Custom software vs. off-the-shelf vs. Zapier or Make for law firms

Off-the-shelf fits standard workflows, Zapier or Make fits simple links between cloud tools, and custom fits firm-specific workflows with several systems, review steps or strict data control. The three are not exclusive: one firm can use each for a different job.

The table compares them on the criteria that decide most cases. It reflects our experience and the vendor pages cited below, and the right answer for a given workflow still depends on your systems and volume.

Off-the-shelf wins whenever a mature product already does what you need, because someone else carries the development, security updates and support. Check your current practice management system first, because it may already cover the workflow.

The SRA's compliance tips for solicitors make the same point: see what your existing technology can already do before buying anything new, have the product demonstrated against your requirements, speak to someone who uses it, and confirm it works with your other systems.

Off-the-shelf reaches its limit when your workflow differs from the product's model, when data has to flow between two products that do not talk to each other, or when you need a review step the product does not offer.

Zapier or Make is enough when the steps are simple, both apps have ready connectors, volumes are moderate, and the provider's terms and hosting pass your confidentiality review. A new web form entry creating a contact is a typical example.

Pricing on September 24, 2026: Zapier Free includes 100 tasks per month. Professional starts at $19.99 per month billed yearly or $29.99 billed monthly, Team at $69 or $103.50 for up to 25 users with SAML single sign-on. Zapier counts a task each time it successfully completes a unit of work; triggers do not count, and with pay-per-task billing switched on, tasks beyond the plan are charged at a higher rate.

Make's Free plan includes 1,000 credits per month. Core is $9, Pro $16 and Teams $29 per month for 10,000 credits billed annually, or $10, $18 and $34 billed monthly. Each module action counts as one credit. Detailed execution logs are kept 7 days on Free, 30 days on Core, Pro and Teams, and 60 days on Enterprise.

Example, with stated assumptions: 60 new inquiries a month, each running a workflow with 4 action steps, and one task per action step. That is 240 tasks, inside Zapier's entry Professional tier of 750 tasks. The numbers change quickly once a workflow loops over documents or line items, so estimate from your real volume.

With either platform, client data passes through the automation provider's cloud in addition to the two apps you connect. Zapier states it is hosted on AWS in the United States; Make's pricing page lists AWS hosting in the EU or North America.

Both publish security information. Zapier states SOC 2 Type II and SOC 3 reports, TLS 1.2 or higher in transit and AES-256 at rest; it opts Enterprise customers out of AI training automatically, and other customers opt out by form. Zapier lists audit logs on Team (6 months) and Enterprise (1 year) and custom data retention on Enterprise. Make states SOC 2 Type II and SOC 3 audits, AES-256 encryption and a default log retention of 30 days, and lists audit logs and company single sign-on on its Enterprise plan.

For UK firms, sending personal data to a provider outside the UK can be a restricted transfer under UK GDPR. The ICO says it then needs adequacy regulations, an appropriate safeguard with a transfer risk assessment, or an exception. For US firms, Rule 1.6(c) and Opinion 512 require the vendor review described below. None of this is a legal conclusion about your firm; check it with your adviser.

Custom software is worth building when a recurring workflow is specific to your firm, touches several systems, needs defined review points and logs, or must keep client data inside your own environment. Typical cases are intake with a conflict check, deadline escalation and document assembly from matter data.

It is not worth it for a process that runs twice a year, for a workflow a product already covers well, or on top of a process that is broken. In those cases we say so, and our process check can end with the answer that automation does not pay off.

Custom also means we build on what you have. If your practice management system has an API, the new system uses it, so there is no additional platform for your staff to learn.

Someone always has to: APIs change, connectors break, staff leave and workflows evolve. The question is whether that someone is a vendor, an employee who built a Zapier workflow on the side, or a developer with documentation.

The weakest setup is an automation that one person built and nobody else understands. Whatever you choose, keep a written description of each workflow, who owns it, which data it touches and what happens when it fails. With custom software from us, you get the source code, the infrastructure and the documentation, so another developer could take it over.

The same checks apply whether you buy, connect or build: read the terms of use and privacy policy, know who can access the data, whether it is retained or used for training, and how you will hear about a breach. ABA Formal Opinion 512 sets these out for AI tools, drawing on earlier cloud computing opinions.

Rule 5.3 Comment 3 names internet-based storage of client information as a nonlawyer service outside the firm, where the lawyer must make reasonable efforts to ensure the service is compatible with the lawyer's obligations. In the UK, the SRA's compliance tips expect the COLP to be responsible for regulatory compliance when new technology is introduced. Our guide to AI and Rule 1.6 goes into these checks in detail.