Zero Network, Zero Breach: The Architecture of Privacy-First Case Management
Every cloud service operates an attack surface that stretches from the vendor's API endpoints through its database servers to its infrastructure providers. On-device architecture eliminates every mile of that surface. Zero network access means zero breach surface for client data.
In 2025, the average cost of a data breach reached $4.88 million globally, according to IBM's annual Cost of a Data Breach Report. For law firms, the cost is not merely financial — a data breach that exposes client confidences can result in malpractice liability, bar discipline, loss of client trust, and in extreme cases, disqualification from ongoing litigation. The legal industry's data is among the most sensitive in any sector, yet the standard practice management technology stack introduces vulnerabilities that would be unacceptable in healthcare or finance.
The root cause is architectural. Any cloud-based case management platform — regardless of how well it is built, how thoroughly it is audited, or how many certifications it holds — operates an attack surface that includes API endpoints, authentication systems, database servers, cloud infrastructure accounts, employee endpoints, and third-party integrations. Every one of these components has been exploited in real-world breaches. The question is not whether a particular cloud platform will be breached, but whether its security measures will be sufficient until the next attack method evolves.
The Attack Surface of a Cloud Case Management Platform
Consider the components that a typical cloud case management platform must maintain and secure:
- API endpoints: HTTP(S) endpoints that the mobile app, web app, and third-party integrations use to read and write case data. Each endpoint is a potential entry point for injection attacks, authentication bypass, or data exfiltration. The 2024 Sysdig Cloud-Native Security Report found that the average cloud application has over 200 API endpoints, each representing a potential vulnerability.
- Authentication infrastructure: User account databases, session management systems, OAuth providers, and password recovery flows. Compromised credentials are the leading cause of data breaches — Verizon's 2024 Data Breach Investigations Report found that 68% of breaches involved a human element, including credential theft and social engineering.
- Database servers: The servers that store case data at rest. Whether managed by the platform vendor or by a cloud provider like AWS RDS or Azure SQL, these databases must be patched, access-controlled, and monitored. Misconfigured databases — left exposed to the public internet without authentication — have been responsible for some of the largest data breaches in history.
- Infrastructure providers: The cloud providers (AWS, Azure, Google Cloud) that host the platform's servers. A compromise at the infrastructure layer — through a misconfigured S3 bucket, a compromised IAM role, or a vulnerability in the hypervisor — can expose data from every customer of the platform simultaneously.
- Employee access: Platform vendor employees with administrative access to production systems. Insider threats, whether malicious or accidental, are a persistent risk. The 2024 Insider Threat Report from Gurucul found that 74% of organizations consider insider attacks more likely than external attacks.
- Third-party integrations: API connections to calendaring, document management, e-filing, and payment processing services. Each integration expands the attack surface and introduces dependencies on the security practices of third-party vendors.
In 2023, the file transfer service GoAnywhere MFT was exploited by the Clop ransomware group, exposing data from dozens of law firms that used the service for document sharing. In 2020, the same group exploited a vulnerability in Accellion FTA — another third-party file transfer tool — to exfiltrate sensitive legal documents from multiple firms. Both breaches exploited third-party infrastructure, not the law firm's own systems. In a cloud-based case management ecosystem, the same third-party supply-chain risk applies: your case data is only as secure as your vendor's vendors.
How On-Device Architecture Eliminates the Surface
An on-device case management application has no API endpoints, no authentication infrastructure, no database servers, no infrastructure provider accounts, and no vendor employees with system access. The application's attack surface is limited to the device on which it runs. The data store is a SQLite file in the application's sandboxed directory, encrypted by iOS Data Protection at the file system level and accessible only through the app's UI, which is itself gated by device-level authentication.
This is not a matter of implementing better security measures than a cloud platform — it is a fundamentally different architecture where entire categories of attack are structurally impossible. A threat actor cannot exploit an API endpoint that does not exist. They cannot steal credentials for an authentication system that has no accounts. They cannot breach a database server when the database is a local file on a device that is sitting in the attorney's pocket.
The security advantages of on-device architecture are not theoretical, and they do not depend on perfect implementation. Even if an on-device application has a software vulnerability — every application does — the blast radius is limited to a single device and the data it contains. A vulnerability in a cloud application can expose data from every customer simultaneously, as we have seen in countless supply-chain and infrastructure-level breaches.
The Backup Question
The most common objection to on-device case management is the backup question: what happens if the device is lost, stolen, or damaged? This is a legitimate concern, and it has a straightforward solution that does not compromise the privacy architecture.
iOS device backups — whether encrypted local backups via a computer or encrypted iCloud backups — protect case data with the same encryption that protects the live data on the device. An encrypted iOS backup encrypts all app data, including the SwiftData store, using the device passcode. Apple cannot read encrypted backups, and the backup is protected by the same hardware-backed encryption as the device itself.
The key distinction is that backup encryption is user-controlled. The attorney chooses whether to enable encrypted backups, sets the backup password, and manages the backup destination. No third party has access to the backup data, and the attorney is not reliant on a vendor's backup practices — they control their own data redundancy.
Cloud platform: Attack surface includes API endpoints (hundreds), authentication infrastructure (user database, session management, OAuth), database servers (production, replica, backup), cloud infrastructure (AWS/Azure/GCP accounts), vendor employee endpoints, and third-party integration APIs. A compromise at any layer can expose all customers' data.
On-device (e.g., Docketloom): Attack surface is limited to the device itself. No network endpoints. No accounts. No databases. No infrastructure accounts. No vendor employees with access. No integrations. A compromise can only affect data on a single device.
Why This Matters for Solo Practitioners
For solo practitioners and small firms, the security calculus is particularly stark. Large firms have dedicated IT security teams, incident response plans, cyber insurance, and the resources to vet vendor security practices. Solo attorneys typically have none of these. Choosing an on-device case management tool is not just a privacy preference — it is a risk management decision that eliminates an entire class of security vulnerabilities that the attorney would otherwise have to monitor, evaluate, and insure against.
When your case management tool has zero network access, zero accounts, and zero server infrastructure, the threat models that keep CISOs awake at night — API exploitation, credential theft, cloud misconfiguration, supply-chain compromise — simply do not apply to your case data. The data is on your device, and it is protected by the same security that protects your phone. For a solo practitioner, that architectural simplicity is a meaningful reduction in professional risk.
This content is legal information, not legal advice. It does not create an attorney-client relationship and cannot substitute for consultation with a licensed attorney about your specific circumstances.