Security and data handling
Intake packets hold social security numbers, dates of birth, bank balances and a full creditor schedule. Here is exactly what happens to them.
How Casewell protects bankruptcy client data
Encrypted at rest
Client-identifying columns are encrypted in the database, including debtor names, the assembled case payload, the read results and file names. A database dump on its own does not yield readable client data.
Seven-day retention sweep
A scheduled job deletes uploaded scans and generated .BCB files seven days after they are created, along with any unreferenced files left on disk. Learned corrections that go unused are removed after 90 days.
Per-firm isolation
Cases, files, users and learned corrections are scoped to one organisation, and every request is authorised against the signed-in user’s firm.
Encrypted private network
Case data moves between our application server and the file generator over an encrypted private network, not across the public internet.
No model training
Reads run through the Anthropic API, which does not train on API inputs or outputs. Your corrections improve your firm’s reads and nobody else’s.
Attorney control is a design constraint
The whole point of reading a form five times is to know when the software is not sure. That signal is worthless if the software then acts on its own guess, so it does not.
What we are still building
Casewell is in beta and it is more useful to say what is not finished than to imply everything is. There is no SOC 2 report yet, and no third-party penetration test has been completed. Firms that need either before adopting a tool should tell us, because it changes what we prioritise.
Security questions
How long do you keep our clients’ intake scans?
Uploaded scans and generated .BCB files are deleted by a scheduled sweep seven days after they are created. Learned corrections that go unused are removed after 90 days. A firm that wants a shorter window can ask for one.
Is client data used to train AI models?
No. Reads run through the Anthropic API, which does not train models on API inputs or outputs. Corrections your staff make are scoped to your own organisation and are used only to improve how your firm’s intake form is read.
Can other firms see our cases?
No. Every case, file, user and learned correction is scoped to a single organisation, and requests are authorised against the signed-in user’s organisation before any record is returned.
Where is the data processed?
Casewell runs on servers in the United States. Case data passes between our application server and the file generator over an encrypted private network, never over the public internet in the clear.
Does Casewell ever act without a person approving it?
No value reaches an exported file unless it was either agreed by every read or explicitly confirmed by a member of your staff, and every confirmation is recorded against the case. Casewell does not reach legal conclusions and does not file anything with a court.
How do we report a security issue?
Email hello@trycasewell.com and say it is a security report. We would rather hear about a problem early than find out about it late.