For law firms and solicitors
Custodiance runs your firm's web and email estate as a managed service: your data stored in UK and EU regions, built to the standard your SRA obligations require, and run by a named senior engineer you deal with directly. Your confidentiality duty does not stop at the matter file; neither does the way we run your infrastructure.
The risk
A typical independent solicitor's site was built three or four years ago on whichever SaaS stack carried a reseller discount: a US host, a US enquiry form, a US newsletter tool, a "secure" document-upload widget pointing at a US bucket. The site works and enquiries arrive. It also quietly fails the obligations the firm, not the agency, is accountable for. Four are worth naming precisely.
The SRA Code of Conduct for Firms, Rule 6.3, owes an unqualified duty of confidentiality to every client, current and former. That duty extends to every piece of personal data the firm holds, including the enquiry that arrived through the website before the person became a client. A US-resident enquiry inbox or document-upload bucket exposes that data to lawful third-party access the firm cannot defend.
Principle 2 (integrity) and Principle 7 (acting in each client's best interests) are unqualified duties read alongside Rule 6. They do not turn off because a sub-processor was convenient or because the agency built the form that way. An estate the firm cannot account for is difficult to square with either principle when a complaint or a PII renewal questionnaire arrives.
A firm offering conveyancing, probate, motoring, immigration, employment-tribunal, debt-recovery, or licensing work to individuals must publish indicative fees, the basis of charge, disbursements, VAT treatment, key stages, timescales, and who does the work, plus a complaints procedure and the firm's SRA number. The SRA reads these against the public website. Most agency-built sites bury them in a PDF or miss clauses entirely.
The firm is the data controller. That means Article 30 records of processing, Article 28 data-processing agreements with every sub-processor, and, under Articles 44 to 49, a lawful transfer mechanism with Standard Contractual Clauses and a written Transfer Risk Assessment for any personal data flowing outside the UK and EU. The agency that wired the enquiry form to a US host almost certainly wrote none of these.
None of these obligations explicitly requires a website hosted in the UK or the EU. Each, however, eventually asks the same question: where does the client data live, who has access, and can the firm prove it? On a typical agency-built site the honest answer is "we do not really know."
How Custodiance answers it
The work that puts a solicitor's site right is not a one-off remediation. It is the work the estate carries continuously, mapped to the SRA obligations a firm is accountable for.
Your web and email infrastructure is run as an estate we hold continuously (audited, monitored, and changed on your behalf), not handed over once and left to decay. Enquiry intake, document upload, the contact list, analytics, and the Transparency Rules pages are kept correct as the regime and your practice evolve.
Hosting is pinned to Vercel's London region in each project's configuration. Enquiry forms post to the estate's own endpoint and are relayed by Scaleway in France to your firm's own mailbox, in your Microsoft 365 or Google Workspace tenant or at Proton in Switzerland, a country the UK and EU recognise as adequate. Where you want analytics, they run on our own Plausible Community Edition server in France, without cookies. Any document-upload flow is scoped with you and named in your sub-processor schedule before it takes a file. The US-incorporated providers that stay in the path, Vercel for hosting, GitHub for the source code and Cloudflare for DNS, are named in the published sub-processor list as exceptions. When a client, an insurer, or the SRA asks where the data lives and who can reach it, the answer is written down, not assumed.
The standard each estate is built to is written down and applied consistently, so the way your firm is built is the way the next one is: auditable, repeatable, and defensible rather than improvised per project. The posture is set out in the Custodiance framework.
One senior technical partner runs your estate: a name and a direct line, not a ticket queue. That engineer understands your SRA obligations and does the work between requests.
Read the evidence
Two briefings work through the specifics (the confidentiality posture and the Transparency Rules implementation) clause by clause, with the regulatory text quoted and sourced.
The SRA Confidentiality Trifecta (Rule 6.3, Principles 2 and 7, and UK GDPR Articles 28 and 44 to 49) and the four specific failures on a typical solicitor's site: US-resident enquiry forms, document upload (the highest risk for conveyancing AML), email tools holding matter-type tags, and practice-management widgets such as Calendly and DocuSign. What a regulated-grade estate puts in their place.
Read the briefing →The Transparency Rules are read against the public website, not the firm's internal records. A rule-by-rule implementation checklist for Rules 1 to 6 plus the Code of Conduct Rule 7.1 publicity duty: price pages, complaints publication, the SRA number and register link, the digital badge, prominence, and the not-misleading duty on fee-earner profiles, each with the markup that satisfies it.
Read the briefing →Engage
Quoted per practice After a scoping call, confirmed in writing
For an established practice that wants its web and email estate run properly, in UK and EU regions, by a named technical partner.
Custody, not marketing.
A scoping call is a measured conversation about your obligations, your current setup, and what it would take to run it properly. Each of the SRA arms above is reviewed against your live site and marked pass, partial, or fail, with the specific remediation for each. No obligation, and no pressure.