Privacy & Security Policy
Last updated: 2026-05-22
Security first — not buried at the bottom
You are considering uploading your bank statements, credit card statements, and family-court financial disclosures to a website you have never used before. That is a leap of faith. The rest of this document is what we have done to deserve it.
Security is not an afterthought at Casefile. It is the first thing we built, before the AI assistant, before the affidavit generator, before the landing page. We will keep this page honest. If a claim here ever stops being true, we will change it before we change anything else.
Specific scenarios — "what if X happens"
These are the worries we hear most. Here is what is actually true.
A full database dump produces zero readable PII. Every sensitive column is encrypted with AES-256-GCM under a per-row data key, wrapped by a per-user key, wrapped by a master key that is not on the database server. We verify this with grep on every release.
The database refuses connections from outside the server. It is bound to 127.0.0.1 only. A leaked password cannot be used remotely. And even if an attacker reached the database, every sensitive column is ciphertext.
Your uploaded file contents are stored as AES-256-GCM ciphertext blobs. The encryption keys are not on the file system; they live in our key management vault. FTP access exposes encrypted blobs that are useless without the vault.
Our nightly backups are themselves encrypted with a separate key, held under a separate access policy from the runtime application. A stolen backup is unreadable without that backup-specific key.
No one at Casefile can bulk-read user documents, even the founder. The admin panel shows metadata only. To view a single sensitive field for a single user (only ever for support reasons), the admin must enter a fresh 2FA code, the action is rate-limited to 10 per hour, every reveal is permanently audit-logged, and document file contents can never be decrypted through the admin path at all.
This is the hardest scenario. Our master key is held in a separate key management vault, with auto-unseal backed by an off-server cloud KMS. A server compromise gives the attacker the vault address but not the unseal credential. To decrypt anything they would additionally need to compromise the cloud KMS account — a separate authentication boundary with its own MFA. The runtime application is also continuously monitored for anomalous access patterns and unusual decrypt volume.
What Casefile is, and is not
Casefile is a document and finance preparation tool for parents navigating Illinois child support and custody cases. We organize your documents, parse your bank statements, and auto-populate the Illinois 13.3.1 Financial Affidavit. We hand the result to you. You hand it to your licensed attorney.
Casefile is not a law firm. We do not provide legal advice. We do not predict outcomes. We do not draft pleadings. We do not file anything on your behalf. Built by Champlin Enterprises in Illinois.
What we collect, and exactly why
We collect only what we need to do our job.
- Your email address and a password hash — so you can log back in.
- A TOTP 2FA secret — because we require two-factor authentication, no exceptions.
- Documents you upload — because that is the product.
- Transactions our parser extracts from your statements — to auto-fill your 13.3.1 affidavit.
- Case-level metadata you enter (county, opposing party name, attorney email) — to pre-fill the affidavit's header.
- Your IP address when you log in — for audit trail and rate limiting.
- Your Stripe customer ID and subscription status — to bill you and let you cancel.
We do not collect: tracking cookies for advertising. Cross-site fingerprints. Your social security number. Your bank account or routing numbers. Information about your children's identities. Health information beyond what you voluntarily upload.
How we protect what we collect (12 layers, defense in depth)
Plain English, layer by layer.
- Encrypted in transit. TLS 1.2 or higher. HSTS preload enrolled, so modern browsers refuse plaintext even before reaching our server.
- Encrypted at rest with per-document keys. Every uploaded file gets its own AES-256-GCM key, wrapped by your account key, wrapped by our master key in HashiCorp Vault with cloud KMS auto-unseal.
- Encrypted sensitive database columns. Transaction descriptions, amounts, account numbers, case metadata, assistant messages, affidavit drafts — every one is encrypted at rest with the same envelope above. A full mysqldump produces no readable PII.
- Encrypted backups under a separate key. Our nightly backups are encrypted with a SECOND master key, held under a SEPARATE access policy. Compromising the runtime app does not compromise the backups, and vice versa.
- The database does not listen to the internet. MariaDB bound to 127.0.0.1. A leaked database password is useless from outside the server.
- Append-only audit log. Every action on your account is logged, and the database refuses to UPDATE or DELETE audit rows at the trigger layer. The web application user has the DELETE privilege revoked at the grant layer.
- Admins cannot bulk-decrypt. The admin panel is metadata only. Per-field reveal requires fresh 2FA, is rate-limited, and is audit-logged. File contents can never be decrypted through admin paths.
- AI assistant is opt-out. Disable in Settings to stop sending any document text to Anthropic. We are pursuing a written zero-retention contract with them.
- Search index never sees plaintext. We use HMAC token fingerprints, not full text. The search engine could not produce a readable document if it tried.
