I'm planning infrastructure for a court-reporting agency that will store sensitive transcripts, audio recordings, protected health information, and attorney work product. The proposed setup is TrueNAS Scale with ZFS snapshots, replication, and encryption; an ASUS Pro WS W680 ACE motherboard with IPMI; an Intel i5-14500; 32 GB ECC DDR5; four 12 TB IronWolf Pro drives in RAIDZ2; mirrored 500 GB NVMe boot drives; a 750 W Seasonic power supply; a large Fractal Design case; and a line-interactive UPS. Networking would use a FortiGate 91G firewall, a PoE FortiSwitch, and a dedicated administrative PC. The NAS and firewall would be the only systems managed from that admin workstation.
Contractors would authenticate through their managed devices, Intune, MFA, Entra ID, and a remote-access or ZTNA workflow before reaching only their assigned NAS folders. Clients would have download-only access to their own folders. I'm also planning a 3-2-1 backup strategy with long-term retention: an on-premises copy, an off-site TrueNAS copy, and cloud cold storage such as Backblaze B2, Amazon S3 Glacier, or Azure Blob Storage.
Does this architecture make sense for a small business handling regulated and confidential data? What major security, compliance, identity, backup, support, or usability issues should I address before building it?
4 Answers
Work backward from your legal and regulatory obligations before choosing hardware. Depending on the cases and jurisdictions, you may need to address HIPAA, state privacy laws, contractual confidentiality requirements, litigation holds, retention schedules, access logging, breach response, and possibly payment-card requirements. Get advice from a qualified compliance or security professional, then document a threat model, access-control policy, incident-response plan, and recovery objectives. Sensitive data should not be exposed through a complicated custom workflow just because the components are available.
The biggest concern isn’t whether the hardware can run TrueNAS; it’s whether the whole system can be supported, audited, and recovered when something goes wrong. A custom-built server may be fine for a lab, but a business handling confidential records should consider supported hardware, a support contract, documented procedures, spare parts, monitoring, and tested disaster recovery. A managed document platform or business storage service could also give you simpler sharing, MFA, auditing, retention, and permission management without having to engineer all of that yourself.
The backup plan is a good starting point, but snapshots and replication are not substitutes for independent backups. Define recovery-point and recovery-time targets, use immutable or otherwise protected backup copies, encrypt backups with carefully managed keys, monitor backup jobs, and perform regular restore tests. Keep at least one copy isolated from ordinary administrator credentials and ransomware paths. Also account for the cost and time of long-term cloud retrieval, and document how seven- or ten-year retention will work when software, encryption keys, and file formats change.
A few extra hard drives in another location are not enough by themselves. The useful goal is multiple copies on different media or services, with at least one offline or immutable copy and a tested recovery process.
The identity design needs more investigation. Entra ID, Intune, and MFA do not automatically translate into secure per-folder permissions on a standalone TrueNAS deployment. Verify exactly how users and groups will be mapped, how contractor and client accounts will be separated, how download-only access will be enforced, and whether every access is logged. A purpose-built SaaS document portal, SharePoint or another managed file platform may provide those controls more cleanly. If you keep the NAS, use least privilege, separate administrative accounts, restrict management interfaces, segment the network, and avoid exposing the storage system directly to the internet.
A cloud service isn’t automatically compliant or secure, but it does move much of the maintenance and authentication burden to a provider. Make sure the chosen service supports the required agreements, retention, audit logs, legal holds, and export or recovery requirements.