CaseBuilderAI, LLC ("CaseBuilder") reads case files that contain medical records, accident reports and other confidential client information. This page describes how that information is handled today. We update it when the platform changes.
1. Where your data lives
- CaseBuilder runs on Google Cloud in the United States (Cloud Run and Cloud SQL, region us-central1).
- The text read from each page of your case files, and the work prepared from it, is stored in a managed Cloud SQL database. Google Cloud encrypts this data at rest.
- CaseBuilder keeps no copy of the files you upload from your computer; files in Google Drive, OneDrive or SharePoint, Dropbox, ShareFile or Clio stay there and are fetched again when an exhibits package is built.
- All traffic between your browser and CaseBuilder uses HTTPS (TLS).
- Credentials and keys are kept in Google Cloud Secret Manager, never in application code.
2. Who can see a case
- You sign in with your firm email and a password, or with your Google or Microsoft account. A password is kept only as a salted scrypt hash, never as the password itself.
- A law firm's own email domain is approved after CaseBuilder reads the firm's public website; other requests are reviewed by our team, or start with a paid plan.
- A session ends after 8 hours without use.
- Each case belongs to a firm. Only the people that firm invites can open it; a case of another firm is refused.
- A firm's owners and admins decide who is in the firm. When someone leaves, they lose access to the firm's cases.
- Sessions use secure, HttpOnly cookies. Changes are accepted only from the CaseBuilder application itself.
- Access to production systems is limited to authorized CaseBuilder personnel.
3. How documents are read
- CaseBuilder reads documents with Anthropic's Claude models through Anthropic's commercial API. Under Anthropic's commercial terms, data sent through the API is not used to train its models.
- Every conclusion CaseBuilder draws cites the page it comes from, so counsel can check it against the original.
- To verify the law a demand cites, CaseBuilder sends only the citation, such as a statute's section number or a case's reporter citation, to the state's official source or to CourtListener. The letter's text and your client's information are never sent.
- CaseBuilder's logs record usage, such as the number of pages and model tokens. They never record the text of your documents, the questions you ask or the answers.
4. Repositories you connect
- When you connect Google Drive, OneDrive or SharePoint, or Dropbox, CaseBuilder asks only for read access. Clio and ShareFile grant access according to your own account; CaseBuilder uses it only to list and read the files you choose. CaseBuilder never changes anything in your repository.
- The access token the provider gives us is stored encrypted, and you can disconnect at any time.
5. How long data is kept
- A case is kept while your firm works on it. A case marked closed is deleted 60 days after closing, and any case is deleted after 12 months without activity. We email a notice 30 days before either deletion.
- A firm can delete a case permanently at any time. Deletion removes its versions, readings and work product from the database.
- Automated database backups are kept for 7 days, after which deleted data no longer exists in them.
6. Payments
Plans are billed through Stripe. CaseBuilder never receives or stores card numbers.
7. Service providers
CaseBuilder relies on these providers to run the platform:
- Google Cloud: hosting, database, backups and secrets, covered by Google's HIPAA Business Associate Addendum.
- Anthropic: the AI models that read documents and draft work product.
- Stripe: subscriptions and payments.
- Zoho Mail: account and case notices by email.
- Google and Microsoft: signing in.
- Free Law Project (CourtListener): checking case citations; it receives only the citation.
8. Reporting a concern
If you believe your data or account has been exposed, or you find a security issue, write to us right away. If we confirm an incident that affects your firm's data, we will notify your firm without undue delay.
Contact Information
- Email: [email protected]
- Phone: +1 (973) 665-4394
- Address: 131 Continental Drive, Suite 305, Newark, Delaware 19713