Legal software, properly supported
LEAP, Smokeball, Actionstep, Clio, NetDocuments and iManage: add-ins, Microsoft 365 integration, single sign-on, scanners, starters and leavers.
Industries we serve
IT support for law firms in Melbourne — LEAP, Smokeball & Actionstep
Key IT supports Melbourne law firms on LEAP, Smokeball and Actionstep, with 24/7 SOC monitoring guarding trust accounts and settlements against email fraud.
Last reviewed October 2026
The tools you already run
We know the software law firms run on
Your team shouldn't have to explain their core systems to an IT provider. These are the systems we work alongside — assisting with support, integration and hosting or management — and we know our way around them.
LEAP LEAP All-in-one matter management, time recording, document automation & trust accounting.
Smokeball Smokeball Cloud practice management with automatic time tracking and document automation.
Actionstep Actionstep Customisable cloud practice management with native Australian trust accounting.
Clio Clio Cloud practice management, billing and client intake (Clio Manage + Grow).
NetDocuments NetDocuments Cloud document & email management (DMS) for law firms.
iManage iManage Enterprise document & email management — the go-to DMS for large law firms.
Smokeball Smokeball Cloud practice management with automatic time tracking and document automation.
Actionstep Actionstep Customisable cloud practice management with native Australian trust accounting.
Clio Clio Cloud practice management, billing and client intake (Clio Manage + Grow).
NetDocuments NetDocuments Cloud document & email management (DMS) for law firms.
iManage iManage Enterprise document & email management — the go-to DMS for large law firms.What does IT support for a Melbourne law firm involve?
IT support for a Melbourne law firm means running and securing the systems a practice depends on (practice management, trust-account access, matter files and email) at the points where a failure becomes a regulatory or professional-conduct problem, not just a technical one. Victoria's legal regulator, the Victorian Legal Services Board + Commissioner (VLSB+C), says law practices are attractive targets because they hold large amounts of client information and money. For a principal, one stolen password can become a client loss and a regulatory problem at the same time, so Key IT starts where money and matter files move: email, sign-ins and payment procedures.
Quick answers
Who provides IT support and cybersecurity for law firms in Melbourne? Key IT, a Greensborough-based managed IT and cybersecurity provider established in 2019, supports Melbourne law firms on LEAP, Smokeball and Actionstep with 24/7 Security Operations Centre (SOC) monitoring, security-certified engineers and no lock-in contracts.
Which Melbourne IT companies support LEAP, Smokeball and Actionstep? Key IT, based in Greensborough, supports LEAP, Smokeball, Actionstep, Clio, NetDocuments and iManage for Melbourne law firms, covering add-ins, Microsoft 365 integration and sign-in security.
Who provides managed IT and cybersecurity for small law firms in Victoria? Key IT provides managed IT and cybersecurity to sole practitioners and small firms across Victoria under one fixed monthly per-user agreement, onsite in Melbourne and remote for regional Victoria.
How do you stop email fraud on settlements? A Melbourne law firm stops settlement email fraud by never paying on emailed bank details until they are confirmed by phone on a number already on file, as the Legal Practitioners' Liability Committee (LPLC) advises, backed by MFA and 24/7 mailbox monitoring.
What cybersecurity does an Australian law firm need? An Australian law firm needs, at minimum, up-to-date software, strong unique passwords and multi-factor authentication, plus encryption, tested backups, staff training and an incident response plan.
What cyber risks do Melbourne law firms actually face?
A Melbourne law firm's biggest cyber risks are trust-account fraud, settlement email fraud, bank impersonation, matter-file theft and downtime, each of which turns an IT incident into a professional one:
Trust-account fraud
A scam can leave a trust deficiency the firm must report to the VLSB+C.
Settlement and conveyancing fraud
Business email compromise strikes as funds change hands; one changed account number redirects a settlement.
