Matter management security is the set of rules that decides which people can see, edit, and approve each legal matter and its invoices, based on their role and their relationship to the record. A profile-based approach, often shortened to PBS, groups those rules into a small number of profiles such as Matter Lead, invoice reviewer, finance user, and outside counsel, then scopes each profile to the matters, vendors, and legal entities it genuinely needs. The aim is simple: everyone can do their job, and nobody sees more than their role requires.
Legal matter data is unusually sensitive. Investigations, employment disputes, and board-level transactions sit in the same platform as routine vendor bills, so access design deserves as much attention as workflow design.
What is matter management security?
Matter management security is the access-control model for an ELM platform, covering who can view matters, who can view or approve invoices, and what external users can reach. It combines user roles with the links between users and specific records.
Matter management works when every piece of legal work rolls up to one matter record, which also means one record concentrates sensitive information. Good security design lets that record be shared with exactly the people who need it, including finance and outside counsel, without opening the rest of the matter list.
What does profile-based security mean for legal matters?
Profile-based security for legal matters means access comes from a defined profile plus the user’s relationship to a matter, vendor, invoice, or legal entity. Two users with the same role can see completely different matters because they are attached to different records.
The term PBS is also a named feature in document management. NetDocuments uses profile-based security to control access through document profile attributes. In ELM platforms the same idea is delivered through roles, teams, reviewers, and subscribers. In Onit’s SimpleLegal, for example, permissions are shaped by the associations between records, and teams or team members can be assigned as reviewers and subscribers on matter groups, legal entities, or vendors.
Which user profiles does a legal department need?
A legal department typically needs five to eight user profiles, each defined by what the user does with matters and invoices. Fewer, clearly defined profiles are easier to assign correctly and easier to audit.
- Legal operations administrators. Configure users, teams, relationships, and settings. Keep this group to two or three people.
- Matter Leads. Own their matters, see full matter detail, and approve or delegate invoice review.
- Invoice reviewers. Approve or reject invoices, sometimes across many matters, often without needing full matter detail.
- Finance users. See spend, accruals, and payment status for reporting, with no access to privileged matter content.
- Outside counsel. See and bill only the matters assigned to their firm through the vendor portal.
Write each profile as a one-paragraph description with its permitted actions. That document becomes the reference for every access request after go-live.
How do relationships limit what each profile can see?
Relationships limit what each profile can see by tying access to the specific matter, vendor, invoice, or legal entity a user is linked to. In SimpleLegal, the level of the link sets clear boundaries on access, and reviewers and followers can be set at the matter, vendor, legal entity, practice area, and invoice level.
- Matter level. Reviewers or subscribers on a matter can access the matter and its invoices.
- Vendor level. Reviewers or subscribers on a vendor can access that vendor’s invoices without access to the matters.
- Invoice level. Reviewers or subscribers on one invoice can access that invoice without access to the related matter.
Legal entity links need the most care. Linking a matter to a legal entity can give users subscribed to that entity access to the matter, so a broad entity subscription can expose more than intended.
How should confidential legal matters be protected?
Confidential legal matters should be protected with narrower assignments, restricted naming, and extra checks on any broad access rule that could reach them. Typically a small share of matters, often investigations and employment disputes, needs this treatment.
- Named access only. Assign confidential matters to individual users at matter level and keep them out of broad matter groups and entity subscriptions.
- Neutral matter names. Use a code name so the matter title in reports and invoice queues reveals nothing sensitive.
- Restricted reviewers. Route invoices on confidential matters to a named reviewer inside the matter team.
Agree a written definition of “confidential matter” with the General Counsel, so intake and reviewers apply it consistently. Flag confidential matters with a dedicated field at creation, and run a monthly report listing every user with access to them. A short list that the General Counsel can scan in five minutes is the most effective control you can give them.
How do you separate viewing from approving in matter management?
Viewing is separated from approving by giving visibility and approval authority through different assignments, so seeing a matter never implies the right to approve its spend. This separation supports clean audit trails and sensible controls.
- Subscribers for visibility. Use subscriber assignments for people who need to follow a matter or its invoices.
- Reviewers for approval. Reserve reviewer assignments for people with genuine approval authority.
- No self-approval. Make sure nobody can approve an invoice they submitted or one for work they directed outside policy, and document any exception.
Review approval authority whenever someone changes role. Approval rights that outlive a role change are among the most common findings in access reviews.
How should outside counsel access be scoped?
