CaseFlow Automation Ltd operates LegalDocs-Assist, a browser-based SaaS platform that helps UK legal practitioners working in RTA (including credit hire), Employers’ & Public Liability, housing disrepair, and clinical negligence to analyse insurer and defendant correspondence, draft responses, and produce structured case documents, all supported by AI cross-referenced against a curated legal knowledge base.
Security and privacy are built into the platform's architecture, not bolted on. Our approach is grounded in data minimisation, privacy by design, and honest framing of what our controls achieve and where their limits lie.
Key Facts
âś… Encryption: TLS in transit; AES-256 at rest; per-tenant data isolation via Row-Level Security.
âś… Access: Role-based access control, invite-only registration, concurrent session detection, email-verified authentication.
âś… Privacy: Privacy-by-design data handling: browser-side text extraction from source documents and a mandatory server-side PII masking gateway before any text reaches the AI. No client data used for AI model training.
âś… AI Safety: Closed knowledge base, three-layer anti-hallucination controls, human-in-the-loop design. AI is decision-support only.
âś… Compliance: UK GDPR / DPA 2018 alignment; ICO registered (ZC013423); architecture supports formal impact assessments.
The platform at a glance
đź“š 210 UK authorities across five practice areas in the curated case law base.
🛡️ 3 anti-hallucination layers applied to every AI output.
🛡️ 17 PII categories masked before any text reaches the AI.
🏢 Per-tenant row-level client data isolation.
LegalDocs-Assist is a browser-based SaaS platform for UK legal practitioners across four practice areas: RTA (including credit hire), Employers’ & Public Liability, housing disrepair, and clinical negligence. Core features include:
| In Scope | Out of Scope |
|---|---|
| Web application (portal), server-side API functions, AI inference layer, data storage, PII masking gateway, authentication system | Client endpoints and devices, client on-premises networks, third-party integrations chosen by the client |
The platform's database and file storage are hosted in the European Union via managed cloud infrastructure. Scanned document reading is performed by Microsoft Azure AI Document Intelligence in the United Kingdom (UK South). External AI model inference is performed at provider endpoints hosted in the United States. The provider's use of the content is restricted, by our platform provider's agreements with it, to delivering the service, including a prohibition on using it to train any model. We make no representation about the provider's own retention practices.
| Role | Entity | Scope |
|---|---|---|
| Controller | Client organisation | Determines the purposes and means of processing claim data |
| Processor | CaseFlow Automation Ltd | Processes data on behalf of the client to provide the Service |
| Controller | CaseFlow Automation Ltd | Platform account data (user credentials, usage logs) |
Lawful basis: Contractual necessity for providing the Service; legitimate interest in providing efficient legal support tools.
| Class | Examples | Handling |
|---|---|---|
| Public | Marketing materials, published case law | Standard controls |
| Internal | Platform configuration, usage statistics | Access control, logging |
| Confidential | Correspondence content, case details, AI outputs | Encrypted at rest, RLS isolation, PII masking before AI processing |
| Restricted | Personal identifiers in uploaded correspondence | Masked before AI processing; original text stored in client's isolated partition only |
Layer 1: Browser‑side and server‑side text handling of source documents. Text‑based PDFs are read in the user's browser and only the extracted text is transmitted, for the drafting tools and for the Witness Statement document slots alike. Word and plain‑text documents submitted to the document slots are reduced to text on the server and masked before any AI processing. Three documented exceptions apply where an original file does reach the server: (i) scanned or image‑only documents, briefly processed so the text can be read at all; (ii) photographs submitted to the document slots, which the AI reads directly because there is no text to mask first; and (iii) the Medical Pagination tool (see its own section below). On every exception path the provider's use of the content is restricted, by our platform provider's agreements with it, to delivering the service, including a prohibition on using it to train any model, and the platform's automated deletion controls apply.
