.
Exit terms are cheapest to negotiate when nobody is leaving. If a provider bristles at discussing them during courtship, believe what that tells you.
When should a firm walk away?
Some findings end the negotiation rather than shape it:
- The provider will not put scope, response expectations, or exclusions in writing
- Data ownership and return terms are missing, vague, or “handled case by case”
- No confidentiality language exists until you request it
- The contract is silent on breach notification
- Auto-renewal with a punishing termination clause and no offboarding commitments
- They will not show you their standard terms until late in the process
That last one is a useful early filter. We publish our client terms at braintek.com/legal so you can read them before the first meeting, which is exactly the posture you would want from anyone holding your clients’ files. Terms shown up front are harder to quietly change later.
Who does this for law firms in Houston and DFW?
Braintek has supported Texas businesses since 2002, with local teams in Houston and DFW. Fully managed support fits firms of roughly 10 to 50 people; larger firms usually do better co-managed, with internal IT handling the day to day while we cover security, projects, and escalations. If your firm is comparing agreements, or suspects the current one would not survive its own review, book a discovery call or send the contract over. We will tell you plainly what is covered, what is missing, and what to demand in writing.