The problem
The old EK Lawyers site was old in the way that actually costs a law firm business. It didn’t reflect the practice as it exists today, it gave search engines nothing structured to work with, and there was no secure channel for a client to exchange documents once a matter was underway — everything ran over email.
For an insolvency and business law practice, that last point isn’t cosmetic. The documents moving back and forth in an insolvency matter are financial records, creditor correspondence, statements of position — exactly the material that shouldn’t be sitting in an email thread on somebody’s phone. A firm can be diligent about it and still have no record of who accessed what, and no way to prove it later.
What we built
A full rebuild of the public site — home, services by practice area, about, team, insights, results, contact — alongside legal boilerplate that needed a proper pass rather than a template (privacy, terms, disclaimer). That was the smaller half of the job.
The larger piece is a secure client portal behind it, built on Next.js and Postgres:
- JWT authentication with MFA — a second factor, not just a password, because the material behind the login warrants it.
- Role-based access control — so a client sees their matter and nothing else, and staff access is scoped rather than universal.
- Encrypted document storage, with ClamAV malware scanning on every upload. A portal that accepts files from the public is an attack surface; scanning at the door is the cheap part of not regretting it.
- A full audit log — who accessed which document, and when. This is the part email can never give you, and the part that matters when a matter is later disputed.
None of that is a brochure feature. It is software a firm’s clients log into and depend on while their matter is live, which sets a different bar than a marketing site does: it has to be available, it has to be right, and it has to keep a record of itself.
The review pipeline
Alongside the portal we built an automated review-request pipeline — a secure, tokenised email sequence that asks a client for a Google review once their matter closes. It follows up on day 14 and day 28 if there’s no response, carries a one-click opt-out so nobody gets chased after they’ve already left one, and deduplicates per matter so a client with two files open doesn’t get asked twice. It is live in production now.
The reason it exists: for a professional services firm, the Google Business Profile and the reviews attached to it are a substantial share of what a prospective client actually sees. Most firms know this and still don’t ask, because asking is an awkward manual job that lands at the end of a matter when everyone has moved on. Automating the ask is the whole intervention.
SEO/GEO, built in from day one
Every page shipped with real metadata and OG images, a proper sitemap.xml and robots.txt, and an llms.txt so AI assistants can read the firm’s services cleanly rather than inferring them. Structured data covers LegalService and FAQPage.
The goal is specific: when someone asks Google — or asks ChatGPT or Perplexity — who handles insolvency in Sydney, the firm shows up with the right answer already attached, rather than being one of the sites an assistant couldn’t parse and therefore didn’t mention. Retrofitting this later costs more than building it in, which is the argument for doing it during a rebuild rather than after one.
Where we are
The rebuild is complete and about to go live, replacing the old site outright. Next: wiring the review pipeline directly into the firm’s LEAP practice management system, so a request fires the moment a matter is marked complete and nobody has to remember to trigger it.