Built to protectyour case data

All API traffic moves over TLS 1.3. Database storage at Supabase is encrypted at rest with AES-256. Passwords are bcrypt hashed with salt.

JWT auth via Supabase, role-based access between consumer and professional, row-level security in the database, MFA required for all production access.

Emails, phone numbers, SSNs, ZIP codes, injury descriptions, plaintiff and defendant names, and settlement amounts are stripped before any error event leaves our backend.

Application-level firewall rules, DDoS protection at the Fly.io edge, and per-route rate limiting prevent abuse and brute force.

Our consumer flow is isolated from professional analysis. A guardrail layer enforces information-only output and refuses jurisdiction-specific legal opinions.

Independent third parties run external penetration tests yearly. We undergo regular SOC 2 Type II audits to validate the controls above.

Auth and database. Stores email, user ID, hashed passwords, and case analysis results. SOC 2 Type II, ISO 27001.

Backend API hosting. Receives request metadata only. Logs retained for seven days. SOC 2 Type II.

Consumer plan billing. PCI DSS Level 1. Caseworth never stores full credit card numbers.

LLM gateway for GPT-4, Claude, and others. Does not train on user data. Case facts processed in real time, not stored for training.

Error monitoring with PII scrubbing enabled. Receives stack traces, endpoint names, and timing only — never emails, case facts, or medical records. Sentry Session Replay (masked) is consent-gated and only runs with user consent.

Transactional email for password resets and receipts. Thirty day retention.

Bot and abuse prevention on public-facing forms. No advertising or behavioral data use.

In-app customer support chat. Receives support conversation data and user ID.

Website and product analytics, plus session replay for UX analysis. All three are consent-gated — they do not run until you accept via the cookie banner.

Measures whether users who arrived via a Google ad completed a signup. Consent-gated via Google Consent Mode v2.

Medical and injury detail moves over TLS 1.3 and is stored encrypted with AES-256, the same standard applied to all case data.

Access to records containing health detail is restricted by role and row-level security. Consumer health data is never shared with insurance companies or opposing counsel.

We collect health information only as needed to generate your estimate and retain it only for as long as necessary to provide the Service.

Error monitoring (Sentry) scrubs injury descriptions and medical detail before events leave our backend, and masks all text and media in any diagnostic replay. Session-replay analytics is disabled entirely on every consumer flow where medical or injury detail may be entered — Lexstimate, analysis, intake, and chat — and records only on non-sensitive routes, only after you consent.