Layer 2: PII Masking Gateway. Before any text is sent to the AI model, it passes through a mandatory server-side masking gateway covering 17 verified categories: personal names (titled names, including a title with initials such as Ms L Campbell, save where a title is misread when a scanned page is read; bare / untitled names in high-precision contexts such as field labels, salutations and sign-offs), email addresses, UK phone numbers, National Insurance numbers, NHS numbers (Mod 11 validated), HMRC tax identifiers (Unique Taxpayer References and PAYE references), UK driving licence numbers, vehicle registration marks (VRMs), IBANs, credit and debit card numbers (Luhn-checked), sort codes, bank account numbers, dates of birth (in context), policy and claim references, street addresses, and the names of uploaded files. A file name often carries the claimant's surname, so file names are masked in the same way as the text inside the document, and scanned pages are sent to the reading service under a neutral file name. The Microsoft reader is sent no file name at all, because it receives only the raw bytes of the page, so the position is at least as strong on that route. Detected items are replaced with neutral placeholders such as [NAME_REDACTED], [NHS_REDACTED], [UTR_REDACTED] or [VRM_REDACTED]. An additional aggressive output-side re-scrub runs on AI responses to catch bare First-Last name pairs that slipped past the input gateway, with guards for case citations (X v Y) and known organisation names.
UK postcodes are deliberately preserved. Postcodes are material to BHR locality arguments in credit hire and to venue analysis in housing disrepair; masking them would degrade legal output. Two safeguards make this safe: (i) the AI provider's enterprise terms prohibit training on inputs or outputs, and (ii) an output-side scrubber (postcodeScrubber.ts) strips any postcode appearing in the AI response that was not present in the original input, preventing fabricated locality data. The credit hire locality check sends the claimant's postcode and coordinates, and nothing else, to public mapping services. That call sits outside the masking gateway and is disclosed rather than described as covered.
The masking gateway is mandatory and a strong first layer, but it is pattern‑based and not a perfect filter. We do not claim full redaction or guaranteed coverage; users are asked to send only what the task needs. Every AI‑facing function that receives text invokes the masking gateway before the model call. This is enforced by an automated coverage test in continuous integration, where any exception must be named in that test with a written reason, which turns a silent gap into a recorded decision. Inputs that arrive as scans or photographs cannot be masked before reading, because masking requires text. Those paths are documented exceptions protected by our platform provider's agreements with the model provider, which prohibit training, and by automated deletion, and any structured fields they produce are masked again in later drafting steps. Each invocation logs the count and categories of items masked. Original values are never logged.
Where the AI runs and what happens to the output. The masked text is sent to a third-party AI model provider for inference, through the Lovable AI Gateway to provider endpoints hosted in the United States. The provider's use of the text is restricted, by our platform provider's agreements with it, to delivering the service, including a prohibition on using it to train any model. CaseFlow retains nothing: the generated output is returned to the user and then deleted from our systems.
Party names in the Witness Statement Generator. In the Witness Statement Generator, the party names entered on the form (claimant, defendant, witnesses) are passed to the model so the statement attributes evidence to the correct person. In the analysis tools, titled and labelled names are masked like any other identifier.
Clinician names in Medical Pagination. The medical pagination and chronology feature applies the same masking gateway to every other category (NHS numbers, National Insurance numbers, dates of birth, addresses, phone numbers, email addresses, bank identifiers and references), and the claimant's name supplied on the form is masked as [CLAIMANT]. Names are the single deliberate exception: clinician and treating-unit names are preserved, because a clinical chronology is only usable if it attributes each entry to the clinician and the unit that gave the treatment. This is an approved carve-out of the same class as the Witness Statement Generator carve-out above, it is recorded in the code that implements it, and it is disclosed here rather than described as covered.
AI provider terms. The restriction sits in our platform provider's agreements with the model providers, which prohibit use of customer content for training.
⚠️ Honest Limitation: Pattern‑based detection cannot catch every possible PII format. A bare name buried in free prose with no surrounding cue may pass the input gateway and is caught, if anywhere, by the aggressive output re-scrub; novel reference formats and data that is only identifiable in combination may also not be detected. The masking gateway acts as an automated safety net, not a guarantee, and users are asked to send only what the task needs.
The medical pagination feature is the single deliberate exception to our local-only PDF processing principle. Source PDFs uploaded for this feature are briefly stored in a private, access-controlled storage bucket while the feature processes them. Source PDFs are deleted as soon as the pagination completes, whether successful or not, on a cleanup routine that runs every fifteen minutes; compiled paginated bundles are kept for 24 hours for download and are then purged by a separate automated deletion routine that runs daily. Our audit records retain the fact that a bundle was generated, but never the content itself.
