Protecting PCLaw Trust Accounting Data

Why trust accounting data needs a distinct security posture

Trust accounting records inside PCLaw represent client funds the firm holds in a fiduciary capacity, which raises the stakes for both accuracy and security well above general business data. An infrastructure failure or security incident touching trust records is a materially more serious event than the same failure touching general correspondence.

Access control fundamentals

Limiting who can access trust accounting functions inside PCLaw, and ensuring each person has their own individual login rather than a shared account, is a foundational control that supports both security and accountability.

• Individual user accounts for every staff member, never shared logins
• Permissions scoped so only staff with a genuine need can access trust accounting functions
• Prompt removal of access when staff leave the firm or change roles
• Multi-factor authentication on any remote access to the server hosting PCLaw

Audit trails

PCLaw's own transaction logging supports internal review of trust activity, and this is complemented by infrastructure-level logging of who accessed the server and when. Individual logins are what make this kind of audit trail meaningful, since activity tied to a shared account cannot be attributed to a specific person.

Backup immutability for trust records

Backup copies of trust accounting data should be protected from being altered or deleted using the same credentials that access the live system. If an account is compromised, whether through phishing or another attack, immutable or access-separated backups ensure the firm still has a clean, unaltered copy of trust records to restore from.

This builds directly on the broader backup practices described in our guide to backing up Primafact case files properly, since the same immutability principle applies to any financial or case record a firm cannot afford to lose or have tampered with.

General record-keeping considerations

The Law Society of Ontario sets expectations around trust accounting record-keeping for Ontario lawyers, and firms should confirm their specific obligations directly with the Law Society or their own legal and accounting advisors. From a pure infrastructure standpoint, what a managed IT provider can support is ensuring records remain available, backed up, and access-controlled for as long as the firm determines it needs to retain them. This article does not provide legal advice and makes no claim about compliance with any specific regulatory requirement.

Cybersecurity practices that support trust accounting protection

1. Enforce multi-factor authentication for all remote and administrative access to the PCLaw server.
2. Keep the server and workstations patched and running supported operating systems.
3. Monitor for unusual login activity or after-hours access to the server hosting PCLaw.
4. Maintain immutable, tested backups separate from daily operational credentials.
5. Review user access permissions on a regular schedule, especially after staff changes.

Sources and further reading

• Law Society of Ontario: Bookkeeping guide

Frequently asked questions