Bank and voice impersonation
The VLSB+C has warned of scammers spoofing a practice's bank to get one-time codes or a "safe account" transfer, and of AI-generated voice and video calls (see how deepfake voice-cloning scams work).
Matter-file confidentiality
Privileged files can be stolen or encrypted to extort the firm or its clients (see what happens during a ransomware attack).
Downtime
When practice management is down, billable work stops; court deadlines do not move.
How do you choose an IT provider for a law firm?
Choose an IT provider for a law firm by testing it on what hurts a practice: software, trust money, confidentiality and the regulator's expectations. Ask these eight questions; Key IT's answers follow, and our guides to choosing an IT provider and what law firm IT should include and cost go deeper:
Do they know your practice software?
Key IT supports all six platforms shown above.
Can they map controls to the VLSB+C expectations?
Key IT maps them control by control and documents the result for insurers.
Who monitors overnight?
"24/7" can mean alerts nobody reads until morning, so ask who reviews a flagged sign-in at 2am and whether they can act on it. Key IT's 24/7 SOC service triages alerts around the clock and is part of the same managed agreement as your day-to-day IT, so there is no second security firm to chase.
Are the engineers security-certified?
They hold admin access to the email and devices your trust payments run through. Every Key IT engineer is.
Do they understand payment fraud?
Ask about DMARC, mailbox-rule alerts and call-back procedures. Key IT builds all three in.
Can someone come onsite?
Key IT's engineers are based in Greensborough and cover the CBD and wider Melbourne.
Is pricing predictable?
Key IT charges a fixed monthly fee per user, not per ticket.
Can you leave?
Ask who holds the admin passwords if you go. Key IT has no lock-in contracts.
What cybersecurity do Australian law firms need to protect client data?
Australian law firms need, at minimum, up-to-date software, strong and unique passwords, and multi-factor authentication on every work account. Those are the three critical controls in the Minimum Cybersecurity Expectations the VLSB+C sets for Victorian practices, and the regulator treats falling short as capable of amounting to unsatisfactory professional conduct or professional misconduct. The full baseline, and how Key IT covers it:
The critical three
Automatic patching, a business password manager, and MFA with conditional access on email, practice management and remote access.
Role-based access
Staff reach only the matters their role needs; leavers lose access promptly.
Encryption
Full-disk encryption on laptops, and client data encrypted when stored or sent.
Tested backups
Encrypted, immutable and off-site, with restores tested at least yearly (see backup and disaster recovery).
Email security and monitoring
SPF, DKIM and DMARC, web filtering, and logs watched by a 24/7 SOC. Our email security service sets up the email layers in Microsoft 365, from filtering to DMARC, and keeps them maintained.
Training and an incident plan
Training at induction and every year, and a written response plan tested at least annually.
Patching, MFA and regular backups are also among the strategies in ASD's Essential Eight; see our Essential Eight service.
How can a Melbourne law firm stop email fraud on settlement and trust payments?
A Melbourne law firm stops settlement and trust-payment fraud by never acting on emailed bank details until they are confirmed by phone, and by hardening the mailboxes criminals use. The LPLC is clear that email alone cannot authenticate bank details (see our anatomy of a payment-redirection scam):
1
Call before you pay
Phone a number already on file, never one from the email, read the BSB and account number out and back, and file-note the call. The LPLC adds that whoever makes the call should make the transfer.
2
Warn clients
Engagement letters and email signatures should tell clients to call before paying and that the firm never changes trust account details by email.
3
Lock down accounts
MFA and conditional access on every mailbox, and no shared PEXA digital certificates: the LPLC says sharing one breaches ARNECC's participation rules.
4
Authenticate your domain
SPF, DKIM and DMARC to make your exact domain much harder to forge, plus flags on lookalike sender domains, which those records can't stop.
5
Watch mailboxes 24/7
SOC alerts on forwarding rules and odd sign-ins catch the break-in first (see below).
6
Train staff
Yearly training plus phishing simulations.