LegalDocs Assist is designed not to retain personal case data. Uploaded source documents and the outputs the tool generates (witness statements, paginated bundles, chronologies, timelines, advice, correspondence) are deleted shortly after they are produced or on session close, and a scheduled purge runs continuously as a backstop so case content is never retained beyond 24 hours. Controllers are expected to download or save their own copy of any output they need, and to re‑run the tool if needed. Medical‑bundle pagination source files are deleted within roughly one hour of completion, on a fifteen‑minute cleanup cycle; compiled bundles are purged by a separate daily deletion routine. Inactive login sessions expire automatically. The only data retained is the minimal account record needed to run the subscription; activity and audit logs are retained as stated elsewhere in this document.
Recovery drafts on your device. Nothing is kept on our servers beyond 24 hours. So that a crashed tab or a closed window does not cost a fee earner her work, the platform keeps a recovery draft of typed and confirmed details in your own browser storage for up to 48 hours, then deletes it. Uploaded documents are never stored in the browser, so a restored draft asks you to drop the files again. Signing out clears every recovery draft immediately.
Backups. Case content is purged from live tables by an hourly automated routine, so nothing remains in the working database beyond about a day. A daily snapshot backup may capture case content that existed when it ran. Snapshots are retained for approximately fourteen days and are then overwritten. We do not restore deleted case material from backups. Uploaded documents held in file storage are excluded from database backups entirely.
Special category (health) data. The Service routinely processes special‑category health data (medical records, injury, treatment) for clinical‑negligence and personal‑injury work. Safeguards: browser‑side processing of source documents, server‑side PII masking before any text reaches the AI, encryption in transit and at rest, and immediate deletion within 24 hours. As data controller, the firm is responsible for the Article 9 lawful basis.
Deletion semantics. Deletion on the platform is immediate and permanent. When a record or document is deleted it is removed from the live database and, where it has associated files, from storage. Deleted storage objects are not held in any backup and cannot be restored.
Account deletion. An individual user account can be deleted on request. The user's profile and account data are removed. Case content created under the controller's tenant remains under the controller's control until the controller deletes it or the contract ends.
Firm-level (tenant) erasure. On contract termination, or on a verified erasure request, we permanently delete the controller's tenant: all case content, witness statements, chronologies, correspondence, generated documents and the associated storage objects, together with the user accounts. This action runs only via a hardened admin path executed by CaseFlow Automation Ltd platform administrators. Controllers cannot self-delete a tenant. It requires the tenant to be archived first as a reversible step, then permanently deleted from the archived list as a second gate. It is recorded in a tenant_deletion_audit row that holds only the fact of deletion, who performed it, when, and the row and object counts, never the deleted content itself. The only data retained is the minimal account and billing record required by law, and the data processing agreement audit history, both stripped of unnecessary personal data. This is a contractual commitment honoured operationally, not an automated platform feature.
On termination. On contract termination the tenant is archived immediately; the archive remains reversible for thirty (30) days as a grace period, then permanently deleted from the archived list as a second gate. Tenant erasure is executed within thirty (30) days of contract termination unless the controller requests earlier execution. Statutory account and billing records are retained for the limitation period and then deleted.
Under UK GDPR, data subjects have the rights of access, rectification, erasure, restriction, portability and objection.
Controller-held data (claimant records). For personal data about the controller's own clients and claimants, the controller fulfils data subject requests. CaseFlow Automation Ltd, as processor, supports the controller in fulfilling those requests, including by deleting or exporting the relevant records on the controller's instruction. The technical capability is in place: RLS-scoped queries scope reads and writes to the controller's tenant, and admin-initiated user and tenant deletion paths execute cascading erasure across the database and storage.
Processor-held account data. For account data CaseFlow Automation Ltd holds as controller (user credentials, usage logs), the data subject may exercise these rights directly by contacting info@caseflowautomation.co.uk. Data subjects also have the right to complain to the Information Commissioner's Office.
