VA Legal Ethics Opinion 1872, in plain English
What Virginia's ethics opinion on cloud storage actually asks of a firm, and what "aligned with it" means when we set up your files.
What LEO 1872 is
The Virginia State Bar's Standing Committee on Legal Ethics issues opinions that interpret the Rules of Professional Conduct for situations the rules don't spell out word for word. Legal Ethics Opinion 1872 is the one that addresses cloud computing — storing and transmitting client data through a third-party service rather than on a server in the office.
It doesn't ban cloud storage. It says a lawyer may use it, provided they take reasonable care to protect client confidentiality when they do. The opinion is the "what reasonable care looks like" part.
What "reasonable care" actually asks for
Opinions like this one, consistent with how most state bars have approached the same question, generally come back to a handful of practical points: understanding how the vendor stores and secures data, knowing where it's physically stored and who can access it, having a way to get your own data back out if you ever switch providers, keeping data encrypted both in transit and at rest, and having a written policy your staff actually follow rather than a setting nobody checked.
None of that is exotic. It's closer to "know your vendor and prove it" than to a specific technical checklist — which is also why "we use Microsoft 365" isn't, by itself, an answer. The question is whether it was set up with a firm's confidentiality obligations in mind or just switched on with defaults.
What "aligned with it" means when we set it up
When industries.js and this site say a law firm's cloud storage is "aligned with VA LEO 1872," that means the file structure is matter-centric (organized the way a case actually moves, not a flat dump of folders), access is scoped to who needs it, and the setup itself — encryption, retention, who can see what — is something we can walk you through and defend, not a black box.
We're not your ethics counsel and this page isn't legal advice — for a specific compliance question, the opinion itself and your own judgment (or the Bar) are the actual authority. What we can do is set the technical side up the way the opinion assumes a careful firm would.
Thirty minutes, no obligation.