3-Person Law Firm: Best-Practice IT Setup

Small law firms are an IT milieu of their own: high confidentiality requirements, statutory retention duties for case files, regulatory specifics (in Germany: beA, KIM, DATEV interfaces; equivalents exist in most jurisdictions) — and often no in-house IT team. The temptation is to buy three laptops, subscribe to Microsoft 365, and store files “somewhere in OneDrive.” This works for a while — until the first restore case or the first audit on GDPR-compliant processing.

This article sketches a concrete, robust IT architecture for a three-attorney firm: three lawyers, perhaps an assistant, mixed practice (corporate, family, criminal — irrelevant to the architecture). We stay concrete, name components and discuss trade-offs instead of throwing buzzwords.

Goals

The IT must do four things:

1. Store case files securely and verifiably — beyond statutory retention periods (often 6–10 years after case closure depending on jurisdiction).
2. Support home office and travel — attorneys today work from the courthouse, the cafe, the car.
3. Integrate vertical software — DMS, electronic legal mailbox, accounting interfaces — without dubious workarounds.
4. Stay operational in incidents (ransomware, hardware failure, theft).

We build this on an open-source-first strategy with pragmatic commercial additions.

Workstations: Notebooks instead of Desktops

3× notebook, 14”–16”, with these minimum specs:

• 32 GB RAM (DMS and PDF viewers are memory-hungry)
• 1 TB NVMe SSD, BitLocker-encrypted
• Windows 11 Pro (for AD join and group policy)
• TPM 2.0 (standard on current models)
• Webcam, good keyboard (underrated — attorneys write a lot)

Recommended mainstream business vendors: Lenovo ThinkPad T series, Dell Latitude, HP EliteBook. Premium: Lenovo X1 Carbon, Dell XPS 13 Plus. Avoid gaming laptops (battery, fan noise, optics in client meetings).

External monitors in the office: 2× 27” IPS per workstation, USB-C docking. 4K is optional, but WQHD (2560×1440) is the floor — attorneys compare documents side-by-side.

Server: TrueNAS Mini X+ as Case File Server

The heart of the firm is a central file store with versioned protection. We recommend a TrueNAS Mini X+:

• Compact (fits in any office, no server room needed)
• 4 HDD bays + 2 M.2 NVMe slots for SLOG/L2ARC
• 10 GbE onboard
• ZFS with snapshot protection against ransomware
• TrueCharts / Apps for AD integration

Population:

• 4× 8 TB HDDs in RAIDZ1 → ~21 TB usable (more than enough for a firm of this size)
• Optional 2× 500 GB NVMe mirror for VM datasets (DMS backend if on-prem)

Dataset layout:

• firm/cases — case archive, SMB share, AD permissions
• firm/templates — boilerplate, general desktop
• firm/accounting — separate permissions, accounting only
• firm/internal — personnel records, managing partners
• firm/scans — document scanner inbox

Snapshot plan: hourly (24 h retention), daily (30 days), weekly (12 weeks), monthly (24 months). See TrueNAS Snapshot Schedule Best Practices.

AD integration: Either a small Windows Server AD (in a VM, see below) or Samba AD directly on TrueNAS — see TrueNAS Active Directory Domain Join.

Backup: PBS + Cloud, 3-2-1

A law firm cannot afford data loss. The 3-2-1 backup model:

• 3 copies of data
• 2 different media
• 1 copy offsite (cloud)

Concrete implementation:

1. Primary: TrueNAS Mini X+ (production data + snapshots)
2. Local backup: Second TrueNAS Mini X+ on the same site (different floor or server room) as replication target — daily ZFS-send
3. Offsite backup: Cloud backup to Storj or Backblaze B2, encrypted — see Cloud Backup Provider Comparison

For the workstations additionally a Proxmox Backup Server (PBS) on the second Mini X+ or separate hardware — see Proxmox Backup Server 4.0 What’s New. PBS has a Windows agent (Beta since 2025) which dedups the notebook NVMe drives.