Platform data is hosted in the EU. Where AI model inference involves processing outside the UK/EEA, this occurs under the provider's enterprise data processing terms which include Standard Contractual Clauses (SCCs) and prohibit the use of input/output data for model training.
| Control | Implementation |
|---|---|
| Registration | Invite-only. Users must be invited by a platform administrator. No self-registration. |
| Email Verification | Required before first login |
| Password Security | Salted hashing (bcrypt); minimum complexity enforced |
| Session Management | Concurrent session detection. Only one active session per user. Automatic expiry for inactive sessions. |
| Password Reset | Secure token-based reset via email |
| Account Suspension | Administrators can immediately suspend user accounts |
Roles are stored in a dedicated user_roles table, separate from user profiles, and enforced via database-level security functions.
| Role | Access Level |
|---|---|
| Handler / User | Own company's data: analyse, draft, view history |
| Senior | Company-wide visibility of team activity |
| Manager | Company-wide visibility, usage statistics, team management |
| Platform Admin | User management, company administration, platform configuration |
Every database table containing client data enforces Row-Level Security (RLS) policies. These policies are evaluated at the database level on every query and cannot be bypassed by the application layer. A user from Company A cannot access, view, or modify data belonging to Company B, even if they manipulate API requests.
AI is used exclusively for decision-support. It drafts, analyses, and suggests. It never makes legal decisions, sends correspondence, or takes autonomous action.
| Feature | AI Role | Human Role |
|---|---|---|
| Witness Statement Generator | Assemble a first-person CPR Part 32-format draft from the witness's own account and structured user inputs | Verify factual accuracy with the witness, sign with statement of truth; the fee-earner is responsible for substantive compliance |
| Correspondence Analyser | Identify insurer/defendant arguments and cited cases in incoming correspondence | Review, verify, decide response strategy |
| Reply Generator | Draft response cross-referenced against curated case law | Edit, approve, send |
| Liability Assessment | Evaluate accident statement and apportion liability indicatively against authorities | Apply professional judgement, decide strategy |
| Impecuniosity Assessment | Apply the 12-step financial ruleset to claimant statements and supporting documents | Review reasoning, verify documents, decide strategy |
| Case Advice | Provide structured strategic guidance on case posture and next steps, grounded in the curated knowledge base | Treat as decision-support; apply professional judgement |
| Medical Pagination (clinical negligence) | Combine, deduplicate and paginate multi-file medical records into a single court-ready bundle | Review bundle and dedupe report before disclosure |
| Clinical Negligence Chronology | Build a date-ordered chronology from medical records and correspondence | Verify dates, content and clinical attribution; finalise narrative |
| Disrepair Chronology (housing disrepair) | Build a date-ordered chronology with severity flags from supplied records | Verify dates and content, finalise narrative |
Every AI output is presented as a draft requiring human review. Users must explicitly accept a disclaimer acknowledging this before accessing AI features.
We follow the Civil Justice Council's position on AI-assisted witness statements in three concrete ways:
We do not build or offer PD 57AC / Business and Property Courts trial witness statements.
Legal AI carries a specific risk: fabricated case names, invented citations, or misattributed principles. We address this with three independent layers that every AI output passes through, applied at every AI invocation site in the product:
| Control | How It Works |
|---|---|
| Layer 1: Closed Knowledge Base & Prompt Rules | The AI can only cite cases from our curated, pre-loaded database of 210 UK authorities. It is explicitly instructed not to cite anything outside this set, with directives including "Do NOT invent case names" and "If no authority exists, say so." |
| Layer 2: Citation Validator | Every case name the AI cites is automatically cross-referenced against our verified database. Any citation not found in that database is stripped from the output before you see it. |
| Layer 3: Text-Body Scrubber | A separate scanner reads all prose (summaries, reasoning, strategic advice) for any remaining X v Y case-name patterns the validator did not catch, and replaces any unverified name with a visible warning placeholder. |
| Low Temperature Setting | All AI calls use temperature: 0.3, which reduces creative output and favours deterministic, factual responses. |
| Knowledge Isolation | GTA claims receive only GTA protocol and rate tables, no case law. Non-GTA claims receive case law only, no GTA data. This prevents cross-contamination of authority sources. |
| Mandatory Limitation Language | When the knowledge base contains no relevant authority, the AI is required to state this explicitly rather than fill the gap with speculation. |
| Postcode Fabrication Scrubber | An output-side scrubber strips any postcode the AI introduces that was not in the original input, so preserved postcodes cannot become fabricated locality data. |
⚠️ No AI system can guarantee zero hallucination. These controls significantly reduce the risk, but users should always independently verify case law citations before relying on them.
