Where a Notary's Office Should Store and Protect Legal Documents in the Cloud Era
A notary's authentic acts live in the regulated MICEN, but the office also handles drafts, scans and client files. How to store those confidentially in 2026.
Mathis Belouar-Pruvot
· founder of Filarr · 11 min read
Quick Answer
A notary's authentic acts (the minutes) are not a cloud problem you solve alone: electronic authentic acts in France follow a regulated channel and are archived in the notariat's own central electronic repository (the MICEN), not in a personal Dropbox or a generic SaaS. The real question is everything else the office handles every day: drafts, client correspondence, scanned IDs, title searches, estate files, internal notes. For those, professional secrecy (secret professionnel) and the GDPR's security obligation (Article 32) mean you must control where the data sits and who can technically read it. A classic cloud provider holds the decryption keys and can be legally compelled to hand data over; client-side, zero-knowledge encryption keeps those documents unreadable even to the host. This article is general information, not legal advice.
Why this question keeps notaries up at night
A notarial office (étude or office notarial) is in an unusual position. The notary is a public officer, trusted with some of the most sensitive documents in a person's life: wills, marriage contracts, property deeds, inheritance files, company statutes. With that role comes professional secrecy, and a breach is not just an ethical failure, it is a criminal offense. In France, the violation of professional secrecy is punishable under Article 226-13 of the Code pénal (up to one year of imprisonment and a 15,000 euro fine). Few professions carry a confidentiality duty that strict.
At the same time, offices have gone digital. Télé@ctes, electronic signing, scanned supporting documents, email exchanges with clients and banks, shared drives between clerks (clercs) and the notary. The paper safe has quietly been replaced by a mix of local servers, professional software, and, very often, a generic cloud account that nobody formally vetted. That last part is where the risk concentrates.
The worry is legitimate and concrete. If a cloud provider is breached, if a laptop is stolen, if a clerk's account is phished, who can actually read the files? And if the provider is subject to a foreign jurisdiction, can it be forced to disclose data regardless of what French law says? These are not hypothetical fears. They are the exact scenarios professional secrecy was written to prevent.
The answer, structured
1. Separate the authentic act from the rest of the office's data
This distinction is the single most important thing to get right.
The authentic act itself (the minute) has its own legal life. Since the mid-2000s, French law has allowed the acte authentique électronique (AAE), and electronic minutes are archived centrally by the notariat through its dedicated infrastructure (the Minutier Central Électronique des Notaires, operated by the profession's own bodies). You do not, and should not, store an electronic authentic act in a consumer cloud. That channel is regulated, and it is not where your decision lies.
What you actually decide about is the surrounding mass of data: working drafts before signature, client supporting documents (IDs, bank statements, property titles), correspondence, internal notes, archived copies, the shared folder every office keeps. This is the data that ends up in email, on a shared drive, or on a cloud account, and this is where confidentiality is most often lost.
So the honest framing is: the minute follows the notariat's regulated path; the office's everyday documents are yours to secure properly.
2. Understand what "encrypted" actually means for your files
Most cloud services say they encrypt your data. That is true, and it is also not the protection you think it is. There is a crucial difference between encryption where the provider holds the keys and encryption where only you do. If the provider holds the keys, your files are readable by the provider, by anyone who compromises the provider, and by any authority that lawfully compels the provider. The term for the stronger model is zero-knowledge: the host stores only unreadable blobs and literally cannot decrypt them.
The practical consequences of this difference show up only in the worst moment, a breach. We walk through exactly what leaks in each model in our comparison of local encryption versus classic cloud storage during a data breach, and the precise vocabulary (encrypted at rest versus end-to-end versus zero-knowledge) is untangled in our guide to the concrete differences between these three terms. For a notary, the takeaway is simple: "encrypted at rest" on a mainstream cloud does not satisfy the spirit of professional secrecy, because a third party can still read the files.
3. Factor in where the data is hosted
Professional secrecy and the GDPR do not stop at the cloud provider's reassurances. Where the data physically sits, and under whose jurisdiction the provider falls, matters. A provider subject to extraterritorial laws (for example, US legislation such as the CLOUD Act) can be ordered to produce data it holds the keys to, even when that data belongs to a French notary and sits on European servers. Hosting data outside the EU is not automatically unlawful, but it is a regulated transfer that you must be able to justify. We cover the real risk and the nuances in our analysis of hosting data outside the EU under the GDPR.
The clean way out of this debate is the same for notaries as it is for any profession under a strict secrecy duty: if the provider never holds a usable key, the jurisdiction question loses most of its sting, because there is nothing readable to compel.
