How your clients' files are protected.

CaseVigil holds what DHS calls Sensitive PII — personally identifiable information whose loss could harm the person it belongs to — together with a firm's case records and its own trust ledger. This page sets out how that is protected, and what we have not yet built. Every statement on it was checked against the running system on the date above.

What We Do Not Claim

CaseVigil is not SOC 2 audited, and holds no security certification of any kind. No outside firm has examined these controls, and we have not yet had an external penetration test.

What we have done is build against the SOC 2 Security criteria — the AICPA Trust Services Criteria, CC1 through CC9 — and keep a controls register that records, for every control, how it is met and where the proof of it lives. A Type I report is planned for 2027.

We put this first because a security page is a set of representations, and a firm deciding where to keep its clients' files should be able to tell what a vendor has built apart from what a vendor has been audited on. We will send the controls register on request under a non-disclosure agreement, and we will answer a security questionnaire in full rather than in summary.

One Firm, One Database

Each firm has its own database and its own document tree. There is no shared table of matters with a column naming the firm, which means there is no query that returns another firm's records by leaving a filter out. Separation is a property of the storage rather than of the code that reads it.

Where It Runs

• Amazon Web Services, in a United States region, in an account used for nothing else.
• The disk is encrypted with a key held in AWS KMS that belongs to VisaVigilAI and rotates yearly.
• Every connection is TLS, with HSTS, a content security policy, frame denial and a referrer policy on every response.
• The AI models run on hardware in our own office, reached over a private network and never exposed to the internet.

Both the staff application and the client portal require a sign-in; the interface refuses to answer an unauthenticated request for any firm's data.

Signing In

• Passwords are hashed with scrypt and are never stored or recoverable.
• Repeated failures are throttled, counted separately by account and by source, and expire on their own — a lockout an administrator must clear is one an outsider can trigger against anyone whose address they know.
• Sessions last 12 hours, on cookies marked HttpOnly, SameSite and Secure.
• Two-factor sign-in uses an authenticator app with backup codes. A firm can require it of every account. On our own deployment it is on for every account.
• Roles are enforced on the server rather than in the browser, and whether someone sees money is a separate permission from what they may edit.

The Client Portal

On one petition the employer and the beneficiary may both hold portal accounts on the same matter. Each sees only their own questionnaire and only the documents shared with them. