Every divorce case you handle is a vault of the most sensitive data a person owns. Bank statements. Tax returns. Account numbers. Business records. Now ask yourself a harder question: where does all of that actually live once you upload it to a tool?

For most legal software, the answer is a vendor's cloud server, sitting next to the data of thousands of other clients. That design is convenient. It is also exactly what attackers want. One in five law firms reported a cyberattack in the past year, and among firms that were breached, 56% lost confidential client data. The average breach now costs north of $5 million, and only about a third of firms have an incident response plan ready when it happens.

This article is about the part of the sales demo nobody shows you: the architecture underneath. Cloud versus local. What leaves your device and what stays. How a file proves it has not been altered. For a family law practice, those details decide whether your tools help you meet your duties or quietly expose you.

Security is now an ethical duty, not a preference

The rules already caught up to this. ABA Model Rule 1.6(c) requires lawyers to make reasonable efforts to prevent the unauthorized disclosure of client information. Rule 1.1 carries a duty of technology competence, and most states have adopted it. The ABA has issued formal guidance on cloud computing and on generative AI, and the message is consistent: these tools are permitted, but only with real due diligence on the provider and security measures proportionate to how sensitive the data is.

Financial records in a divorce are about as sensitive as it gets. So the bar is high. When you pick a tool, you are making a representation about reasonable care. If the tool funnels client data into a place you do not control and cannot audit, that representation gets harder to defend.

Cloud convenience comes with a concentrated target

A cloud tool pools everyone's data in one place. That is what makes it easy to use from any browser. It is also what makes it a high-value target. Attackers know a single breach of a legal platform can expose hundreds of firms and thousands of clients at once. Threat actors now sit inside firm networks for weeks, quietly mapping the most valuable files before they strike.

Local-first design flips the model. The working case data lives on your device, not in a central vault. There is no single database holding every client's financial life, so there is no honeypot to crack. An attacker who wanted your data would have to target you specifically, and there is no master server that exposes everyone else if they succeed.

Know exactly what leaves the device

Local-first does not mean nothing ever moves. Honesty matters here, because vague privacy claims fall apart under scrutiny, and a judge or opposing counsel will scrutinize them. The accurate picture is specific: the case dataset stays put, and only narrow, named pieces leave when a feature requires it.

In Thrive Financial, the full case record lives in your browser's local storage. Parsed statements, the asset and debt inventory, fraud findings, settlement work, and the audit log never sit in a Thrive-hosted case database. What does cross the network is limited and disclosed: selected document text goes to Google's AI service only when you run an AI parse or analysis, authentication and billing metadata flow through Firebase, and payments run through Stripe. That is the whole map. No hidden copy of the case file on a server you cannot see.

This precision is a feature, not a hedge. You can tell a client, in plain terms, that their complete financial file is not sitting on a third-party server. When you use an AI feature, you can disclose exactly what gets sent and get informed consent, which is the standard the ABA's AI guidance points to.

Proving a file has not been touched

Security is half the story. The other half is integrity. In a contested case, opposing counsel will ask whether the document you analyzed is the real one and whether anything changed along the way. This is where cryptographic hashing earns its keep.

A SHA-256 hash is a digital fingerprint. Run any file through it and you get a fixed string of characters. Change a single byte and the string changes completely. Thrive Financial hashes each original document when it is processed and stores that fingerprint with the parsed data. It also seals every exported case file with its own hash. If the file is altered later, the fingerprints no longer match, and the tool refuses to load it.

A checklist for vetting any legal tool

Use this when you evaluate any platform that touches client financial data. The answers should be specific, not marketing.

• Where does the case data live? On a vendor server, on your device, or both. Get the exact answer.
• What exactly leaves, and when? A precise data map, not "we take security seriously."
• Can you prove a document is unaltered? Look for cryptographic hashing and preserved originals.
• Is there an audit trail? Timestamped logs of who did what, exportable for the file.
• Who can access the data, and can you delete it? You should control export and deletion.
• What happens in a breach? If there is no central store of your cases, the blast radius is smaller by design.

Risk	Typical cloud tool	Local-first design
Central honeypot of client data	Yes, all cases on one server	No central case database
You control when data leaves	Limited	Yes, you export deliberately
Tamper-evident originals	Varies	SHA-256 hash + preserved file
Breach blast radius	Every client at once	One device at most

Frequently asked questions

Further reading and helpful resources

• ABA Model Rules of Professional Conduct. The full text, including Rule 1.1 competence and Rule 1.6 confidentiality.
• FTC Safeguards Rule. Federal requirements for protecting customer financial information.
• ABA: Why Family Law Needs AI. Context on the tech shift driving these security questions.
• Thrive Financial: AI and Divorce Finances. How the analysis works once your data is secure.

Thrive Financial is a financial-analysis and case-organization tool, not a law firm or a substitute for licensed professional or security advice. This article describes the product's current architecture and general legal-ethics principles. It is not legal advice. Attorneys remain responsible for client confidentiality, informed consent, and lawful access to uploaded documents. Sources: ABA Model Rules of Professional Conduct and related formal opinions on cloud computing and generative AI. Law firm cybersecurity reporting (2025), including industry breach surveys cited by the ABA, FindLaw, and Embroker. FTC Safeguards Rule guidance.