Important: Test backups regularly. A backup never restored is no backup. See Backup Test Day: Restore in 30 Minutes.

Firewall: OPNsense on a Mini PC

A professional firewall is mandatory — GDPR audits expect it.

Hardware: Mini PC with two or four Intel i225/i226 ports (Protectli, Sophos SG used off-lease, or a Lenovo M75q with 2.5 GbE dongle). Investment: 400–800 EUR one-time.

Configuration:

• WAN: to fibre or DSL router (bridge mode where possible)
• Office LAN: internal AD domain, workstations and TrueNAS attached
• Guest VLAN: isolated, separate SSID for clients and visitors
• VPN endpoint: WireGuard for home-office access
• DNS filtering: AdGuard Home or Unbound with blocklists — see AdGuard Home for Enterprises

Advantages over a consumer router:

• VLAN segmentation (guest separate from office LAN)
• VPN for home office without third-party cloud
• Detailed logs for potential forensics
• No telemetry exfiltration to vendors

Mailserver: M365 or Mailcow?

Two legitimate paths — each with pros and cons for a law firm:

Option A: Microsoft 365 Business Standard

Pro:

• Ready in hours, minimal admin overhead
• Exchange Online, Office apps, OneDrive, Teams bundled
• Painless mobile sync
• Outlook is industry-standard, clients expect it

Contra:

• GDPR compliance only with DPA, EU data residency, mandatory MFA, conditional access
• Attorney-client privilege: critical view for highly sensitive matters — Microsoft is a US vendor
• Recurring subscription cost

Recommendation: A pragmatic start is M365 Business Standard + enforced MFA + conditional access policies. For especially sensitive cases (criminal defense, industrial-espionage matters) add encrypted communication via S/MIME or PGP.

Option B: On-Prem Mailcow

Pro:

• Full data sovereignty
• Full GDPR control
• One-time investment, no subscription
• Brand-able with firm identity

Contra:

• Administrative responsibility (DKIM, SPF, DMARC, reputation, backups, updates)
• External web-hosting partner for reverse MX relay advisable
• Mobile sync needs extra configuration

Recommendation: Firms with an IT-savvy partner or an external IT provider can run Mailcow — see Mailcow for the Mid-Market. We set this up regularly and operate it as a managed service.

DMS: Vertical Software

Open-source recommendation here is not appropriate. Law firms use vertical software that maps the legal interfaces (case structure, deadline management, fee calculation, electronic mailbox connection, accounting export).

In Germany the dominant DMSes are RA-MICRO, Advoware, AnNoTexT, NoRA — international equivalents are Clio, MyCase, PracticePanther, Smokeball. Which one fits depends on the firm’s profile. TrueNAS does not replace the DMS — TrueNAS is the file backend where the DMS stores case files. Some DMSes support a direct SMB backend, others require a local Windows server (in a VM on Proxmox on the Mini X+, see next section).

VM Hosting: Proxmox on a Separate Box or TrueNAS Apps

For a three-attorney firm a small Proxmox box (mini PC with 32 GB RAM, 2 TB NVMe) next to the TrueNAS is usually enough:

• VM 1: Windows Server 2022 for AD + DNS + print
• VM 2: DMS server (if needed)
• VM 3: optional Mailcow or Nextcloud

Very small firms can also lean on TrueNAS Apps (Linux containers) — Nextcloud, Vaultwarden, AdGuard. For the Windows Server a dedicated VM (Proxmox) is preferable.

VPN for Home Office: WireGuard

Attorneys work from home or the road. Three options for secure firm access:

1. WireGuard on OPNsense. Each attorney gets a peer config; once set up it just runs. Low overhead, native apps on Windows, macOS, iOS, Android.
2. RDP via VPN. Attorneys working with the DMS can RDP onto a terminal server in the firm — all data stays on the server, the notebook becomes a display.
3. VDI / cloud solution. Overkill for three people.

