Security at Casefile
Security is the first thing we built. Not the last.
You are thinking about uploading your bank statements and family-court financial records to a website you have never used. The rest of this page is what we have done to deserve it.
If our database leaks
A full dump produces zero readable PII. Every sensitive column is AES-256-GCM ciphertext under a per-row data key wrapped by a per-user key wrapped by a master key that is not on the database server.
If a database password leaks
The database refuses connections from outside the server. A leaked password cannot be used remotely. And even reaching the database exposes only ciphertext.
If someone gets FTP access
Your uploaded file contents are stored as encrypted blobs. The encryption keys are not on the file system; they live in our key management vault. FTP exposure means encrypted blobs, useless without the vault.
If a backup is stolen
Backups are encrypted with a separate key under a separate access policy from the runtime application. A stolen backup blob is unreadable without that separate key.
If a Casefile employee goes rogue
No one at Casefile can bulk-read user documents, including the founder. Admin panel is metadata only. Per-field reveal requires fresh 2FA, is rate-limited, and is permanently audit-logged. File contents are never decryptable through admin paths at all.
If our server is fully compromised
The master key lives in a separate hardened vault, with auto-unseal backed by an off-server cloud KMS. To decrypt anything an attacker additionally needs to compromise the cloud KMS account — a separate authentication boundary with its own MFA.
Twelve layers of defense, in plain English
- Encrypted in transit — TLS 1.2+, HSTS preload, no plaintext downgrade.
- Encrypted at rest with per-document keys — AES-256-GCM, envelope encryption.
- Encrypted sensitive database columns — mysqldump produces zero readable PII.
- Encrypted backups under a separate key — backup compromise does not equal runtime compromise.
- Database bound to localhost — not reachable from the internet.
- Append-only audit log — database triggers refuse UPDATE and DELETE on audit rows.
- Admin cannot bulk-decrypt — per-field reveal only, 2FA-gated, rate-limited, audit-logged.
- AI assistant is opt-out — toggle off and no document text ever leaves our servers.
- Search index has no plaintext — HMAC token fingerprints only.
- Cloudflare WAF at the edge — OWASP top-10 patterns filtered before our app sees them.
- Behavior anomaly detection — mass-download, brute-force, unusual admin access all alert in near-real-time.
- Strong passwords + mandatory 2FA — HIBP-checked, bcrypt cost 14, TOTP required.
What we are NOT claiming
We do not believe in marketing-speak security claims. Read this carefully:
- We are NOT "end-to-end encrypted" in the cryptographic sense. That term means only you can decrypt — that the service cannot. Casefile holds keys to decrypt your data for the AI assistant, the affidavit generator, and document search to work. Anyone marketing "end-to-end encrypted" while also offering AI features is lying or does not know what end-to-end means.
- We are NOT "zero knowledge." Same reason.
- We are NOT HIPAA-certified or SOC 2 certified yet. A formal SOC 2 audit is on our roadmap. The controls described above are real and verifiable now.
If anything ever happens
If we confirm a security incident that affected your data, we commit to notifying you within 72 hours, telling you exactly what was affected, providing 12 months of identity theft monitoring at no cost if financial PII was exposed, and publicly disclosing on this page within 7 days.
We will not hide a breach. We will not slow-roll disclosure to optimize PR.
Found a vulnerability?
Email [email protected]. We acknowledge within 24 hours, investigate within 72, credit you publicly if you want, and pay a bounty proportional to severity once we have a formal program.
Please give us 90 days before public disclosure.
— Kevin Champlin, founder