In the LAB, Nicole Black is (unsurprisingly) full of good information on ethics and the cloud:
Also, the ABA recently revised Model Rule 1.1 to require lawyers to not only to maintain a knowledge of law and a level of skill in the practice of law, but it also now requires lawyers to have (and maintain) proficient knowledge and skills related to legal technologies. So a vendor green light from a bar association wouldn’t be enough, in any event. You still have to have tech proficiency.
See, it’s just not okay to be a Luddite, anymore. You cannot be ethical if you don’t understand what you are doing with your data. You can’t just hire someone else to take care of your data, either. Not without understanding what it is they are doing. You cannot outsource ethics.
You can’t just avoid the cloud, either. Most cloud services are much more secure than your average solo or small firm with no IT department can manage. Staying out of the cloud is not magically more ethical than maintaining your own non-secure PC or file server.