Security Overview

Caseflow uses defense in depth across identity, application authorization, Firebase security rules, backend validation, storage controls, upload validation, short-lived document access, provider safeguards, logging, and human review. Controls are risk-based and evolve with the Service; this overview is not a certification or guarantee against every threat.

• Firebase Authentication supports account identity and token-based sessions.
• Sensitive backend routes verify current ID tokens and, where implemented, reject revoked credentials.
• App Check with reCAPTCHA v3 protects supported browser-to-backend flows against automated abuse.
• Password policy, verification, recovery, login-activity records, and session controls support account administration.
• Administrative impersonation is restricted, session-scoped, logged, and separated from ordinary user state.

• Ownership, organization membership, roles, case capabilities, task grants, and explicit sharing records constrain access.
• Backend handlers re-evaluate authorization for security-sensitive operations rather than trusting browser state.
• Firestore and Storage rules protect direct client access paths.
• Caseflow Connect, support, collaboration, and organization rules are tested for cross-user and cross-tenant isolation.
• Administrators and owners remain responsible for reviewing members, grants, invitations, and connected accounts.

• Supported uploads are staged and promoted only after authorization and policy checks.
• File controls validate size, filename, extension, reported MIME type, content signatures, and supported archive structure; executable disguises and macro-enabled formats are rejected on maintained flows.
• Supported path-backed document views use permission-checked access requests and short-lived signed links.
• Download responses set controlled filenames, private caching behavior, and inline or attachment disposition by validated type.
• Legacy URL-backed records may remain for compatibility and should be migrated when the supported workflow offers it.

• OpenAI requests are backend-mediated; API keys are not exposed to the browser.
• Current permissions are used to rebuild accessible case and document context before hardened retrieval.
• Tenant and case scoping, hashed provider metadata, post-validation, stale-artifact rejection, context limits, redaction, and production raw-upload safeguards reduce exposure.
• AI actions are allowlisted and risk-classified; higher-risk writes use short-lived, context-bound confirmation records.
• AI audit metadata supports traceability without being treated as a complete transcript or a substitute for review.

OAuth, email, accounting, fax, WhatsApp, push, and payment integrations are optional or feature-dependent. Tokens and secrets are kept in backend configuration or protected records, provider endpoints are constrained, and webhook or callback requests use authentication or validation appropriate to the maintained provider path. Data sent to a recipient or external provider then depends on that system’s controls.

Provider infrastructure, deployment validation, security headers, dependency checks, backups, logging, monitoring, and incident procedures support availability and recovery. Unless a signed SLA says otherwise, this page does not promise a recovery time, recovery point, uptime percentage, or notification period.

• Use individual accounts, strong credentials, secure devices, and supported browsers.
• Apply least privilege and remove stale workspace members, task grants, invitations, public links, OAuth connections, and push subscriptions.
• Classify sensitive files before upload and confirm that the selected workflow and provider configuration is permitted.
• Keep independent copies where professional or archival rules require them.
• Review AI output, generated documents, email, fax recipients, and externally shared material before release.

Report suspected unauthorized access, exposed links, account compromise, malicious files, permission errors, or vulnerabilities through the public Support page or in-app Support Center. Provide the affected URL or feature, observed behavior, time, account email, and safe reproduction details. Do not access other people’s data, persist access, destroy records, extort, or publicly disclose an unresolved issue. We do not currently advertise a bug bounty or fixed response SLA.