Law and accounting firms
Practice management, document and tax software, Microsoft 365, client portals and the mailboxes that move money. Santre documents how each client record is stored and protected so the firm can answer when asked.
A review of email security, backups, data location and insurer controls, with a prioritized fix list.
Overview
Santre provides IT services for law firms and accounting firms across Canada. It secures Microsoft 365 and client file sharing with MFA and email authentication, hosts and patches practice management and tax software, keeps tested backups, and documents where client data is stored. Santre also prepares the evidence cyber insurers ask for and trains staff to spot wire-fraud and phishing attempts. Firms can use Santre as their full IT department or alongside an existing IT lead, and their own counsel confirms regulatory obligations.
Common challenges
Real estate closings, trust transfers and client refunds attract fake payment instructions sent from hijacked or look-alike mailboxes. Santre enforces MFA, publishes SPF, DKIM and DMARC records, flags new forwarding rules, and runs phishing simulations so staff follow the firm's verification checklist on every transfer.
Related services: Cybersecurity, Cloud & Microsoft
Law society guidance asks lawyers to understand and secure the cloud services they use, and the CRA expects tax records to be kept in Canada. Santre inventories each system that holds client data, records where it is stored and who can reach it, and confirms the Microsoft 365 tenant's data location before any migration.
Related services: Cloud & Microsoft, Consulting
A backup only matters if files come back quickly in the middle of a filing deadline. Santre backs up servers and Microsoft 365, keeps immutable and offsite copies, and runs scheduled restore tests with documented results the firm can show to its insurer or law society.
Related services: Backup & Recovery
Brokers report that cyber insurers now question law firms closely about their security controls before they will offer cover. Santre deploys endpoint detection and response and privileged-access management, monitors those controls, separates admin accounts from daily accounts, and assembles the evidence behind each questionnaire answer.
Related services: Cybersecurity, Consulting
Many firms still run practice management or tax software on an office server, and an article in CPABC's newsroom notes some antivirus products make tax and audit applications run slowly. Santre hosts, patches and monitors those servers, tests security settings with tax and audit applications before deadlines, and plans cloud moves when the firm decides to make them.
Related services: Managed IT, Network & Infrastructure, Cloud & Microsoft
The CRA accepts electronic signatures on T183 forms but expects identity verification and delivery to a secure, access-controlled location. Santre configures client portals and Microsoft 365 sharing with access controls, link expiry and audit logs, and can automate routine document requests once the controls are in place.
Related services: Cloud & Microsoft, Cybersecurity, AI & Automation
Canadian requirements
Summaries for orientation, last reviewed . Confirm your obligations with your regulator or counsel.
Frequently asked questions
Law society guidance in several provinces allows cloud services when the lawyer understands and secures them. The LSO guideline, for example, expects firewalls, security software and encryption, and written confirmation of the client's technology choice. Santre documents where each service stores data, configures access and encryption, and gives the firm the information its law society checklist asks for. The firm and its counsel decide whether a service meets their professional obligations.
The CRA requires businesses to keep records in Canada, generally for six years from the end of the last tax year they relate to, and says records held outside Canada and accessed electronically from Canada do not count as kept in Canada. Santre records where each system stores data and confirms the Microsoft 365 tenant's location so the firm can answer that question. Specific situations should be confirmed with the CRA or an adviser.
Santre reduces the chance that a mailbox is taken over and makes fake messages easier to spot. That includes MFA on every account, DMARC enforcement, alerts on new forwarding rules, impersonation protection and phishing simulations built around payment requests. The firm's own call-back verification on every transfer, such as LAWPRO's checklist, remains the final control.
Santre monitors servers and backups continuously and keeps recent, tested copies of client files and application data. Restore times are measured in scheduled tests, so the firm knows in advance how long recovery takes and which systems come back first. Santre also schedules patching, upgrades and hardware replacement around filing deadlines and closing dates so planned work does not land in the busiest weeks.
Yes. Before rollout, Santre reviews who can see which files in Microsoft 365, because AI assistants surface whatever a user already has access to. It then tightens sharing, applies sensitivity labels where needed, and pilots the tool with a small group. Professional obligations around AI use remain the firm's call with guidance from its regulator.
A review of email security, backups, data location and insurer controls, with a prioritized fix list.
