Security and privacy: where does the firm's client data live?

The short answer: on the firm's computer, encrypted, under the firm's control. A firm that runs its clients' files in CaseFlow is owed a precise answer to where and how the data is kept, and to what leaves the computer and when. Every sentence on this page describes a mechanism that exists in the software today.

Three places, and only two of them belong to the firm

1. On the office computer. The database is encrypted, and its key is kept in the operating system's keychain on that computer. A copy of the data file on another computer does not open.
2. In the firm's cloud, only if the firm chooses. The backup is encrypted and kept on the office computer, and restoring it requires the firm's recovery kit. Syncing the backup to the firm's own cloud (Google Drive, OneDrive or Dropbox) is off by default; when enabled, it goes to the firm's own account.
3. On CaseFlow's servers: no case files. Client files, documents and correspondence are kept on the firm's own computer, so each firm's data stays with that firm, separate from every other firm.

What leaves the computer, and when

• Licence check. The licence key, a one-way fingerprint of the computer (not a serial number), the version number and the answer to the monitoring question (yes, no or not answered). No case detail is sent.
• Version updates. The software downloads updates from one source; they carry the publisher's code signature and are checked before they install.
• Managed AI, only if the firm enables it. Only what the task the lawyer asked for needs is sent, through a CaseFlow server, for processing in a region in the European Union. The server records a usage and cost meter only, never content. Full detail in the AI commitment.
• AI on the firm's own account. A firm that connects its own provider account sends directly to that provider, under the agreement and processing region the firm chose. The data does not pass through CaseFlow's servers.
• Remote signing, only by choice. The document to be signed is kept on the server behind an unguessable single-use link, and the signed document returns to the firm's computer.
• Remote support, only by prior arrangement. A screen share the firm approved travels encrypted through a relay server CaseFlow runs. Its content is not stored.
• Crash reports and usage data. The mechanism is off by default and sends nothing.

Exactly what is processed, where and for how long is written in the privacy policy and the data processing agreement.

Firm-level controls

• App lock with a personal passcode, with two-step verification by a rotating code and recovery codes, as the firm chooses.
• Roles and permissions in a multi-seat office: administrator, partner, lawyer, paralegal and read-only. Each user sees the cases assigned to them or under their supervision.
• An audit log of actions in the system, exported as a file and as a readable report.
• The firm decides how much latitude the smart assistant has. The default is conservative. An action that leaves the office, such as sending an e-mail, sending for signature or charging a card, always needs a person's explicit approval, under every setting.
• Signed updates to every seat, from one identified source.

How CaseFlow's servers are protected

The servers are hosted in a data center in the European Union, protected and kept up to date, and all traffic to them is encrypted. An encrypted backup leaves every night for a separate storage site, and restoring from it is tested.

AI and data

The smart assistant does the groundwork, and the lawyer approves. It files nothing with a court and sends nothing on the firm's behalf without approval. The full commitment, written so a lawyer can rely on it under the Israel Bar's September 2026 ethics opinion, is in the AI commitment.

What this page does not claim

CaseFlow holds no ISO 27001 or SOC 2 certificate, and no external penetration test has been performed on it. The CaseFlow team keeps a control-by-control self-assessment against the Protection of Privacy Regulations (Data Security), 5777-2017, and ISO 27001 Annex A. A licensed firm can obtain a report on the security measures under section 8 of the data processing agreement.

Reporting a vulnerability

Anyone who finds a vulnerability is asked to write to security@caseflow.co.il. The CaseFlow team acknowledges within one business day, acts by severity, and tells the reporter when the fix has shipped.