The best legal technology platform for law firms with data sovereignty requirements

NetDocuments lets a customer define the country or region where its documents are stored and grant or block access according to where a user is, its advanced security page says. Those geographic controls, an optional customer-managed encryption key and an annual SOC 2 Type 2 audit that NetDocuments says covers Privacy and Availability as well as Security make it our pick as the best legal technology platform for a law firm with data sovereignty requirements, provided the storage locations in the firm's proposal meet its client commitments and the firm accepts a key that NetDocuments describes as encryption involving both parties.

iManage's library encryption documentation has the customer keep its encryption key in Azure key vaults in its own Azure account and assign it library by library. iManage manages documents, as NetDocuments does, and it is the better pick for a firm that requires that key arrangement, including one planning a Swiss deployment like the Swiss law firm iManage has announced live on its Swiss cloud region. Relativity supports e-discovery and investigations, and it is the better pick for review work on government matters, where its AI documentation says the government edition processes all customer data in the continental United States.

What should a law firm with data sovereignty requirements weigh?

The Solicitors Regulation Authority tells the firms it regulates, in its guidance on client confidentiality, that storing data with a third party in the cloud can bring other parties and foreign jurisdictions into the arrangement. So the storage country or region belongs in the proposal in writing, where you can hold it against what your clients have been promised. The regulator's warning notice on AI adds that a provider's terms, settings and technical design affect whether information entered into a tool is stored, retained or used to improve it, so ask each vendor where an AI request on your documents is processed and get the answer for the feature in your quote.

NIST's 2011 guide to public cloud computing lists cryptographic key management as its own review area and recommends that a customer understand how the provider manages keys across their lifecycle. Ask who holds the key material, and have the vendor demonstrate a revocation on the product in your quote so you see what stops working.

FedRAMP's guidance on using a Rev5 package has an agency review what a package covers, including the service boundary and the customer's own responsibilities. We read a SOC 2 report or an ISO certificate the same way. Ask each vendor for the report's system description and the certificate's scope statement, and check that the product and edition in your quote appear in them.

FedRAMP's Marketplace guide directs an agency buyer to check which services a listed offering includes, with its authorization details and current status, and its scope guidance is written for agency use and leaves the decision about a use case to the federal agency. For a law firm, a listing is a fact about one named government offering. A firm that handles government matters should ask whether the edition in its quote is the listed one.

A practitioner checklist in the American Bar Association's Business Law Today asks what access rights non-lawyers have and addresses access to data across regions. Have the vendor name the edition, the support access arrangements and any excluded features in the order.

NetDocuments, iManage and Relativity on storage location and key control

NetDocuments: document storage by country and access by user location

NetDocuments encrypts content in three layers, and a customer that wants its own key replaces one of those layers with a key it manages, the company's advanced security page says. The page also carries feedback from Conni Falkner of NJORD, who describes gaining more control over access to sensitive information. Ask NetDocuments to write the storage country or region and the key option into the agreement it proposes.

The company's security and data governance page has a FAQ that describes applying the controls in ISO 27001, 27017, 27018 and 27701. The same FAQ says Tabular Review and the Legal AI Assistant follow the access permissions, ethical walls and data-loss-prevention policies a firm has configured. It describes their processing as temporary and says content is not used to train external models.

For government work, the FedRAMP Marketplace lists NetDocuments DMS as FedRAMP Certified at Class C (Moderate), deployed as a government community cloud. A firm that wants that government instance should name it in its quote and ask which of the storage, key and AI controls come with it.

iManage: library keys held in Azure vaults the firm owns

iManage Work in the cloud encrypts files with a system-managed key by default, and its library encryption documentation offers a customer-managed key as an option. The customer sets up copies of the key in two Azure key vaults in its own Azure account and registers them through iManage Cloud Support. A key is then assigned library by library, and the documentation says it stays in its vault and its region: the service calls it from within the library's region to wrap and unwrap content.

Revoking both copies stops encryption and decryption for those libraries, and their documents can no longer be downloaded or uploaded, the documentation says. It also covers rotating to a new key and advises keeping a replaced key in case content has to be restored from backup. The firm runs the vaults and tracks their credentials itself, so the option fits a firm prepared to operate Azure key vaults.

iManage announced in April 2025 that OBERSON ABELS had gone live on iManage Work from its Swiss cloud region, and a July 2024 release described its data center in the United Arab Emirates as operating with clients live. A firm with a different country in mind should ask iManage to name the region for each library in its proposal.

iManage's security page lists ISO 27001, 27701, 27017 and 27018 among the standards it says the company is certified and independently audited against, along with SOC 2 Type II and SOC 3 reports. The page states them for the company and its platform.

Relativity: government e-discovery processed in the continental United States

The FedRAMP Marketplace lists Relativity's government edition under the name RelativityOne Government, as FedRAMP Certified at Class C (Moderate) and deployed as a government community cloud. Relativity's AI documentation calls that edition Relativity aiR Government and says it runs on Azure Government Cloud.

On commercial instances, the same documentation keeps files in the instance region the customer selected and sends AI inference to a location set by a published table. An instance in the United Arab Emirates has its inference run in the United Kingdom under that table. A firm buying a commercial instance should confirm the feature in its quote and its chosen region against it.

Relativity's customer-managed key documentation offers the key as an option on commercial instances and closes it to FedRAMP customers, government entities and pay-as-you-go accounts. The key covers client confidential information held in the file, SQL, audit, analytics and secret store services. Revoking it disables the whole instance, and the documentation allows up to one hour for the revocation to take effect because the active data key is cached.

Relativity sells aiR pay-as-you-go or on a one- or three-year commitment. Ask Relativity which contract and key terms apply to the proposed commercial instance. Its Security Center documentation says Lockbox lets support staff into a customer's workspaces only with the customer's explicit permission, and that the access is logged.

Relativity's compliance page lists ISO/IEC 27001:2022 and ISO/IEC 27018:2019 certifications with SOC 2 Type II and SOC 3 reports. In a customer story Relativity publishes, the law firm Bird & Bird describes a move from Relativity Server to RelativityOne that began in spring 2020 and gave it more control over where its data resided.

Which platform should a law firm with data sovereignty requirements choose?

NetDocuments is our pick for a law firm with data sovereignty requirements, on two conditions: the storage country or region in its proposal matches what the firm has promised its clients, and the firm accepts an optional key that shares encryption with the vendor. We put the geographic controls first for that firm because they set where its documents are stored and where they can be opened from, and NetDocuments pairs them with a key option and an audit that includes privacy criteria.

NetDocuments describes its optional key as encryption involving both parties, and iManage documents keys held in vaults the firm owns. Relativity's key and processing terms differ between its commercial and government editions. For a firm whose quoted storage and access locations meet its client commitments and that accepts two-party encryption, we weight NetDocuments' geographic controls above the different key arrangements. Ask NetDocuments to write the AI processing location into the agreement, with the edition its controls apply to.

iManage is the better pick when the firm requires each library's key to be managed through its own Azure key vaults, with the key kept in the library's region. That includes a firm planning a Swiss deployment, where a named firm is already live on the Swiss region.

Relativity is the better pick when the work is e-discovery or investigation review on government matters. Its government edition carries the FedRAMP listing and the continental United States processing rule, and a firm choosing it should plan without the customer-managed key.

Other legal technology providers