NetDocuments architecture is the structure behind the platform: a cloud-native, multi-tenant document management service in which every document sits inside a repository, a cabinet, and usually a matter workspace, with security, profiles, and storage controlled at each level. The design choices made at the start, such as the cabinet list and the attributes that define a matter, shape every search and permission for years.
Cloud is now the default direction for legal technology. New platforms are being adopted widely, and a 2024 operations index found 60 percent of law departments implemented new technology over the past year. This guide explains how NetDocuments is put together, level by level, and what each level means for your team.
What is NetDocuments architecture?
NetDocuments architecture is a software-as-a-service design in which all customers run on one shared, vendor-operated platform, accessed through a browser and desktop integrations. Shared platforms put more weight on access control, since the 2026 edition of a long-running global study puts the average cost of a data breach at $4.99 million, a record high. The service was born in the cloud in 1999 and runs every customer on a single version of the software, which means new features arrive for everyone at once.
For a legal department, the practical effect is that your team configures the platform and never maintains it. Your administrators own the structure, the profiles, and the access model. NetDocuments owns the servers, upgrades, backups, and capacity.
Every customer receives the same release on the same schedule, so your configuration has to be built to work with upgrades you do not control, which makes documented design decisions important. There is no on-premises index, database, or file server to patch. Your IT effort shifts to identity, integrations, and governance.
How does the NetDocuments repository, cabinet, and workspace hierarchy work?
The NetDocuments hierarchy works in three main levels: a repository for the whole organization, cabinets inside it, and workspaces and folders inside each cabinet. Every document belongs to exactly one cabinet, and that cabinet decides its default security and which profile fields it carries.
- Repository. The top-level account for your organization. It holds global settings, users, groups, and the cabinets beneath it.
- Cabinet. The main container for content, typically one for client or matter files and separate ones for content that needs its own security, such as board or employment material.
- Workspace. A shared, matter-centric view inside a cabinet, generated from profile values such as client and matter number, with folders and saved searches arranged by a template.
Many organizations need fewer cabinets than they expect, and two or three well-designed cabinets are easier to govern than a dozen built around individual teams.
What role do cabinets play in a NetDocuments build?
Cabinets are the main control point in a NetDocuments build, because each one sets its own default access, profile attributes, and workspace behavior. Moving a document between cabinets changes its security and its metadata, so the cabinet list is the hardest part of the design to change later.
Cabinets can also be active, with full editing and indexing, or archival, which restricts editing and deletion for closed records.
- Security boundary. Default access is set per cabinet, and users see only the cabinets they have rights to. Separating highly confidential content into its own cabinet is simpler than restricting it document by document.
- Profile attributes. Each cabinet defines the custom fields documents carry, such as client, matter, document type, and author. Those fields drive search, filtering, and workspace creation.
- Workspace behavior. Each cabinet also decides whether it uses workspaces, which attribute they are built on, and which template new workspaces follow.
How do NetDocuments workspaces support matter-centric filing?
NetDocuments workspaces support matter-centric filing by giving every matter one shared view of its documents, emails, folders, and saved searches, built automatically from the matter’s profile values. When a user opens a matter workspace, everyone with access sees the same structure.
Workspaces are created from a template that the cabinet administrator designs. The template sets the default folders and saved searches, so a consistent template is what makes a litigation matter look the same across 500 matters.
A document profiled with a matter’s client and matter values appears in that workspace, and a document filed into the workspace inherits its profile values and its access list. Changing a template after rollout generally affects only workspaces created afterward, so older matters keep the old layout until someone updates them.
How do folders and profiles work in NetDocuments?
Folders and profiles in NetDocuments work together, with the profile acting as the true home of a document and folders acting as virtual groupings. A document lives in the cabinet and is filed into a folder, which means one document can appear in more than one folder without being copied.
Search, workspaces, and reporting all read profile values, so a document with an empty matter field is effectively lost.
NetDocuments applies a limit of 500 subfolders within a single parent folder, with no cap on top-level folders, and deep, sprawling folder trees usually signal that profile fields should be doing the work. Making client, matter, and document type mandatory at save time is the single most effective control for keeping the repository searchable.
How does NetDocuments control access and ethical walls?
NetDocuments controls access through permissions set at the cabinet, workspace, folder, and document levels, with inheritance rules that pass access down from the container a document is filed in. Ethical walls sit on top of that model and lock permissions for specific matters.
Workspace Security Manager policies are created at the cabinet level and applied to workspaces, and each workspace carries a single policy. Settle your matter security design before applying policies at scale. Role-based security testing before go-live keeps access errors out of production.
- Default access and inheritance. Set sensible cabinet defaults, then decide whether folders and workspaces pass their access to documents filed in them.
