The verdict in three sentences
For a 35-lawyer employment law firm in Edinburgh, a custom secure client portal costs, as a 2026 order of magnitude, between 20,000 and 40,000 GBP, delivered in 12 weeks, against 35 to 70 GBP per user per month for an off-the-shelf solution. The non-negotiables are two-factor authentication, encryption of documents at rest and UK-based certified hosting, because legal professional privilege and client confidentiality cover every document exchanged. Beyond 3 years of use, custom generally becomes cheaper than the subscription, while integrating with the firm's practice management system.
Custom or off-the-shelf: the 5-year comparison
Sending documents by email (payslips, employment contracts, dismissal letters, tribunal submissions) exposes the firm to misdirected emails and leaks. The choice is between a subscription and a firm-owned tool.
| Criterion | Off-the-shelf solution | Custom portal |
|---|---|---|
| Entry cost (GBP) | 0 to 2,000 setup | 20,000 to 40,000 |
| Recurring cost (GBP) | 35 to 70 per user per month | 300 to 600 per month (hosting + maintenance) |
| 5-year cost, 35 lawyers + 5 assistants | 84,000 to 168,000 | 38,000 to 76,000 |
| Client access | Often counted as guest users | Unlimited |
| Integration with practice management system | Limited to built-in connectors | Custom API |
| Customisation (employment, collective matters, litigation) | Low | Full |
| Code ownership and exit | No | Yes |
The calculation uses 40 internal users. For a small 5-lawyer firm, the subscription remains cheaper; the tipping point sits around 15 to 20 users.
Security requirements and their cost
The Law Society of Scotland rules on confidentiality and UK GDPR require secure handling of client information, and the regulator expects firms to manage cyber risk actively. Here is what each component represents in the budget.
| Security component | Purpose | Share of budget | Indicative cost (GBP) |
|---|---|---|---|
| Two-factor authentication (TOTP or SMS) | Block access with a stolen password | 5% | 1,000 to 2,000 |
| Encryption at rest (AES-256) | Make files unreadable if a disk is stolen | 8% | 1,600 to 3,200 |
| UK certified hosting (ISO 27001, Cyber Essentials Plus) | Data residency and assurance | Recurring | 150 to 400 per month |
| Timestamped audit log | Track who viewed which document | 6% | 1,200 to 2,400 |
| Granular permissions per matter | A client only sees their own matters | 10% | 2,000 to 4,000 |
| Penetration test before go-live | Independent robustness check | One-off | 3,000 to 6,000 |
| Expiring share links | Send a document to a third party (expert, sheriff officer) | 4% | 800 to 1,600 |
The 12-week plan
Weeks 1 and 2: scoping with partners, IT and two pilot clients (an SME and a trade union client). Weeks 3 to 9: development in two-week sprints with a demo at the end of each. Week 10: penetration test. Weeks 11 and 12: migration of active matters, assistant training and gradual opening to clients. The items that most often delay a project are access to the practice management system's API and sign-off by the data protection officer.
Mini case study
Catriona, partner at a 35-lawyer employment law firm in Edinburgh, compares an off-the-shelf solution at 50 GBP per user per month for 40 users, 24,000 GBP per year, with a custom portal at 30,000 GBP plus 450 GBP per month for hosting and maintenance, 5,400 GBP per year. Over 5 years: 120,000 GBP for the subscription against 57,000 GBP for custom. The estimated saving reaches 63,000 GBP, with break-even around month 20. This scenario is illustrative and should be adjusted to the actual number of users.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Is a client portal mandatory for a law firm?
No, but sending sensitive documents by unencrypted email risks breaching confidentiality and UK GDPR fines of up to 4% of turnover. A portal greatly reduces that risk and reassures corporate clients.
Where should the data be hosted?
UK hosting certified ISO 27001, ideally with Cyber Essentials Plus for the supplier, is recommended. Count 150 to 400 GBP per month depending on document volume.
Can the portal connect to our practice management system?
Yes if the system exposes an API, as the main UK legal software vendors do. The integration represents 10 to 20% of the budget and removes double entry.
How long until go-live?
Count 12 weeks, penetration test included. A launch with 10 pilot clients in week 11 lets you fix the last pain points before full opening.
Do clients need to install an app?
No, the portal runs in the browser on desktop and mobile. Two-factor authentication uses an SMS code or a free authenticator app.
Let's scope your project. Tell us the number of lawyers and clients, your practice management system and hosting requirements: we will propose a secure architecture and a 12-week plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
