Security at CaseChorus
Last updated: September 21, 2026
We understand you have an important duty to protect client confidences. When your firm puts a case file into CaseChorus, you remain responsible for that decision, and you need enough information to make it and to document that you made it carefully.
This page is that information. It is specific, and it includes what we have not built yet. We are an early-stage product and we would rather you know exactly where we stand than read a page of adjectives. Send us any security questionnaire you may have, and we will answer it.
Where your data lives
Everything runs on Amazon Web Services in a single United States region. Your uploaded files sit in encrypted object storage; your cases, questions, transcripts, and reports sit in an encrypted PostgreSQL database. Nothing is stored on anyone’s laptop or on any other cloud. The database runs across multiple availability zones, so losing one does not take the service down.
Encryption
Files and databases are encrypted at rest with AWS-managed keys that rotate automatically. All traffic is encrypted in transit with TLS, including between us and every service provider. Our database refuses unencrypted connections.
Separation between firms
Each firm’s data is isolated at the database level, enforced by the database itself through row-level security rather than by application code alone. The application separately checks authorization on every request. Uploaded files are stored under per-firm paths, and the application authorizes access before issuing any file link.
Access
Accounts are invitation-only. There is no public signup; we create each firm’s account and the firm invites its own people. Passwords are managed by AWS Cognito, use a 12-character complexity policy, and never reach our servers in readable form. Sessions expire after 30 minutes of inactivity and sign-in tokens last 15 minutes.
The product itself gives no CaseChorus employee a path to your case content. Our internal administrator role cannot open cases, and the temporary support-access mechanism that once allowed it has been removed.
Separately, a small number of our engineers hold production infrastructure credentials and can reach the database and file storage directly, as is true of any hosted product. They use that access to operate the service, resolve problems, and improve output quality, which can mean looking at the case that produced a bad result. Access is limited to the people who need it and everyone is under confidentiality obligations.
Your firm’s own visibility
The product keeps an audit trail of significant actions: creating and sharing cases, uploading and deleting files, changing roles. Your firm’s administrators can review it. Note that a firm administrator can see every case in the firm, and ordinary users see only cases they own or that were shared with them.
AI processing
We use Anthropic’s commercial API. Case facts, full document text, and image exhibits are sent to generate juror responses and reports. Under the commercial terms governing our account, Anthropic is not permitted to train its models on that content and deletes it within 30 days.
We send material as-is. We do not redact or de-identify before sending. If that matters for a particular matter, do not upload that matter.
We do not train any model on your data and we have no pipeline that could.
Software practices
The codebase is covered by automated tests with full coverage gates enforced on every change, plus browser-level end-to-end tests. Deployments run through continuous integration with required checks. Dependencies are scanned for known high-severity vulnerabilities, and container images are scanned on push. All credentials live in AWS Secrets Manager; none are stored in source code.
Retention and deletion
We keep your material until you delete it. Deleting a case or document removes the record and purges the stored file, including prior versions. A full firm deletion completes in our live systems within about 48 hours. Database backups roll on a seven-day cycle; system logs are kept 14 days.
We do not yet have automated retention limits or self-service firm deletion. Both are in development.
What we have not built yet
We would rather tell you than have you find out.
| Not yet in place | Status |
|---|---|
| Multi-factor authentication | Deliberately deferred during beta, including for administrators. On the roadmap |
| Single sign-on | Planned |
| Malware scanning on uploaded files | Planned. Files are checked by type and size, not scanned for malicious content |
| SOC 2 or ISO 27001 certification | Not started. We expect to begin once out of beta |
| Infrastructure-level access logging | In progress. Application-level audit logging is in place today |
| Tested backup restoration | Backups run daily; a restore has not yet been exercised |
| Formal incident response exercises | A written runbook exists; it has not been rehearsed |
Incidents
We have had no security incident to date.
If one occurs, we will tell affected firms without unreasonable delay and within 72 hours of confirming it, and we will give you what you need to meet your own notification duties.
Talk to us
Security questions, questionnaires, or a request for more detail than this page carries: legal@casechorus.com.
See also our Privacy Policy and our Data Processing Addendum.