Insights·May 10, 2026·law

Building a document vault that lawyers actually trust

A field guide for Indian law firms building a document management system. What a real vault must do, where DPDP and bar council rules bite, and where boutique builds beat packaged DMS products.

Every law firm we've worked with has the same conversation, eventually. Someone — often a senior associate doing a clause search at 11pm — asks where the latest version of a particular agreement is. Six people answer. Three are wrong. One file is on a partner's laptop, one is in an email thread, one is on the network drive in a folder named with a typo, and the version everyone is referencing is two iterations behind the one the client signed.

That's the moment a firm decides it needs a document vault. Often the next decision — what to buy or build — is where it gets expensive.

This is a field guide for partners and IT leads at Indian law firms thinking about a real document management system. What it actually has to do, where the Indian context bites, and where the leverage sits if you're choosing between packaged DMS products and a custom build.

What a real legal document vault must do

Strip away the marketing pages. A vault that lawyers will actually trust does five things, in this order:

  1. Every document lives inside a matter. Not a folder. Not a project. A matter — with parties, status, originating partner, and an audit identity. Files outside matters are second-class citizens.
  2. Every version is preserved. Not just current and previous. Every save, every redline, every signed copy, with attribution and timestamps. The day you need to defend a chain of custody, you need everything.
  3. Access is per-matter, not per-folder. A partner working on a related-but-walled deal should see nothing of the conflicting matter. Per-folder permissions break the moment someone moves a file.
  4. Every read, write, and share is logged. Quietly, completely, and reviewable in a single audit screen. The DPDP Act's accountability principle, the bar council's confidentiality expectations, and your own internal investigations all need this.
  5. Search works across the languages your matters actually contain. Hindi, Marathi, Tamil, Gujarati alongside English. Foreign DMS products often fail this quietly — full-text search returns clean English contracts and silently misses regional-language affidavits and court orders.

A vault that does these five well will get used. A vault that does fifteen things badly will be the system everyone routes around with WhatsApp and personal Gmail.

Where Indian firms have specific document needs

Most of the legal DMS market was designed for US and UK firms — billable-hour driven, single-language, federal-only court system, and minimal e-filing. Indian firms diverge in ways that matter:

  • Court-aware document tagging. A petition has a different lifecycle than an opinion. A pleading has different retention rules than a memo. Foreign systems often collapse these into "documents." Indian-built or India-aware vaults treat them as distinct types with their own metadata.
  • E-stamping and court e-filing artefacts. State-by-state e-stamp paper, high court e-filing receipts, NJDG case identifiers — these aren't ordinary documents. They're records that need to be findable from the matter screen, not buried four folders deep.
  • Bilingual and trilingual case files. A single corporate dispute in Mumbai might involve English contracts, a Marathi notarised translation, and a Hindi witness affidavit. Search and OCR have to handle all three.
  • Partner-allocation visibility. Originating, working, and supervisory partners often need different default views into the same matter. A vault that only shows files chronologically misses how Indian firms actually share work.
  • Bar council and DPDP readiness as a default. Confidentiality is not a feature in India anymore — it's a statutory obligation under the DPDP Act and the longstanding Bar Council and Advocates Act regime. The vault has to make the default behaviour the compliant behaviour.

Build, buy, or do both

The cleanest answer we give partners asking us this:

  • Buy a packaged DMS like NetDocuments, iManage, or one of the India-native platforms (Provakil, MyKase, Counsel Crest) if you're 50+ fee-earners with significant international work, or if you can adopt the product without changing how partners actually work.
  • Build custom if you're 10 to 40 fee-earners in India, your differentiator is in workflow (litigation calendars, partner allocation, client experience), and the packaged products would force you to either dilute that differentiator or pay for surface area you'll never use.
  • Hybrid is what most of our clients land on. Use a packaged product as the file primitive — versioning, OCR, full-text search — and build a thin custom surface on top for the parts that are uniquely yours: the matter workspace, the partner cockpit, the client-facing share link, the audit screen.

The hybrid approach is the wedge. It's also where boutique studios beat both pure packaged sales and enterprise consultancies — the work is small enough to ship in a quarter, specific enough that no SaaS company will ever build it for you.

The five rollout traps

We've seen these break document management projects more often than any technology problem.

Trap one: trying to migrate ten years of files on day one. Firms that ingest only live matters and freeze the old network drive read-only ship in a quarter. Firms that try to lift everything stall for a year and then stall for another year.

Trap two: per-folder permissions instead of per-matter. Folders move. Files get duplicated. Permissions drift. Per-matter access — granted at the matter level and inherited by every artefact inside — is the only model that survives a busy litigation team.

Trap three: ignoring mobile. Senior partners read documents on phones in cars between hearings. If the mobile experience is a Citrix-style remote desktop, they'll forward the file to personal email. Build a real mobile reader on day one or accept the leakage.

Trap four: client-facing share links that need the client to create an account. General counsels with a hundred files to download will not create accounts. They will ask for a Dropbox link. Then your vault is empty and Dropbox has your privileged documents.