The platform employs a three-tier disclaimer framework to ensure users understand the nature and limitations of AI-generated content:
| Layer | When Shown | Purpose |
|---|---|---|
| One-Time Acceptance Modal | First use of AI features | Requires explicit acknowledgement that AI outputs are not legal advice and must be independently verified |
| Persistent Banners | Dashboard and Case Advice pages | Continuous reminder that outputs are decision-support drafts |
| Inline Notices | Every AI generation dialog and result card | Context-specific reminder at the point of consumption |
âś… Users must explicitly accept the disclaimer before using any AI feature.
âś… Every AI output is labelled as a draft requiring review.
âś… Language throughout the platform uses terms like "cross-referenced" and "greater confidence" rather than "verified" or "guaranteed".
| Log Type | Content | PII Included? |
|---|---|---|
| Activity Log | Feature usage events with timestamps, user IDs, company IDs | No |
| PII Masking Log | Count and categories of items redacted per invocation | No. Original values are never logged. |
| Authentication Log | Login events, session creation, concurrent session detection | Email addresses (for identification) |
| Error Logs | Application and function errors | Designed to exclude PII |
In the event of a suspected security or AI safety incident:
| Capability | Implementation |
|---|---|
| Database Backups | Automated daily backups with point-in-time recovery; encrypted backup storage |
| Data Redundancy | Managed by cloud infrastructure provider with multi-availability-zone resilience |
| Service Recovery | Stateless server-side functions can be redeployed rapidly; no single point of failure in the processing layer |
| Graceful Degradation | If AI inference is unavailable, the platform's non-AI features (case law library, templates, liability guide, guidance notes) remain operational |
| Data Portability | Client data can be exported on request |
⚠️ Honest Limitation: CaseFlow does not currently maintain a formalised Business Continuity Plan (BCP) or conduct scheduled DR exercises. Recovery capabilities are provided by the underlying managed cloud infrastructure. We are evaluating formal BCP documentation as the platform matures.
Effective 4 September 2026, updated 2 October 2026 to add Microsoft. CaseFlow uses a limited number of named third-party services to deliver the platform:
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage and server-side function execution | All platform data (encrypted at rest, RLS-isolated) | EU |
| Lovable | AI gateway through which every model call is made. Its agreements with the model providers restrict use of content to delivering the service and prohibit training | Masked text only (PII redacted before transmission). Where an operator explicitly uploads a photograph or image directly to an image-analysis slot, the page image is processed directly, under the gateway operator's agreements with the model providers, which prohibit use of the content for training | EU/US; under data processing agreement |
| Gemini model providing AI inference at US-hosted endpoints, accessed only via the Lovable gateway | Masked text only; use restricted, by Lovable's agreements with it, to delivering the service, including a prohibition on training. The same photograph exception applies as in the row above | EU/US; under the gateway's enterprise terms with SCCs | |
| Microsoft (Azure AI Document Intelligence) | Reading scanned or image-only pages into text for every firm from 5 October 2026, with no fallback to the former reader. The result is deleted as soon as it is collected and is not used to train any model | The scanned page image, which has no text to mask before it is read. Held in memory only, never written to our file storage | UK (UK South) |
| Resend | Transactional email (invitations, password resets, security notifications) and the platform's scheduled usage and activity reports | Email addresses and user names. The scheduled reports (weekly usage digest, client usage report, monthly activity report and daily login report) additionally carry named individual users together with their last login date and their per-tool action counts. The contact form carries the sender's name, email address, firm and their free-text message of up to 2,000 characters. No client case content and no uploaded documents are sent by email. | EU/US; under data processing agreement |
| Firecrawl | Fetching public web pages only: case law enrichment from published judgment sources, and hire company terms and conditions monitoring | No personal data. Only a public URL is sent. Sending client case content or uploaded document text to this service is prohibited by policy. | EU/US; under data processing agreement |
| The National Archives (Find Case Law) | Retrieving the published text of a court judgment during case law enrichment | No personal data. Only a published judgment citation or URL is sent. | UK |
| Web Hosting / CDN | Static asset delivery | No personal data | Global CDN |
The credit hire locality check and the housing disrepair venue analysis call public mapping services. Each receives the claimant's postcode and its coordinates and nothing else. No name, no address, no case reference, no document text.
