Security and data handling
What happens to the documents you share during an engagement: where they are stored, who can reach them, what is sent to an AI model, and which service providers handle them.
Last updated
- The documents you upload are stored privately and are never reachable through a public link.
- Nothing appears in your portal until Casework has reviewed it.
- AI-assisted drafting uses Claude with zero data retention and no training on your data. You can have it switched off for your engagement.
- Payments run through Stripe. Casework never sees card or bank details.
- We'll complete your security or vendor-risk questionnaire as part of onboarding.
Your documents
Where your files live.
You share evidence through the client portal. Files go to a private Vercel Blob store. They are never published, and there is no public link to any of them.
An upload uses a signed link that is tied to your engagement and expires after five minutes. To download a file, the portal first checks that the signed-in contact belongs to the engagement. Our server then fetches the file using a signed link valid for 60 seconds and passes it to you. That link never leaves our server.
The portal accepts PDF, Word (.docx), Excel (.xlsx), CSV, PNG and JPEG files of up to 25MB each. We don’t need raw applicant records: the engagement documents your systems, not your candidates.
All traffic to the site and portal is served over HTTPS.
Access
Who can see what.
The portal has no passwords. You sign in with a one-time link sent to your email. The link expires after 15 minutes and works once, and we store only a hash of it, never the link itself. A session lasts 14 days in a secure, HTTP-only cookie.
Each contact on your side gets their own permissions: whether they can approve sections, upload evidence, or see billing.
Drafts are internal. A deliverable only appears in your portal once Casework has reviewed it and sent it to you for review.
Casework staff sign in to the admin console the same way, with an emailed sign-in link that expires after 15 minutes. Every engagement keeps an activity log of its key events: evidence uploads, portal sign-ins, review and approval steps, contracts, invoices and emails sent.
AI-assisted drafting
What is sent to a model, and how to turn it off.
Casework uses Claude, Anthropic’s model, to produce first drafts of deliverable sections. Each draft is checked against the requirements of the regulation it answers, and then reviewed by Casework before you see it.
To draft a section, we send:
- the instructions for that section;
- a short summary of your intake answers: company name, AI systems in use, hiring stages, where you hire, industry, hiring volume, and whether counsel and a bias audit are in place;
- text from up to eight evidence files attached to that section, at most 8,000 characters from each. Only PDF and plain-text formats such as CSV are read. Word, Excel and image files are never sent.
These requests go through Vercel AI Gateway with two restrictions. They are routed only to providers that have zero-data-retention agreements with Vercel, and only to providers that don’t train models on the prompts they receive. If no provider meets both, the request fails. It is never sent elsewhere instead.
If your policies don’t allow AI processing, tell us at kickoff. We switch AI drafting off for your engagement and draft by hand. With it off, nothing from your engagement is sent to a model.
Service providers
Who else handles client data.
These are the outside services involved in running an engagement, and what each one handles.
- VercelHosting, private file storage (Vercel Blob), the AI Gateway that routes drafting requests, and bot protection on the intake form.Site and portal traffic, the evidence files you upload, and drafting requests.
- NeonThe Postgres database, hosted on AWS in us-east-1 (United States).Intake answers, engagement records, contacts, deliverable text, and the activity log.
- Anthropic Claude, via Vercel AI GatewayDrafting and reviewing deliverable sections, served under a zero-data-retention agreement.Drafting instructions, a summary of your intake answers, and text extracted from evidence (see AI-assisted drafting).
- ResendEmail delivery.Recipient names and addresses, and the emails themselves: sign-in links, kickoff and notifications.
- StripeInvoicing and payment.The billing contact and invoice amounts. Card and bank details stay with Stripe.
- SignWellElectronic signature.Signer names and email addresses, and the documents signed.
- Cal.comScheduling calls.The name, email address, and time of a booked call.
- PlausibleCookieless analytics on the public website.Aggregate page views. No client or engagement data.
Contracts
Insurance, terms and privilege.
Casework LLC carries errors and omissions and general liability insurance, and we can share certificates before you sign.
We can contract under your own master services agreement, and we’ll complete your security or vendor-risk questionnaire as part of onboarding.
Casework is not a law firm, so our work product is not privileged. If privilege matters to you, engage us through your outside counsel, who then owns the work product. See the Pack FAQ and our Privacy Policy.
Questions
Send us your questionnaire.
Send security questions, vendor-risk questionnaires, or requests to delete your documents to hello@getcasework.com.