Retention is two opposite duties: keep what you must, delete what you should. S3 Object Lock gives you write-once storage with retention periods and legal holds that even administrators cannot bypass in compliance mode. How the modes work, how a legal hold differs from a retention period, and a design that keeps both duties straight.
Litigation holds, regulatory record-keeping and client deletion requests all apply to the same data. Systems that cannot express "keep this until the hold is released, then delete it on schedule" end up keeping everything, which is its own risk.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Classify records by retention schedule when they are stored, as object tags or metadata, not later.
Use governance mode for most records, so a documented process can correct mistakes; reserve compliance mode for records a regulator requires to be immutable.
Apply legal holds from a case management step, recording who placed them, for which matter, and when. Lifting a hold is the same process in reverse.
Run deletion with lifecycle rules once retention expires and no hold applies, and record what was deleted.
Remember the copies: backups, search indexes, exports and AI indexes must follow the same schedule, or deletion is only partial.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Law Firm Security in 2026: What Clients' Outside Counsel Guidelines Ask For, and How to Answer
Corporate clients increasingly send outside counsel guidelines and security questionnaires before engaging a firm. The requests are predictable: MFA, encryption, incident notification, data return and destruction at matter end, vendor controls. The ethical baseline (Model Rule 1.6(c) and ABA Opinion 483), the common asks, and how mid-sized firms meet them without an enterprise security team.
Read
Generative AI for Law Firms: What ABA Opinion 512 Requires, and a Private Setup That Meets It
ABA Formal Opinion 512 applies existing duties to generative AI: competence, confidentiality, communication, candour and reasonable fees. Informed client consent is needed before putting client information into tools that learn from it, and boilerplate engagement language is not enough. The options for firms, from business chat plans to a private assistant on AWS, and what each means for those duties.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.