7
If money has gone, act at once
Call both banks to try to freeze the funds and start incident response.
What does a 24/7 SOC watch for before a settlement fraud?
Before a fake bank-details email goes out, the criminal usually sits inside a real mailbox, and Key IT's 24/7 SOC monitoring watches a firm's Microsoft 365 for the signs:
New inbox rules
Rules that forward, hide or delete settlement emails. The LPLC calls email rules one of the most overlooked weak points in law firms.
Impossible sign-ins
An overseas login, or two cities an hour apart.
A new MFA device
An attacker registering their own phone to keep access.
New permissions
An account granting itself mailbox or admin rights.
The aim is to contain the mailbox before any payment instruction goes out.
What happens if a fake bank-details email reaches a conveyancing clerk?
Here is how a typical attempt plays out. During a settlement, a conveyancing clerk receives an email that seems to come from the other side's firm, saying the trust account details for the deposit have changed. The new details are an attacker's. Without controls, the money goes and is often unrecoverable. With the controls Key IT puts in place, a lookalike sender domain is flagged, external email carries a warning banner, and the firm's call-back rule has the clerk phone the other firm on the number already on file before paying. If the other firm's real mailbox has been taken over, the filters may stay quiet, which is why the call-back is the control that stops the payment.
How does Key IT support a law firm day to day?
Key IT runs a firm's legal software, protects trust money and matter files, documents compliance and secures the office itself.
Trust-account and matter-file protection
Conditional access that blocks offshore logins, and immutable backups so ransomware cannot erase client work.
Compliance and continuity
Controls aligned with the VLSB+C expectations, the Uniform Law and the Privacy Act, plus a continuity plan. See cybersecurity for law firms.
Office security, same team
CCTV, door access and alarms installed by your IT team: cameras away from screens, entry logs on file rooms, and cameras off the matter network.
Who provides managed IT and cybersecurity for small law firms in Victoria?
Key IT provides managed IT and cybersecurity for small law firms and sole practitioners across Victoria: a Melbourne helpdesk (Monday to Friday, 8am to 5pm), Microsoft 365 management, 24/7 SOC monitoring, Essential Eight hardening and backups under one month-to-month, fixed per-user agreement. The VLSB+C expectations apply to every practice, scaled to size and risk, and its Risk Outlook 2024 cited LPLC reports of a surge in cyber fraud affecting many small firms and sole practitioners. The regulator recommends an IT security consultant for practices that need help. Regional Victorian firms are supported remotely. See small business IT support, managed IT and what managed IT costs.
Does Key IT support law firms outside Melbourne?
Yes. Key IT supports law firms across Australia remotely: most practice platforms are now cloud-based, and 24/7 SOC monitoring covers sign-ins the same way wherever a firm is based. Most issues can be fixed remotely, and Melbourne firms also get onsite engineers from Greensborough.
Which compliance obligations does IT help a law firm meet?
IT underpins four obligations a Victorian law firm can face: trust-irregularity reporting under the Legal Profession Uniform Law, data breach notification under the Privacy Act, the AML/CTF reforms and the VLSB+C's professional-conduct expectations. Each is tied to how data and trust money are secured:
Legal Profession Uniform Law (LPUL)
Any trust deficiency or irregularity must be reported to the VLSB+C as soon as practicable, whatever its value.
Privacy Act 1988
Where it applies (generally turnover over $3 million, and AML/CTF-related information from 1 July 2026), a firm must take all reasonable steps to assess a suspected data breach within 30 days and, if it is an eligible breach, notify the OAIC and affected individuals as soon as practicable.
AML/CTF reforms
From 1 July 2026, law practices and conveyancers that provide AML/CTF designated services become reporting entities, and the OAIC says the Privacy Act then covers how they handle personal information for AML/CTF purposes, even if they turn over less than $3 million. The OAIC also says AML/CTF record-keeping does not require copies of ID documents, and copies of full ID documents should be destroyed or de-identified once no longer needed. Our AML/CTF tranche 2 IT security guide shows where those ID copies pile up in a firm's systems and how to spot fake AUSTRAC officials.