Outside counsel access should be scoped to the matters assigned to each firm, with portal accounts for named individuals only. Third parties are a growing route into company data, and an analysis of 12,195 confirmed breaches found third-party involvement in breaches doubled to 30 percent. In SimpleLegal, assigning a vendor to a matter makes the matter visible in Counsel Exchange, and firm users need Counsel Exchange access to submit invoices for it.
Assign vendors at engagement and only to the matters they work on. When a firm’s engagement ends, remove the assignment as part of matter closure, and ask firms to tell you when their staff leave so portal accounts can be disabled within a business day or two. Confirm during configuration whether removing an assignment ends access automatically in your setup, and build a manual step if it does not. Counsel Exchange is the portal outside counsel use to submit invoices and collaborate with Onit customers, and outside counsel onboarding is the right moment to set these expectations.
How often should matter access be reviewed?
Matter access should be reviewed at least quarterly, with immediate updates whenever someone joins, moves, or leaves. Regular review catches the access that accumulates quietly over time.
- Quarterly certification. Matter Leads and administrators confirm who has access to their matters and remove anyone who no longer needs it.
- Joiners, movers, and leavers. Update access within one business day of a role change or departure, triggered by HR or IT notifications.
- Time-limited exceptions. Record every temporary access grant with a reason, an approver, and an expiry date, usually 30 to 90 days.
Check your internal audit or security policy for any required cadence, and follow it where it is stricter.
How do you test matter management security before go-live?
Matter management security is tested before go-live by logging in as each profile and confirming it can see and do exactly what the design allows, and nothing else. A typical test plan runs 25 to 40 cases across profiles, relationships, and confidential matters.
- Profile boundaries. Confirm each profile’s visible matters, invoices, and actions match its written description.
- Inheritance surprises. Add a user to a group, legal entity, or vendor and check for any access that appears unexpectedly.
- Confidential and external access. Confirm confidential matters stay hidden from broad groups, and vendor users see only their firm’s matters.
Role-based security testing catches access problems before they reach production. Repeat the core cases after every configuration release that touches users, teams, or relationships. Release management on configured legal platforms keeps those retests on schedule.
Conclusion
Matter management security works best as a profile-based model: a handful of clearly defined profiles, scoped through relationships to specific matters, vendors, invoices, and legal entities. Keep confidential matters on named access, separate visibility from approval, scope outside counsel to their own matters, and review access every quarter and at every role change. Test each profile from its own login before go-live and after every release, and the platform will serve lawyers, finance, and firms without exposing what should stay private.
How Basla can help
Basla provides delivery teams for enterprise legal management and eBilling software implementation, covering legal technology consulting, business analysis, profile and permission design, reviewer and subscriber configuration, vendor portal access setup, security test scripting, documentation, and hypercare after go-live. The team works with your legal operations, IT security, and finance leads to define profiles and access rules, then tests every profile from its own login before go-live.
Basla has delivered matter management and eBilling across more than ten global jurisdictions, where profile-based access kept regional teams, finance, and outside counsel working in one platform with the right boundaries.
Frequently asked questions
What is matter management security?
Matter management security is the access-control model that decides who can view matters, view or approve invoices, and reach records as an external user in an ELM platform. It combines user profiles with each user’s relationship to specific records.
Is profile-based security an Onit feature?
Profile-based security is a named feature in NetDocuments, and Onit’s public documentation does not use that term. In SimpleLegal, the same approach is delivered through roles, teams, reviewers, subscribers, and record relationships.
What can an invoice-level reviewer see in SimpleLegal?
An invoice-level reviewer in SimpleLegal can access the assigned invoice without access to the related matter. Matter-level reviewers can access both the matter and its invoices.
How should confidential matters be secured?
Confidential matters should be assigned to named users at matter level, kept out of broad groups and legal entity subscriptions, and given neutral code names. Their invoices should route to a named reviewer inside the matter team.
How often should legal matter access be reviewed?
Legal matter access should be reviewed at least quarterly, and updated within one business day when someone joins, changes role, or leaves. Temporary access should carry an expiry date.
How do outside counsel get access to matters?
Outside counsel get access to matters in SimpleLegal when their firm is assigned to the matter, which makes it visible in Counsel Exchange. Firm users also need Counsel Exchange access before they can submit invoices.
*This article is provided for general information only and does not constitute legal advice. Basla Solutions provides legal technology implementation and support services and does not practice law.*