4. Match the storage model to the data
Here is a practical comparison of the options an office realistically faces.
| Storage model | Who can read the files | Fits authentic acts? | Fits office working documents? | Main caveat |
|---|---|---|---|---|
| Notariat's regulated channel (electronic minutes) | The profession's own secured system | Yes, this is the legal path | No, it is not a general file store | Not your decision to make elsewhere |
| Mainstream cloud (generic consumer or business SaaS) | Provider holds the keys | No | Risky | Provider and authorities can read; check jurisdiction |
| EU-hosted business cloud | Provider holds the keys | No | Only with care | Better data-residency story, but provider still reads |
| Local storage with client-side (zero-knowledge) encryption | Only you | No (acts have their own channel) | Yes, strong fit | You own key management and backups |
| Qualified sensitive hosting (for example SecNumCloud-labelled offerings) | Provider under strict label | Depends on the service | For some regulated workloads | Cost and scope; verify the label actually covers your use |
The row that most offices overlook is local storage with client-side encryption. It is the model where the confidentiality guarantee is technical rather than contractual: the file is scrambled on your machine before it ever moves, so a stolen laptop, a breached sync server, or a compelled provider all yield the same thing, noise.
What this means concretely for your office
You do not need an IT department to raise the floor significantly. A handful of controls do most of the work:
- Turn on full-disk encryption on every machine (BitLocker on Windows, FileVault on macOS). This protects against the single most common incident, a lost or stolen device.
- Stop sending sensitive attachments through ordinary email and consumer file-transfer tools. Most of them are not end-to-end encrypted, as we detail in our look at whether WeTransfer is actually encrypted. Prefer a link where the decryption key never reaches the server.
- Encrypt the office's working documents client-side, so that whatever happens to the drive or the sync server, the content stays unreadable. Our practical guide to encrypting notes and documents covers threat models and tool trade-offs honestly.
- Enforce strong authentication (a password manager and multi-factor authentication) on every account that touches client data, including email.
- Keep backups, and keep them encrypted. A backup that leaks is just a second copy of the breach.
- Write down a short retention and deletion policy. Notarial minutes have long legal conservation durations (electronic minutes are retained for decades before being transferred to public archives), but the supporting documents and drafts around them should not be kept forever "just in case". The GDPR expects you to keep personal data only as long as necessary.
The neighbouring professions face the exact same structure of problem, and the controls translate directly. If you want to see how it reads for an adjacent public-trust role, our guides on GDPR and client document storage for accounting firms and on where health professionals should store patient notes under secrecy and GDPR walk the same path with different legal constraints.
Where Filarr can help (and where it cannot)
To be clear and honest about the boundary: Filarr is not a channel for authentic acts. It does not replace the notariat's electronic minute repository, it does not sign authentic acts, and it is not a GDPR certification, an HDS health-data label, or legal advice. If you are looking for where to store an electronic minute, that is the regulated profession's system, not Filarr.
Where Filarr fits is the office's everyday working data: drafts, scans, client supporting documents, internal notes, the files you would otherwise drop into a generic cloud folder. Filarr is a local-first workspace that encrypts every file on your disk with AES-256-GCM, using a separate key per file (a file key wrapped by a key derived from your password with PBKDF2-SHA512 at 600,000 iterations, with Argon2id available). It works fully offline. If you want a copy off-site, the optional cloud sync is zero-knowledge: files are encrypted on your machine before upload, and the server stores only opaque blobs it cannot read. You can also point it at your own S3-compatible bucket (bring your own storage) if you want the data to sit somewhere you control.
Honest limitations you should weigh: Filarr is young (its ecosystem and community are smaller than long-established tools), its mobile app is still in progress, and because the encryption is real, losing your password and your 24-word recovery phrase means the data is gone, which puts backup and key custody squarely on you. The desktop client is open source under BSL 1.1. Filarr is free forever for local use, with optional sync starting at 4 euros per month.
In short: use the regulated channel for the acts, and use strong client-side encryption for the confidential pile of documents around them.
FAQ
Can a notary store electronic authentic acts in a regular cloud like Google Drive or Dropbox? No. Electronic authentic acts follow the notariat's own regulated archiving channel, not a consumer or business cloud. The cloud question only genuinely concerns the office's surrounding documents: drafts, scans, correspondence, and client files.
Does encrypting our files make the office GDPR compliant? No single tool makes you compliant. Encryption is one of the security measures the GDPR expects (Article 32 references encryption where appropriate), but compliance depends on your whole processing: legal basis, retention, access control, records, and more. Encryption strongly reduces the impact of a breach, which is a large part of the risk, but it is not a certification.
Is hosting our data on a US provider's European servers a problem for professional secrecy? It can be. A provider subject to foreign extraterritorial law can be compelled to disclose data it can read, regardless of where the servers physically are. If you must use such a provider, prefer architectures where the provider never holds a usable decryption key, so there is nothing readable to hand over.
What is the difference between "encrypted at rest" and "zero-knowledge" for our files? Encrypted at rest usually means the provider encrypts the data but also holds the keys, so it can read your files and so can anyone who compromises or compels the provider. Zero-knowledge means only you hold the keys and the host stores unreadable blobs. For a confidentiality duty as strict as a notary's, the second model is the one that actually matches the obligation.
How long must we keep client documents? Authentic minutes have long legal conservation durations and are eventually transferred to public archives, so you do not simply delete them. The supporting documents and drafts around a file are different: the GDPR expects you to keep personal data only as long as necessary for the purpose, so define a retention and secure-deletion policy for that everyday material rather than hoarding it indefinitely.