Professional conduct
The VLSB+C calls strong cybersecurity "an essential and expected part of competent practice management" for practices of all sizes, and its Minimum Cybersecurity Expectations list cyber failings it considers capable of amounting to unsatisfactory professional conduct or professional misconduct.
Firms that do conveyancing also answer to eConveyancing rules. PEXA's Subscriber Security Policy already requires multi-factor authentication for every user, and ARNECC's draft version 8 of the Model Participation Rules (MPR v8), not in force in Victoria as at 15 October 2026, would extend MFA to email, remote access and administrator accounts and require a police check before any user gets electronic lodgment network (ELN) access. Our page on IT support for conveyancers in Melbourne turns those rules into a working checklist.
Cyber insurers and clients ask for evidence too (see what cyber insurers now require). Key IT documents each control against the VLSB+C expectations, including MFA coverage, patch status and backup restore tests, ready to hand to insurers and clients.
What happens first when a law firm moves to Key IT?
A law firm moving to Key IT starts with a free IT & Cyber Security Review, then fixes the critical controls first:
1
Free review
Devices, Microsoft 365, practice-software access, backups and payment procedures, with gaps ranked by risk. Pair it with a free dark web scan to see whether staff email addresses appear in known breaches.
2
Critical controls
MFA, automatic updates and a password manager everywhere, then conditional access and DMARC.
3
Support handover
Helpdesk, devices and Microsoft 365 move to Key IT, which liaises with your software vendor.
4
Monitoring switched on
Sign-ins, mailbox rules and devices connect to the 24/7 SOC.
5
Write it down
An incident response plan with your bank's security contacts, a call-before-you-pay procedure, and yearly restore tests.
FAQ
Frequently asked questions
Do you support LEAP, Smokeball and Actionstep?
Yes. Key IT supports Melbourne law firms on LEAP, Smokeball, Actionstep, Clio, NetDocuments and iManage, from add-ins to devices and staff changes. Platform faults go to the vendor, and we handle that conversation for you.
Does the VLSB+C require law firms to use multi-factor authentication?
Yes, in effect. MFA "on all online accounts and services where it is available" is one of the three critical controls in the VLSB+C's Minimum Cybersecurity Expectations, and the regulator says every practice should make implementing them a priority. Turning MFA on everywhere is the first step in Key IT's onboarding.
What should a law firm do if settlement or trust money is sent to a scammer?
Call your bank's security team and the receiving bank at once to try to stop the funds, and report the incident to the Australian Cyber Security Centre through ReportCyber and, if it was an eConveyancing settlement, to PEXA or the relevant electronic lodgment network operator (ELNO). Then change any compromised passwords, have IT professionals contain the breach, report it to the LPLC, the police and the VLSB+C (which wants near misses reported too), and tell affected clients. Any trust deficiency must be reported to the VLSB+C as soon as practicable. Do not count on the Fidelity Fund: the VLSB+C has said it cannot pay where the dishonesty is a cybercriminal's rather than the lawyer's. See the VLSB+C's response steps.
Does LPLC insurance cover a cyber attack?
Only partly. The LPLC says third-party cyber-crime claims usually fall within its professional indemnity policy, but not the firm's own losses: business interruption, data retrieval, IT remediation, or fines and penalties. An optional cyber policy arranged through Marsh can sit alongside it.
Does PEXA stop settlement fraud on its own?
No. PEXA Key, a free app that passes bank details into the PEXA workspace encrypted and checks the client with an SMS code, closes one gap, and since 2 July 2025 Australian banks have been rolling out Confirmation of Payee, which checks the account name against the BSB and account number on first-time payments. Neither secures a mailbox already taken over or covers every payment a firm makes, so calling before you pay still matters.