Trap five: surveillance theatre instead of audit. Heavy-handed monitoring breeds workarounds. A quiet, complete audit log that the firm can pull when needed is more useful than a dashboard that flashes red every time someone opens a file.

A worked example: a 22-lawyer Pune corporate firm

A real shape we've quoted in the last six months. Names changed, numbers in the range a fixed-scope studio can hold to.

  • 22 fee-earners across Pune and Mumbai. Mostly transactional with a small dispute resolution practice.
  • Existing stack: a network drive in Pune, a separate one in Mumbai that's never quite in sync, a billing spreadsheet, and an email-driven client document collection process that fails every audit they engage with.
  • DPDP readiness deadline coming up. The compliance officer wants a defensible system before the next financial year.

What we'd typically scope:

  • Phase 1 (10 weeks, INR 14L fixed). Matter workspace with per-matter access, document upload with versioning and audit, full-text search across English + Hindi + Marathi, partner cockpit (originations, WIP per partner), client share link without account creation, mobile reader.
  • Phase 2 (6 weeks, INR 6L fixed, optional). E-stamp paper integration, NJDG case-tracking link, board-pack export for the management committee.
  • Retainer (post-launch, INR 50k/mo). Bug fixes, small features, partner-onboarding sessions, DPDP audit support twice a year.

Total year-one cost lands around INR 26L if both phases ship. A packaged enterprise DMS for a firm that size — including Indian customisation, integration, and licensing — usually quotes higher and ships slower. The honest trade-off: the boutique build is faster and more aligned, but the packaged product gives you a bigger ecosystem and a brand the client's general counsel will recognise.

How to start without committing to a build

If you're not sure whether to build, buy, or hybrid, do this first:

  1. Inventory live matters. Not all matters — just what's open and active right now. That's the real corpus the vault needs to win.
  2. Pick one practice area. Probably whichever has the most file-handling pain. Litigation is usually where the volume sits; transactional is usually where the precision sits.
  3. Demo three packaged products. Provakil and MyKase for India-native; one of NetDocuments or iManage for the global comparison. Watch how partners actually click through them.
  4. Write down what's missing. That gap list is your custom-build scope. If the gap is small, buy and live with it. If the gap is the whole differentiator, build the surface and let a packaged product be the primitive underneath.

That sequence is mostly free. It also produces a brief that any boutique studio — including ours — can quote against in a week.

Where Tanvora fits

We build matter workspaces, partner cockpits, document vaults, and client portals for Indian law firms — usually as a hybrid build on top of a packaged DMS, sometimes as a full custom system for firms that have outgrown what's on the market. The work is small, focused, and shipped in quarters, not years.

If you're sketching a document vault and want a second opinion on what to build, what to buy, and what to leave as a network drive for now, book a discovery call and we'll walk you through the trade-offs against your specific firm shape. Related reading: our broader field guide to custom software for Indian law firms, our take on matter management build vs buy, and a case study on a law firm rollout we shipped last year.

Frequently asked

Do Indian law firms actually need a document management system, or is a network drive enough?

A network drive works at five lawyers and breaks at twenty. The breakage is rarely catastrophic — it's slow drift. Files get versioned by filename suffix. Conflicts get checked against a partner's memory. Confidentiality lives in good intentions. A vault is the point at which those soft controls become visible, audited, and survivable when a partner leaves.

What's the minimum a real legal document vault must do?

Five things. Every document lives inside a matter. Every version is preserved. Access is per-matter, not per-folder. Every read, write, and share is logged. Search works across English plus the regional languages your case files actually contain. Anything more is preference. Anything less is a network drive in a nicer wrapper.

How does the DPDP Act change document management for law firms?

It moves confidentiality from an ethical duty under the Advocates Act and Bar Council rules into a statutory obligation with penalties. Practically: you need a documented data inventory, a defined retention policy, breach notification within stated timelines, and demonstrable access controls. A vault that doesn't log who saw what, when, can't satisfy the demonstrable part. We treat DPDP readiness as a baseline, not a feature.

Should we use a packaged legal DMS like NetDocuments or iManage, or build custom?

If you're a 50+ lawyer firm with international clients, packaged is usually the right answer — they've solved the boring parts at scale. If you're 10 to 40 fee-earners in India, packaged products are often overbuilt for the litigation surface and underbuilt for Indian-specific workflows (court e-filings, e-stamping, regional-language case files, partner allocation). A custom or hybrid build wins there — and it's cheaper than the all-in cost of an enterprise DMS over five years.

Where does most of the rollout pain come from?

Not the technology. It's the upload — the day-one decision about what gets ingested from the network drive and what stays behind. Firms that try to migrate ten years of files in one go stall. Firms that ingest only live matters and freeze the old drive read-only ship in a quarter. The vault should win because new work feels lighter, not because old work was forced into it.

How do we keep partners and senior associates from working around the vault on WhatsApp and email?

Make the in-vault path the path of least resistance. Mobile that actually works. A share link for clients that doesn't need them to create an account. A WhatsApp-style notification when a document is added to their matter. Auditing without surveillance theatre. Partners go around systems that punish them; they use systems that save them ten minutes a day.

Ready to talk about your build?

Book a discovery call See selected work