Cloud vs Self-Hosted Legal Software: A Guide for Moroccan Law Firms

Imagine losing access to your case documents and hearing calendar on a busy court morning. When comparing cloud and self-hosted legal practice management software, start with that scenario—not the subscription price or the location of a server.

For a Moroccan law firm, our recommended approach is to separate three decisions: who operates the application, where personal data travels, and how the firm will keep working during an interruption. The best fit is the arrangement you can document, fund and test.

Cloud and self-hosting: separate the service from its location

The NIST definition of cloud computing distinguishes software services from infrastructure services. Using a provider’s application as software as a service, or SaaS, is different from renting infrastructure and running your own application on it.

In this comparison, self-hosted means that the firm, or its appointed IT operator, manages the application installation. Ask each supplier to identify both the operating model and the physical hosting locations; do not treat these as the same question.

The UK National Cyber Security Centre’s shared-responsibility guidance explains that cloud services delegate some security responsibilities to a provider, with the division depending on the service. Customers still need to choose an appropriate service, configure it securely and decide what data belongs there. On-premises operation leaves the organisation responsible for the service’s security.

Three Moroccan data-protection checks before deployment

1. Identify the applicable CNDP formalities

The CNDP’s Notifier un traitement guidance describes prior declaration as the general rule, subject to exclusions, exemptions and prior-authorisation cases. It lists sensitive data and national identity card numbers among authorisation triggers. For offence and conviction data, it expressly identifies an exception concerning processing by auxiliaries of justice. Have the actual processing assessed rather than assuming every legal file follows the same procedure.

2. Examine foreign transfers separately

The CNDP’s foreign-transfer guidance sets out permitted routes, including listed destination countries and specified conditions for other destinations. It provides form F118 and states that transfer authorisation depends on prior approval of the underlying processing declaration or authorisation request. Confirm the applicable route before deployment; a supplier’s general privacy statement is not that assessment.

For procurement, request a written map covering primary storage, backups, disaster-recovery copies, support access and subprocessors. Ask which activities occur outside Morocco and have their transfer implications reviewed. Apply this exercise to self-hosted proposals as well as SaaS.

3. Require security and contractual evidence

Article 23, reproduced on the CNDP’s Sécurité du SI page, requires appropriate technical and organisational safeguards. Where processing is outsourced, it also addresses processor selection, oversight and a binding arrangement covering instructions and security. Our practical conclusion: assess the operating controls and written commitments, not a claim that either local hosting or cloud hosting is automatically compliant.

Compare complete operating plans, not headline prices

Use the following as a purchasing framework, rather than a claim that one deployment model always wins.

When to shortlist managed cloud software

For a firm without a dependable systems administrator, we would prioritise evaluating a managed service. Ask for a clear division of responsibilities, maintenance arrangements, support hours, incident escalation and recovery commitments. Test access from the office and from the locations where lawyers actually work.

When to shortlist self-hosting

Consider self-hosting when the firm has a defined reason to control its installation and a funded operator to maintain it. Before approval, name who will handle application and operating-system updates, monitoring, certificates, backups and emergency recovery. Specify cover for that person’s absence.

For either option, request a three-year cost breakdown covering licences or subscriptions, infrastructure, migration, storage growth, security administration, support, training, recovery tests and exit assistance. Include internal staff time. Treat this as a comparison method—not a forecast that cloud or self-hosting will be cheaper.

Make continuity and exit part of the demonstration

The Canadian Centre for Cyber Security’s Ransomware playbook recommends offline backups and regular restoration testing. A backup promise should therefore be accompanied by evidence that recovery works. Ask about encryption, separation from production access and the latest completed restore test.

For a legal practice, we recommend four acceptance exercises using fictional matters:

1. Restore a working file: recover a matter with its documents, client links, tasks, deadlines and hearing entries. Check usability, not just whether files reappear.
2. Rehearse an outage: agree the maximum acceptable interruption and data loss. Test how authorised staff obtain essential hearing and deadline information without creating uncontrolled copies.
3. Review access: demonstrate the available authentication and permission controls, staff departure procedure and restrictions on support access. Record any missing capability.
4. Test departure from the supplier: request an export, inspect its format and verify document-to-matter links. Agree export charges, handover timing and deletion arrangements in writing.

Also establish a retention schedule before migration. Article 3 of Law 09-08 links identifiable-data retention to the time necessary for the processing purposes. Have applicable professional and legal retention requirements reviewed rather than adopting indefinite storage by default.

Choose the arrangement the firm can sustain

Our recommendation is conditional: shortlist managed cloud when operational capacity is limited; shortlist self-hosting when control requirements are clear and maintenance is genuinely resourced. In both cases, make the decision depend on documented data flows, reviewed CNDP formalities, a successful recovery exercise and a usable exit process. Those are more useful purchasing tests than the hosting label alone.

This article provides editorial and technical purchasing guidance, not legal advice. Confirm the requirements applicable to your firm with the CNDP and qualified advisers before implementation.