- Cloudflare WAF at the edge. Bot traffic, OWASP top-10 patterns, and brute-force attempts are filtered before reaching our application.
- Behavior anomaly detection. Continuous monitoring of audit log patterns alerts in near-real-time on unusual mass-download patterns, repeated failed logins from one source, or admin actions outside normal scope.
- Strong passwords + mandatory 2FA. We check your password against Have I Been Pwned's leaked-password database. Bcrypt cost factor 14. TOTP 2FA required to even reach your dashboard.
What we are NOT claiming
We do not believe in marketing-speak security claims. Read this carefully.
- We are NOT "end-to-end encrypted" in the cryptographic sense. That term means only you can decrypt — that the service cannot. Casefile is not that. We hold the keys to decrypt your data because the AI assistant, the affidavit generator, and the document search all need plaintext to work. Anyone marketing "end-to-end encrypted" while also offering AI features is lying or does not know what end-to-end means.
- We are NOT "zero knowledge." Same reasoning.
- We are NOT HIPAA-certified. Casefile is not a medical record system. Medical documents you upload get the same envelope encryption as everything else, but we make no HIPAA claims.
- We are NOT SOC 2 certified yet. A formal SOC 2 audit is on our roadmap once revenue justifies the cost. In the meantime we publish this Security section to demonstrate the controls.
Where your data goes (sub-processors)
- HashiCorp Vault (our infrastructure) — holds the master encryption key. Cannot see any user data.
- AWS Key Management Service — holds the credential that unseals Vault at boot. Cannot see any user data.
- MariaDB (our infrastructure) — stores ciphertext of your records. Cannot read plaintext.
- Bunny.net — stores ciphertext of your uploaded files. Cannot read plaintext.
- Backblaze B2 — stores ciphertext of our nightly backup blobs. Cannot read plaintext.
- Anthropic — sees plaintext of documents you submit to the AI assistant, ONLY when AI access is on. Zero-retention contract pending; default retention is 30 days. Disable AI access in Settings to opt out entirely.
- Stripe — sees your name, email, and payment method. Never sees uploaded documents.
- Mailgun — sees email subjects and bodies for system emails. Never sees uploaded documents.
- Sentry — sees error stack traces. Our redactor removes encrypted-row contents and PII patterns before payload leaves our server.
- Cloudflare — sees HTTP request metadata. Never sees uploaded document contents.
What you can do (your controls)
- Toggle AI access off in Settings → Privacy. The assistant becomes unavailable; documents are never sent to Anthropic.
- Export all your data from Settings → Privacy. ZIP includes every uploaded document (decrypted into your local ZIP) plus JSON of cases, transactions, affidavits, AI conversations, and audit log.
- Delete your account from Settings → Privacy. We start a 7-day cancellation window during which you can change your mind. After that, encrypted blobs are permanently deleted from storage, backups, and the search index. Audit logs are retained 2 years with your identifier scrubbed.
- Audit your activity from Settings → Security. See every login, document access, affidavit generation, and admin reveal involving your data.
How long we keep it
We keep your data while your account is active. On deletion, documents and transactions and drafts and conversations and search-index entries are permanently destroyed within 7 days. Audit logs are retained 2 years with your user identifier nulled, for compliance and forensics purposes.
Breach notification commitment
If we confirm a security incident that affected your data, we commit to:
- Notify you within 72 hours of confirmation, via email and an in-app banner.
- Disclose what data was affected, what we know about how, and what we are doing to contain it.
- Provide identity theft monitoring for 12 months at no cost if financial PII was exposed.
- Publicly disclose on this page within 7 days, even if you are no longer a customer.
We will not hide a breach. We will not slow-roll disclosure to optimize PR. The trust we have asked for here is worth more than the embarrassment of saying we screwed up.
Reporting a vulnerability
If you find a security flaw, email [email protected] with details. We commit to:
- Acknowledge within 24 hours.
- Investigate within 72 hours.
- Credit you publicly (if you want) once we have shipped a fix.
- Pay a bounty proportional to severity once we have a formal bounty program.
Please give us 90 days before public disclosure.
Roadmap (what is not done yet)
In the spirit of honesty:
- Anthropic zero-retention contract — in progress.
- Data Processing Agreements with all sub-processors — pending.
- Formal third-party penetration test — budgeted for pre-launch.
- Cyber insurance policy — broker quote in progress.
- SOC 2 Type 1 — on roadmap once revenue justifies the cost.
We will keep this section updated as items land.
Contact
- Privacy questions: [email protected]
- Security disclosures: [email protected]
- General support: [email protected]
Image credits: Pexels photographer attribution.
— Kevin Champlin, founder