Security & data handling

Case isolation (shared tenancy)

Free, Plus, Professional, and Firm plans run on shared application infrastructure (shared-tenancy hosting). Isolation is enforced in software and schema — not by giving every customer a separate physical server.

Every tenant table carries a case_id. API access checks the active case grant on each request. Media storage keys are namespaced per case. Join tables use composite foreign keys so a row in case A cannot link to an event or file in case B. Guessing another case id does not confirm whether that case exists.

Enterprise / dedicated deployments can place compute and storage on an isolated footprint when that is part of the engagement.

• Verified Free self-signup; case access remains grant-based
• Per-case roles (including Expert tag scopes)
• Case-namespaced, content-addressed media keys
• Composite foreign keys blocking cross-case links at the database

AI processing — self-hosted primary, peak-demand fallback

Features that read case files (audio/video transcription, document OCR/vision, event drafting, file analysis) run primarily on closed, operator-controlled models: self-hosted speech recognition and self-hosted multimodal/text models on private infrastructure.

During periods of peak demand, those same features may temporarily use third-party frontier model APIs (currently OpenAI’s API tier) under arrangements that do not use your content to train those models. Only the content needed for the job is sent. See the AI Disclosure page for the full description and subprocessors.

We do not use customer case content to train public foundation models.

Separately, transactional email (Amazon SES) and optional Google sign-in involve those vendors for messaging and authentication — not as a substitute for the AI Disclosure rules above.

Optional operator-enabled error reporting (Sentry) and coarse product analytics (Mixpanel) may receive technical diagnostics and fixed usage events (paths and actions such as signup or upgrade). They are not used to send case exhibit bodies or transcript text. See the Privacy Policy.

A GlobalAdmin can change AI provider routing in the admin console. Enterprise customers may request a configuration that disables frontier-model fallback. Material changes to production routing will be reflected on this page and the AI Disclosure.

Human-in-the-loop

AI draft events stay not-reviewed until a person confirms them. Upload-time timestamps are flagged as not real occurrence dates. Provenance chips show whether a date or text came from EXIF, embedded metadata, AI suggestion, or upload time. The product is built so automated output does not silently become “the record.”

Authentication and sessions

Sessions use an HTTP-only cookie. Passwords use argon2. Google sign-in is attach-only to pre-created accounts on /login; Continue with Google on /signup may create a Free-tier account when signup is open. Password changes invalidate other sessions. Login and related endpoints are rate-limited.

Encryption in transit and at rest

Public access is over TLS (HTTPS) at the edge. Application traffic to the database uses encrypted connections.

Data at rest is encrypted with cloud-provider managed keys: the application database (Cloud SQL), evidence object storage (Cloud Storage), and worker disks. Enterprise engagements may specify additional controls (dedicated hosts, customer-managed keys, etc.).

No sale of user data

We do not sell personal information, account data, or case content. Operating the product may involve subprocessors (hosting, email, authentication, and AI as disclosed on the Privacy Policy and AI Disclosure pages); that is not a sale of your data. See the Privacy Policy section “We do not sell your data.”

Incidents

If we become aware of a security incident affecting your case content or account data, we will investigate, contain, and notify affected customer contacts without undue delay, consistent with applicable law. Report suspected issues via the contact form with enough detail for us to reproduce or investigate.

Your responsibilities

Choose appropriate invitees and roles, protect credentials, set real dates before approving drafts, and treat downloads and exports (including vault zips) as sensitive once they leave the service.