Security overview
How Cases is built and run to keep your matters confidential: the short version for a first review.
Architecture
Cases is a web application served from a single hardened production environment. Traffic enters through Cloudflare, which terminates TLS and filters abusive requests before they reach the origin. The application, its workers and its database run on private infrastructure; the database is never reachable from the public internet.
Data protection
- In transit: TLS 1.2 or later on every connection, with HSTS.
- At rest: AES-256 on the database volumes, the document store and every backup.
- Secrets: held in a managed secret store, never in source control or on disk in plain text.
- Isolation: every record carries its workspace. Access is checked per request, per route.
Access
Staff access to production is limited to named engineers, requires SSO with hardware-backed MFA, and is logged. Customer data is accessed only to provide support you ask for.
AI processing
Documents are analysed by large language models under enterprise agreements that prohibit training on your data and set zero data retention. Every claim Cases makes is linked to the passage it came from, so a reviewer can check it against the source.
Resilience
Encrypted backups are taken continuously with point-in-time recovery and restored in regular drills. Deploys hand traffic over without dropping connections.
Reporting a vulnerability
Write to [email protected]. We acknowledge within one business day and will not pursue good-faith research.