Legal firms and confidential client calls: what you need to know

Transport encryption protects the link between your device and the provider's servers. It is the same idea as the padlock in your browser bar. Someone sitting on the same coffee-shop Wi-Fi cannot read the traffic, and a casual eavesdropper on the network cannot reconstruct the call.

What it does not do is hide the call from the provider. The audio is decrypted on the provider's servers to route it, which means the company operating the service can, in principle, access it. Most business VoIP falls into this category. It is meaningfully secure against outsiders and meaningfully open to the vendor.

End-to-end encryption (E2EE) means the call is encrypted on your device and only decrypted on the other person's device. Nobody in between, including the provider, can access the content. This is the standard set by Signal and by browser-to-browser WebRTC calls.

E2EE is the strongest confidentiality guarantee available, but it comes with a real constraint: it only works when both endpoints are running compatible encrypting software. The moment a call crosses onto the ordinary phone network to reach a regular number, end-to-end encryption ends, because the phone network cannot decrypt it.

SRTP (Secure Real-time Transport Protocol) encrypts the actual voice packets, and DTLS handles the key exchange that sets up that encryption. These are the building blocks that make both transport encryption and WebRTC end-to-end encryption possible.

For a browser-to-browser WebRTC call, DTLS negotiates keys directly between the two browsers and SRTP encrypts the media between them, with no server in the middle holding a decryptable copy. That is what makes a browser call end-to-end encrypted rather than merely transport-encrypted.

Encryption protects what was said. It does not usually hide who called whom, when, and for how long. That record, the metadata, can itself be sensitive: the fact that a particular client called a particular attorney at a particular time can reveal a relationship you would rather keep private, even if nobody ever hears a word of the conversation.

The most secure call in the world is worthless if the device on either end is compromised. Malware on a laptop, a shared family computer, an unlocked phone, or someone standing within earshot defeats any encryption. Confidentiality is a property of the whole situation, not just the wire.

If a call is recorded, the recording is a stored file that encryption of the live call says nothing about. Where it lives, who can access it, and how it is protected are separate questions. FreeCallMe does not record calls, so there is no stored recording to secure, but any tool that does record moves confidentiality onto the storage layer.

Encryption is a technical control, not a legal shield. A provider that can access call content or metadata can be served with a subpoena or a warrant and required to produce what it holds. True end-to-end encryption limits what a provider is able to hand over because it never holds the content in readable form, but that is a property of the architecture, not a promise the provider makes to a court.

A quieter confidentiality question is what remains after you hang up. A browser-to-browser FreeCallMe call is ephemeral: the session ends when the tab closes, there is no stored recording, and nothing about the conversation is retained. A platform that keeps rooms, transcripts, or history alive after the call is a different confidentiality posture, and worth checking before you use it for privileged conversations.

The ABA Model Rules of Professional Conduct require a lawyer to make reasonable efforts to prevent the unauthorized disclosure of client information (Model Rule 1.6(c)). The standard is not perfection and not a specific technology. It asks whether the measures you took were reasonable given the sensitivity of the information and the cost and difficulty of stronger safeguards.

ABA Formal Opinion 477R applied this to electronic communication and concluded that lawyers must make reasonable efforts, assessed case by case, and that more sensitive matters may call for stronger protections such as encryption. It deliberately avoids mandating one tool, because reasonableness is contextual.

State bars have echoed the reasonableness framing. The New York State Bar Association has issued guidance treating encryption and vendor diligence as part of a lawyer's competence and confidentiality duties, with the level of protection scaled to the sensitivity of the matter.

California's guidance similarly frames technology choices under the duties of competence and confidentiality, asking lawyers to weigh the sensitivity of the information, the available safeguards, and the client's own instructions and expectations before relying on a given method of communication.

Across the ABA and the states, the rule is not 'use product X.' It is 'make a reasonable, documented judgment for the matter in front of you.' For routine matters, transport-encrypted VoIP may be entirely reasonable. For the most sensitive conversations, end-to-end encryption, a signed agreement, or a different channel entirely may be the reasonable choice. The obligation is to think it through, not to buy a specific badge.