Hey, thanks for your detailed response. I definitely wasn't implying that not using client-side encryption is obviously a bad decision on your part. I totally b

Hey, thanks for your detailed response. I definitely wasn't implying that not using client-side encryption is obviously a bad decision on your part. I totally buy that the security expertise of Dropbox et al is in a different league to that of most law firms. I'm a security researcher currently working on secure cloud storage and it's very interesting to hear about requirements of real users, especially for an industry as security sensitive as the legal industry. Regarding the exception you mention, what granularity would you make this distinction at? For example, would you typically just say that all files related to a particular case must be protected from a government agency, or would you divide up the storage of files for particular cases at a finer granularity (e.g. some files for this case can be stored on Dropbox). If Dropbox offered a solution with client-side encryption, how much do you think you would be willing to pay for it in terms of cost or performance?