Confidential matters in SimpleLegal are legal matters restricted to users who have been explicitly granted access, so that everyone else, including administrators and power users, cannot see the matter or its invoices in the application or in reports. Onit calls the feature Confidential Matters, and it is the right tool for what many legal departments describe as private matters: internal investigations, executive employment issues, sensitive transactions, and anything the General Counsel wants limited to a handful of named people.
The feature does most of the hard work. Managing it well comes down to deciding which matters qualify, classifying them early, keeping the access list short, and testing that the matter really is invisible to everyone else.
What are confidential matters in SimpleLegal?
Confidential matters in SimpleLegal are matters protected by explicit, user-level permissions, so that only named users can access the matter and its associated invoices. Users without permission do not see the matter anywhere in SimpleLegal or in reports, and that includes administrators and power users.
That last point is what separates the feature from ordinary access controls. SimpleLegal’s security model combines confidential, role-based, and matter-based permissions. Role and matter permissions decide what most users see day to day, while the confidential setting overrides broad access for the few matters that need it. SimpleLegal is Onit’s ELM platform for mid-market legal departments, and this feature is one of the main reasons sensitive work can sit in the same platform as routine matters.
Which legal matters should be marked confidential?
Legal matters should be marked confidential when knowledge of the matter itself, or of its spend, could cause harm if it reached the wrong person inside the company. Most departments apply this to a small share of their matters.
- Internal investigations. Whistleblower reports, fraud inquiries, and misconduct investigations, where the subject may work in the business.
- Executive and employment matters. Disputes or separations involving senior leaders or sensitive personnel issues.
- Sensitive transactions. Acquisitions, divestitures, or restructurings that are not yet public.
- Board and regulatory matters. Board-level advice and early-stage regulatory inquiries.
Write these categories into a short policy agreed with the General Counsel. A clear definition stops the flag being used too freely, which would make confidentiality harder to manage and weaken its meaning.
How do you enable confidential matter controls in SimpleLegal?
Confidential matter controls in SimpleLegal are enabled by arrangement with SimpleLegal, because the feature is available on specified plans and is not switched on by default. Check your plan and request activation early in the implementation, so the feature is ready before any sensitive matters are created or migrated.
Once it is active, decide who can create a confidential matter and who can grant access to one. Under the default permissions, the matter creator is initially the only user with access and must grant permissions to each individual who needs it. Keep both rights with a very small group, typically the General Counsel’s office and one or two legal operations administrators. If you are migrating existing matters, identify the confidential ones before the load and apply the setting as part of migration, so they never appear in the open matter list, even for a day.
Who should be granted access to a confidential matter?
Access to a confidential matter should be granted only to the named individuals whose work on the matter requires it, usually three to eight people. Every name on the list should have a documented reason.
- Matter Lead. The lawyer accountable for the matter, who usually also approves its invoices.
- Core legal team. The specific lawyers and paralegals working on it, added individually.
- Invoice reviewer. A named reviewer if someone other than the Matter Lead approves bills.
- Finance contact. One named finance user where accruals or payments need oversight.
Avoid adding people through broad groups or legal entity subscriptions. The feature works at the individual-user level, and the access list should stay that way. For a confidential matter, the record should be visible to a list you can read in ten seconds.
How do confidential settings affect invoices and reports?
Confidential settings in SimpleLegal extend to the matter’s associated invoices and to reporting, so unauthorized users cannot see the matter’s spend or discover the matter through reports. This closes the most common leak in legal platforms, where a matter is hidden but its invoices appear in a spend dashboard.
- Invoices. Invoices on the matter are visible only to users with access to the matter, so invoice queues stay clean.
- Reports. Users without access do not see the matter in reports, including administrators who would normally see everything.
- Exports and saved reports. Test any exports, scheduled reports, and integrations to finance, and confirm the restriction behaves as expected in each.
Plan for the reporting effect. Department-wide spend totals viewed by unauthorized users will exclude confidential spend, so agree with finance how those amounts are reported. Someone with access needs to own the confidential part of that picture.
How should outside counsel work on a confidential matter?
Outside counsel should work on a confidential matter through named individual access, with the engagement limited to the firm and people who genuinely need it. External access is where confidentiality is easiest to lose, so treat each addition as a deliberate decision.