| Service | Purpose | Data Processed |
|---|---|---|
| Ideal Postcodes (postcodes.io) | Postcode geocoding | Claimant postcode and coordinates only |
| Komoot (Photon) | Geocoding and nearby-place search | Claimant postcode and coordinates only |
| Overpass API operators | Map queries for nearby hire branches | Coordinates only |
All sub-processors operate under data processing agreements. Client notification will be provided for material changes to the sub-processor list, effective from the date above.
| Regulation / Framework | Status |
|---|---|
| UK GDPR / DPA 2018 | Aligned: data minimisation, privacy by design, transparency, accountability, lawful basis documented |
| ICO Registration | Registered (ZC013423) |
| EU AI Act (Decision-Support) | Aligned: human-in-the-loop design, AI outputs labelled as drafts, disclaimers enforced |
| ISO/IEC 27001 | Not certified. Controls are aligned with key domains (see mapping below). Formal certification is under consideration as the platform scales. |
| Cyber Essentials | Certified. Achieved 7 August 2026, certificate held. |
| Domain | Controls Implemented | Evidence / Reference |
|---|---|---|
| Access Control | RBAC, RLS, invite-only registration, session management | Database policies; Admin panel |
| Cryptography | TLS in transit, AES-256 at rest, salted password hashing | Infrastructure configuration |
| Operations Security | Activity logging, PII masking logs, usage dashboards | Activity log table; Admin dashboards |
| Supplier Relationships | Limited sub-processor set; data processing agreements in place | Sub-processor register (§10) |
| Incident Management | Feature-level kill switches, audit trail, notification procedures | Incident response plan (§8.3) |
| Business Continuity | Automated backups, PITR, stateless architecture | Infrastructure provider capabilities |
| Data Protection | Privacy-by-design data handling, server-side PII masking, data minimisation, no training on client data | PII Masking Architecture Summary (Appendix A) |
| Area | CaseFlow Responsibility | Client Responsibility |
|---|---|---|
| Platform & Infrastructure | Secure hosting, encryption, monitoring, patching | Not applicable |
| Identity & Access | Authentication system, RBAC enforcement, session controls | Manage user invitations, remove leavers promptly, enforce strong passwords |
| Data Protection | Encryption, RLS isolation, PII masking, no-training policy | Classify data appropriately; redact/anonymise sensitive data before upload where possible |
| AI Usage | Anti-hallucination controls, closed knowledge base, disclaimers | Review all AI outputs before use; do not treat drafts as verified legal advice |
| Endpoints & Devices | Not applicable | Secure devices, keep browsers updated, use trusted networks |
| User Training | Platform guidance, in-app tooltips, onboarding materials | Ensure users understand the tool's purpose and limitations |
The canonical technical reference for the masking gateway, OCR routes and retention is the separate PII Masking Architecture: Technical Summary. Where this pack differs on those topics, the summary governs. The plain English walkthrough of what happens to your data lives in our Data & AI: A Plain English Guide.
| Term | Definition |
|---|---|
| RLS | Row-Level Security. Database-level access control that restricts which rows a user can read or modify. |
| PII | Personally Identifiable Information. Data that can identify a natural person. |
| RBAC | Role-Based Access Control. Access permissions determined by assigned roles. |
| GTA | General Terms of Agreement. ABI protocol governing credit hire rates. |
| BHR | Basic Hire Rate. Insurer argument challenging hire charges based on local availability. |
| PITR | Point-in-Time Recovery. Ability to restore a database to a specific moment. |
| SCCs | Standard Contractual Clauses. EU-approved mechanism for international data transfers. |
For security-related enquiries, impact assessment collaboration, or to request further technical detail:
Email: info@caseflowautomation.co.uk
ICO Registration: ZC013423
Website: legaldocs-assist.co.uk
This pack is designed to be honest and specific about our security posture. We describe what we have implemented, acknowledge where we have limitations, and commit to continuous improvement as the platform matures. Trust is earned through transparency, not theatre.