File Storage for Legal

Law firms generate documents that outlive the matter: pleadings, discovery productions, signed engagement letters, exhibits, and closing binders that may need to be retrievable years after a file is closed. The two failure modes firms actually hit are (1) sensitive PDFs sitting behind permanent, guessable, or over-shared links, and (2) a storage bill that scales by headcount instead of by data. files.link addresses both — files are encrypted at rest and in transit, access to anything sensitive flows through short-lived signed URLs, and billing is prepaid credits with no per-attorney or per-paralegal seat charge.

The access model is the part that matters for confidentiality. A practice-management suite or a Drive folder hands out durable share links that keep working until someone remembers to revoke them. Here you upload privileged material as private files and mint a signed URL per access event, defaulting to a 10-minute expiry. When you send opposing counsel a production set or a client a draft to review, the link they receive stops resolving on its own — there is no standing door to forget to close.

For documents that genuinely should be public (a published brief, a firm-letterhead form) you can serve a permanent CDN URL instead.

Retention and cost work together. Active matters live on standard storage for instant access; once a matter closes, move its file set to the cold storage tier to cut per-GB cost dramatically while keeping it API-retrievable for the duration of your retention obligation. Note the 90-day minimum retention on the cold tier — appropriate for archival, not for documents you reopen weekly.

A simple integration: when your DMS or intake tool finalizes a document, POST /v1/files/{matterFolderId}, PUT to the presigned URL, POST /v1/files/confirm-upload, and store the returned id against the matter. The raw-API-key header means a paralegal's automation script or a Zapier step can file documents without anyone touching credentials in a browser. files.link is storage and delivery infrastructure, not a compliance certification — pair it with your own retention policy, conflict checks, and engagement-level confidentiality controls.