Confirm during configuration exactly how a confidential matter behaves for vendors in Counsel Exchange in your setup, since the public documentation focuses on internal users. Then test it with a real firm account before relying on it. Ask firms to staff the matter with a small named team, and to tell you promptly when anyone leaves it. Counsel Exchange is the portal outside counsel use to submit invoices and collaborate with Onit customers. Keep sensitive documents in your document management system under matching restrictions, because a leak is costly: the 2026 edition of a long-running global study puts the average cost of a data breach at $4.99 million, a record high.
When should a matter be classified as confidential?
A matter should be classified as confidential at creation, before any documents, comments, or invoices are added to it. Classifying later leaves a window in which the matter appeared in lists, notifications, and reports for anyone with normal access.
Add a confidentiality question to the intake or matter creation form, and route any “yes” to the small group allowed to create a confidential matter. Once set, the classification is durable: changing the matter template on a confidential matter does not remove its confidential status. That protects against an accidental reconfiguration exposing the matter, and it also means removing confidentiality should be a deliberate, recorded decision when a matter becomes public or closes.
How often should confidential matter access be reviewed?
Confidential matter access should be reviewed at least quarterly, and monthly for the most sensitive matters, with immediate removal when anyone’s involvement ends. Access lists on sensitive matters grow quietly as people are added for a single task and never removed.
- Scheduled recertification. The Matter Lead confirms every name on the list each quarter and removes anyone who no longer needs access.
- Role changes and departures. Remove access within one business day when someone leaves the matter, the team, or the company.
- Exception records. Record any temporary or emergency access with a reason, approver, and end date.
Check your internal audit or security policy for a required cadence, and follow it where it is stricter.
How do you test confidential matter security before go-live?
Confidential matter security is tested before go-live by logging in as users with and without access and confirming the matter, its invoices, and its report rows appear only where they should. A typical plan runs 15 to 25 test cases.
- Administrator check. Log in as an administrator without explicit access and confirm the matter is invisible in lists, searches, and reports.
- Invoice and report check. Confirm invoices on the matter stay out of other users’ queues and dashboards.
- Template change. Change the matter’s template and confirm it stays confidential.
- Removal check. Remove a user’s access and confirm the matter disappears for them.
Role-based security testing catches access problems before they reach production. Repeat these tests after any release that touches permissions or reporting.
Conclusion
Confidential matters give SimpleLegal customers a strong tool for private work: explicit, user-level access that hides the matter and its invoices from everyone else, administrators and reports included. Confirm the feature is enabled for your plan, define which matters qualify, classify them at creation, and keep each access list to the few named people who need it. Review those lists every quarter, test invisibility from an administrator’s login, and agree with finance how confidential spend is reported. Handled that way, your most sensitive matters can live in the same platform as everything else.
How Basla can help
Basla provides delivery teams for Onit implementation, covering legal technology consulting, business analysis, confidentiality policy and permission design, confidential matter configuration and migration support, reporting and finance alignment, security testing, documentation, and hypercare after go-live. The team works with the General Counsel’s office and legal operations to define which matters qualify and who may access them, then tests invisibility from every relevant login before go-live.
Basla has delivered matter management and eBilling across more than ten global jurisdictions, where restricted matters had to stay hidden across regional teams while spend reporting stayed accurate.
Frequently asked questions
What are confidential matters in SimpleLegal?
Confidential matters in SimpleLegal are matters restricted to users with explicit, individual permission. Users without permission, including administrators and power users, cannot see the matter or its invoices in SimpleLegal or in reports.
Does SimpleLegal have a private matters feature?
SimpleLegal provides private matter protection through its Confidential Matters feature. It is available on specified plans, is not enabled by default, and is activated by arrangement with SimpleLegal.
Can administrators see a confidential matter?
Administrators cannot see a confidential matter in SimpleLegal unless they have been explicitly granted access to it. The same restriction applies to power users and to reports.
Does changing a matter template remove confidentiality?
Changing the template on a confidential matter does not remove its confidential status. The matter stays confidential until someone deliberately changes that setting.
Who should have access to a confidential matter?
A confidential matter should be limited to the named individuals who need it, usually the Matter Lead, the core legal team, a named invoice reviewer, and one finance contact. Three to eight people is typical.
How often should confidential matter access be reviewed?
Confidential matter access should be reviewed at least quarterly, and monthly for the most sensitive matters. Access should be removed within one business day when someone’s involvement ends.
*This article is provided for general information only and does not constitute legal advice. Basla Solutions provides legal technology implementation and support services and does not practice law.*