- Profile-based security. An access string on a matter or client value applies to every document profiled to it, including documents filed after the rule is written.
- Walled matters. Use locked workspace policies for matters that need a wall, and test them with real user accounts from each side of the wall.
How does NetDocuments secure and store enterprise data?
NetDocuments secures and stores enterprise data through layered encryption, regional data centers, and independently audited controls. Its security, privacy, and availability controls are validated by annual independent SOC 2 Type 2 audits, alongside controls mapped to ISO 27001, 27017, 27018, and 27701.
Clients and regulators will ask where documents live, who holds the keys, and what the audit trail shows.
- Encryption layers. NetDocuments describes three layers of document encryption, including an optional customer-managed key layer for organizations that want to hold their own keys.
- Data residency. Regional services, with separate sign-in points for the United States, United Kingdom, Germany, Australia, and Canada, let organizations keep content in a chosen region. Optional geo-aware storage extends that control further.
- Audit logs. Data activity logs, administrative logs, and file histories are available in the admin console, which supports client audits and internal investigations.
How does NetDocuments integrate with other enterprise systems?
NetDocuments integrates with other enterprise systems through Microsoft 365 and email add-ins, a large partner integration catalog, and data feeds that keep client and matter values current. NetDocuments lists more than 150 integrations.
- Microsoft 365 and email. Word, Outlook, and Teams integrations let users save, file, and co-author without leaving the application they work in. Email filing to the right matter workspace is often the feature that decides adoption.
- Matter data feeds. Client and matter tables should flow automatically from your matter management or practice system, so a new matter has a workspace the day it opens.
- Partner integrations. The integration catalog and the NetDocuments API connect e-billing, intake, and workspace-creation tools that need to read or file documents.
What NetDocuments architecture decisions should be made before rollout?
The NetDocuments architecture decisions to make before rollout are the cabinet list, the profile attributes, the workspace template, and the access model, because each one is expensive to change once documents are loaded.
Organizations moving from another platform face an extra step. Migrating from iManage to NetDocuments requires mapping workspaces, metadata, and security from one model to the other.
Write down every cabinet, attribute, template, and policy with the reason behind it, because undocumented configuration becomes technical debt the next administrator inherits. Route later changes to cabinets, templates, and walls through a release process, with testing in a sandbox before production.
Conclusion
NetDocuments architecture is simple to describe and demanding to design well: a repository of cabinets, each governing its own security and profiles, with matter workspaces and virtual folders layered on top. The platform handles the infrastructure, encryption, and upgrades, which leaves your team responsible for the structure. Get the cabinets, attributes, templates, and access model right before content arrives, and the system stays searchable and secure as your matter count grows.
How Basla can help
Basla provides certified delivery team members for NetDocuments implementation, including business analysts who document cabinet, attribute, and workspace design, QA specialists who test security and walls with real user roles, and documentation specialists who produce the design specifications and user guides your administrators will rely on. Basla works through staff augmentation or Basla-managed delivery, and supports platforms through hypercare and ongoing administration.
Across its legal technology services, Basla has supported deployments spanning more than 100 jurisdictions for a global retail organization and has scaled delivery teams to twice their size to meet compressed implementation timelines.
Frequently asked questions
What is NetDocuments architecture?
NetDocuments architecture is a cloud-native, multi-tenant design in which documents are organized into a repository, cabinets, and matter workspaces, with security and profile fields controlled at each level. NetDocuments runs the infrastructure, and your administrators configure the structure.
What is the difference between a cabinet and a workspace in NetDocuments?
A cabinet in NetDocuments is a container that sets default security and profile fields for everything inside it. A workspace is a matter-centric view within a cabinet, generated from profile values such as client and matter number.
Are NetDocuments folders real folders?
NetDocuments folders are virtual groupings, and documents actually live in the cabinet. A document is filed into a folder, so the same document can appear in more than one folder without a copy being made.
How many cabinets should an organization create in NetDocuments?
Many organizations work well with two or three NetDocuments cabinets, typically one for client or matter files plus separate cabinets for content with distinct security needs. Each extra cabinet adds its own defaults and attributes to govern.
Where does NetDocuments store data?
NetDocuments stores data in regional services, with separate sign-in points for the United States, United Kingdom, Germany, Australia, and Canada. Optional geo-aware storage and customer-managed encryption keys give further control over location and access.
Can NetDocuments cabinet design be changed after rollout?
NetDocuments cabinet design can be changed after rollout, but moving documents between cabinets changes their security and metadata. Settle it before migration to avoid rework.
*This article is provided for general information only and does not constitute legal advice. Basla Solutions provides legal technology implementation and support services and does not practice law.*