Recommendation: WireGuard + RDP. See OPNsense WireGuard VPN Setup.

Retention Obligations

Most jurisdictions require attorneys to retain case files for 6–10 years after case closure (in Germany: § 50 BRAO at least 6 years; criminal defense often longer; tax cases 10 years). After file return to the client the firm typically must keep a copy for its own records.

Technical implications:

• Files must not “disappear” — snapshots protect against accidental delete
• Long retention in backups (at least 7 years)
• Fast restore after hardware failure
• Disk encryption mandatory (BitLocker on notebooks, ZFS encryption on TrueNAS)

GDPR and Attorney-Client Privilege

Beyond GDPR, attorneys are bound by attorney-client privilege (in Germany: § 203 StGB). Practical consequences:

• DPAs for every external cloud component (M365, Storj/B2, possibly DMS cloud)
• MFA everywhere — no plain password for case access
• Access logging for sensitive datasets
• Encrypted mail for the most sensitive content (S/MIME, PGP)
• The German beA (or comparable electronic lawyer mailbox) has its own stack and hardware card
• No shadow IT — no private cloud storage for attorneys

Special: beA and DATEV (Germany)

The beA (German lawyer mailbox) is mandatory in Germany. It is its own client software with a smart card. It does not integrate directly into TrueNAS or DMS, but most DMSes provide a beA bridge that reduces manual steps.

DATEV interface: if the firm uses DATEV accounting, a DATEV consultancy template runs on a Windows machine. Data is exported from the DMS.

Equivalent mechanisms exist in other jurisdictions (US: e-filing portals; UK: HMRC/Companies House interfaces). The architectural principle stays the same.

Total Hardware Investment

A rough order-of-magnitude estimate (no offer):

Component	Investment range
3× notebook (mainstream business)	3,000–5,000 EUR
2× monitor per seat, docking	1,500–2,500 EUR
TrueNAS Mini X+ (4× 8 TB HDD)	3,000–4,500 EUR
Second TrueNAS Mini X+ for backup	2,500–3,500 EUR
OPNsense hardware (mini PC)	400–800 EUR
Proxmox box for VMs	1,500–2,500 EUR
Total hardware	~11,900–18,800 EUR

Software licenses (Windows Server, DMS, possibly M365), setup labour and ongoing cloud backup come on top. We produce concrete quotes per inquiry — the ranges above are orientation, not an offer.

Recommended Roll-Out Plan

1. Weeks 1–2: order hardware, build OPNsense and TrueNAS, set up AD domain
2. Week 3: provision notebooks, join domain, configure backup and first restore test
3. Week 4: DMS install, migrate data from old system
4. Week 5: team training, VPN setup, mail migration (if M365)
5. Ongoing: monthly snapshot check, quarterly restore test, annual IT review

Conclusion

A three-attorney firm deserves real IT — not less, but not the seven-server setup of a mid-cap manufacturer either. With this architecture you get:

• High data security (snapshots + 3-2-1 backup + encryption)
• Statutory retention (long retention, version protection)
• GDPR compliance (sovereignty on own hardware + DPAs for cloud components)
• Mobile readiness (VPN, RDP, M365)
• Economically defensible (one-time investment, low recurring cost)

Walk through this setup with us if you want a quote tailored to your firm — we advise firms of this profile regularly (law, tax, notarial, audit). Contact.

Sources and Further Reading

• TrueNAS for SMBs
• TrueNAS Active Directory Domain Join
• TrueNAS Snapshot Schedule Best Practices
• Proxmox Backup Server 4.0 What’s New
• Backup Test Day: Restore in 30 Minutes
• OPNsense WireGuard VPN Setup
• Mailcow for the Mid-Market
• Cloud Backup Provider Comparison
• GDPR Logging Obligations 2026