Security
How CaseRead keeps your documents private.
Where your documents live, who inside your firm can see them, who at CaseRead can reach them, and what happens to your data. In plain words, with each control checked against our code.
Your documents, in a schema of their own.
Other firms’ searches can’t reach your vault.
A schema for each firm
Each firm’s document vault (file records and text, search index, projects, folders and version history) lives in its own database schema, and the uploaded files sit in a private storage bucket, in a folder per firm. Vault search chooses the schema from the signed-in lawyer’s own account, never from the request.
Not exposed through our API
Firm vault schemas aren’t reachable through our public database API. A two-firm attack test in August 2026 found no cross-firm access.
What sits in shared tables
Conversations, chat attachments, project memory and calendar entries sit in shared tables protected by row-level security.
Who in your firm can see what
Private stays private, even from firm admins.
- Private by default. New projects are private to the lawyer who creates them. A private project is visible only to you and the colleagues you share it with, not to other firm members or firm admins. The database enforces this.
- Share on purpose. Keep a project private or share it with your firm.
- Three roles. Admin, member and viewer. Viewers are read-only: they can’t upload, edit, share or run research. Only admins can remove members.
Who at CaseRead can reach your data
Our engineers hold database credentials that could reach stored data. These are the controls on our admin console; direct database access sits outside them.
- No document screens. Our admin console has no screen that shows your documents or chats.
- Impersonation is logged before it starts. Support impersonation is written to an append-only audit log first. If the log can’t be written, it doesn’t start. Impersonation sessions expire after 15 minutes, and staff accounts can’t be impersonated.
- High-risk actions, logged first. The same audit-first rule covers firm and user deletion, data purges, password resets, invite links and bulk email.
- MFA on our admin console. Our staff admin console requires a TOTP code every session. Impersonating an account, resetting a password or deleting a firm requires one entered in the last 30 minutes.
- Usage records carry no document names. The usage and cost records our admin console reads never contain your document names or the text of your questions and answers.
Your data isn’t used to train AI models.
CaseRead runs no model training or fine-tuning. Our AI providers’ commercial terms exclude your data from their training.
CaseRead sends each task to the services that do it: Anthropic for reasoning, drafting, OCR and web search; OpenAI for the search index; and the public-law sources, which receive search queries. AI providers receive your data only for tasks you or your firm start, including workflows you schedule.
Encryption, hosting and deletion
Encrypted at rest
Our database host, Supabase, encrypts the data it hosts for us at rest with AES-256.1 Google and Microsoft connection tokens and share-link passwords are also encrypted by CaseRead with AES-256-GCM.
HTTPS enforced
Every page on www.caseread.ai sends an HSTS header (two years). Keys you issue to connect Claude, ChatGPT or Word are stored only as one-way hashes.
Database and files hosted in the US
Your firm’s database and files are hosted by Supabase on AWS in the United States.
One-step project deletion
Delete a project and its documents, versions, chats, memory, workflow results and share links in one step. We keep a content-free record that it happened. Events already sent to your calendar stay there, and our providers’ own retention terms still apply.
When an account is closed or disabled, its sessions and connected-app keys are revoked. If you’re a solo firm, closing your account deletes your firm’s document vault and chats (file removal is best-effort). In a larger firm, it removes your access and the firm keeps its documents.
The companies that process data for us are listed in our Privacy Policy.
- Supabase, “Security”: “All customer data is encrypted at rest with AES-256 and in transit via TLS.” Read September 14, 2026. supabase.com/security
Security questions
Can other firms see my documents?
Other firms’ searches can’t reach your vault. Your firm’s document vault lives in its own database schema, which our public database API doesn’t expose, and vault search only ever runs against the searcher’s own firm. A two-firm attack test in August 2026 found no cross-firm access.
Can CaseRead staff see my documents?
Our engineers hold database credentials that could reach stored data. Our admin console has no screen that shows your documents or chats. Through the console, staff reach an account’s content only by impersonating it, which is written to an append-only audit log before it starts and expires after 15 minutes.
Can other lawyers in my firm see my private projects?
No. A private project is visible only to you and the colleagues you share it with, not to other firm members or firm admins. The database enforces this.
Does CaseRead train AI on my documents?
No. CaseRead runs no model training or fine-tuning, and your data isn’t used to train AI models; our AI providers’ commercial terms exclude it.
Is CaseRead SOC 2 certified?
No. CaseRead hasn’t completed a SOC 2 audit, and we don’t print badges we don’t hold. This page lists the controls we do have.
Do you offer multi-factor sign-in or SSO for customer accounts?
No. Multi-factor sign-in is required on our staff admin console, not on customer accounts.
What happens when I close my account?
Its sessions and connected-app keys are revoked. If you’re a solo firm, your firm’s document vault and chats are deleted (file removal is best-effort). In a larger firm, you lose access and the firm keeps its documents. To erase one project, open it and choose “Delete this project…”.