Legal
GRM LAW
The firm runs intake, conflicts, trust oversight and AML/CTF from one portal.
Whole-tenant ICT, with Conditional Access across the firm from 23 October 2026.
Legal
Software and security for firms that hold privilege.
We build, test and secure the systems Australian law firms run on, from the practice portal to the Microsoft 365 tenant behind it.
Some of the legal systems we build and run.
Product screens shown with sample data.
Legal
The obligations in play.
Privilege, trust money and AML/CTF tranche 2.
Legal professional privilege
Confidentiality duties under the profession’s conduct rules make a systems compromise a privilege problem as well as a security one.
AML/CTF Act, tranche 2
Legal practitioners providing designated services have been reporting entities since 1 July 2026: programs, customer due diligence and records.
Trust account rules
State legal-profession legislation sets record-keeping and external-examination obligations over trust money.
Privacy Act 1988 and the APPs
The Australian Privacy Principles govern client personal information, with the Notifiable Data Breaches scheme behind them.
Threat picture
What the sector is facing.
Notifiable data breaches, 2025
81of 1,205 notifications
Level with education, behind four larger sectors.
OAIC, Notifiable Data Breaches statistics for 2025, published 6 Jul 2026 
High severity
High severity
Policy and regulation
Federal Court orders The Star to pay $260 million for AML/CTF breaches
What we do
What you carry, and what we do about it.
Matter data lives in cloud practice systems and portals: privileged material, one credential away.
We penetration-test practice systems, portals and the networks around them, then hand back a ranked fix list, with a re-test to confirm the fixes.
Penetration testingAML/CTF tranche 2 captures legal practitioners providing designated services: programs, customer due diligence, records.
We run compliance readiness programs that map the obligation to your practice, close the gaps and build the evidence trail an assessor expects.
Compliance readinessTrust accounting records have to be complete, attributable and producible when the examiner asks.
The portals we build carry append-only audit ledgers, enforced on every state change, so the record exists before anyone asks for it.
Secure-by-design buildsIdentity is where confidentiality leaks: the compromised inbox, the over-privileged account.
We review and harden the Microsoft 365 tenant your firm signs in to: conditional access and MFA coverage, privileged roles and app consent.
Entra ID and Microsoft 365 identity security
Services
The services that apply.
- Penetration testingNetworks, web apps, cloud and AI systems, with a report and a re-test.
- Microsoft 365 and Azure security reviewIdentity, Conditional Access and tenant settings, reviewed setting by setting.
- Essential Eight assessmentMaturity rated strategy by strategy, with an uplift plan sequenced by risk and effort.
- Managed ICTMicrosoft 365 tenants, devices and support, run by the people who secure them.
Questions, answered.
What does AML/CTF tranche 2 mean for a law firm?
Legal practitioners providing designated services have been reporting entities since 1 July 2026, with an AML/CTF program, customer due diligence and records to keep. We write the AML/CTF program with your practice and build it into the systems your staff use, with the evidence trail an assessor expects.
Can you test our practice system and client portal?
Yes. We penetration-test practice systems, portals and the networks around them, then hand back a ranked fix list, with a re-test to confirm the fixes.
How do you protect a firm’s Microsoft 365 tenant?
Identity is where confidentiality leaks, so we review and harden the tenant your firm signs in to: conditional access and MFA coverage, privileged roles and app consent.
Do you build portals for law firms?
Yes. The portals we build carry append-only audit ledgers, enforced on every state change, so trust and matter records exist before anyone asks for them. One of them connects to Smokeball and runs the firm’s intake, conflicts and trust oversight.
Industries
Other sectors we work in.
Financial services
Portals and operations for AFSL holders, built around the licence perimeter.
Property
Practice systems, deal sourcing and AML/CTF screening for valuers and buyer’s agents.
Government
Prequalified for councils and agencies, with the Essential Eight held on our own estate.