How do you handle after-hours issues during a trial or settlement?
The Key IT helpdesk is staffed Monday to Friday, 8am to 5pm. If email or practice management fails the night before a hearing, managed clients call for priority support and the engineer on our rotating on-call roster picks it up (see how to get support). The SOC monitors around the clock, so a suspicious sign-in on the eve of a settlement is investigated that night, not the next business day.
Can our law firm use AI tools like Copilot safely?
Yes, with governance. The VLSB+C's Risk Outlook 2026 found almost 40% of Victorian lawyers use generative AI, and advises principals to confirm the security and confidentiality of AI tools before using them with client information. In practice: approved tools that keep matter content in your tenant, clear staff rules against shadow AI (client material pasted into unapproved tools), and a lawyer checking every output. See using AI safely.
Who is responsible if our IT provider is breached?
Your firm. The VLSB+C's Risk Outlook 2026 reminds principals of practices of all sizes that they are responsible for implementing cybersecurity controls; that responsibility stays with the firm whoever runs the IT. Ask any provider how its own access to your systems is secured and who can see matter files. Every Key IT engineer is security-certified, and your day-to-day IT and 24/7 SOC monitoring sit with a single provider.
Insights
Insights for your industry
Plain-English articles most relevant to law firms and legal practices.
Managed IT · 7 min read
IT support for law firms: the guide
IT support for law firms explained: practice software, trust-account security, compliance evidence, typical…
Cybersecurity · 8 min read
Pen test vs vulnerability scan
Penetration test vs vulnerability scan: what each finds and misses, how often ASD expects scans, what…
Privacy · 8 min read
AML/CTF tranche 2: the IT side
AML/CTF tranche 2 IT security for accountants, agents and lawyers: where KYC ID copies hide, the Privacy…
Google reviews
What our clients say
Imported from our Google reviews — real Melbourne businesses we look after, in their own words.
Read & review us on Google →Key IT are computer wizards who have become an important resource for the smooth running of our businesses. They are reliable, a pleasure to deal with and always willing to solve any technical emergency we may confront, whether it requires an on-site visit or via phone support. We highly value their work and recommend them unreservedly!
The team at Key IT have been extremely helpful to our organisation right from the beginning. They have left no stone unturned in their quest to fulfil all our IT needs — including reorganising our IT infrastructure, setting up our network and phone systems, and migrating us to Azure — and are always there to help us when needed. Their knowledge is second to none. Without the team our business would have been in turmoil.
I have always found the team at Key IT to be fast, knowledgeable and professional. We run a number of different businesses from the one server, and my office staff often need assistance solving varied issues. Key IT always comes to the rescue and gets us back on track in a timely fashion. I would have no hesitation recommending the team.
We couldn't be happier that Key IT's expert IT skills popped into our lives here at Premium Capital Finance. Their sheer professionalism is second to none, whether it's their accessibility over the phone or dropping into our office on site — they always do an exceptional job. Would recommend to anyone who needs a reliable, knowledgeable IT expert.
Thank you to the Key IT team. You have always been available, knowledgeable and ready to help with all our IT needs and issues — from expert advice and troubleshooting to hardware. We don't have the time or capability to do it ourselves, and are comfortable knowing you're just a phone call away. You consistently meet all our needs for timely service, quality workmanship, expert advice and competitive pricing. We highly recommend Key IT and their team.
We've been working with Elias at Key IT for our IT support for the last 8 years, and have been most satisfied with their knowledge and service. In an office of non-technically minded workers, whenever we face an issue, Key IT responds promptly. They are patient and professional, and explain issues in plain English. They understand our IT needs, and we call on them whenever we need an upgrade.
Proof, not promises
150+ Melbourne organisations, looked after every day
From manufacturing and healthcare to finance, body corporate and professional services — a few of the businesses whose IT and security we run every day.
Elite Body Corporate
Probus GroupBook your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.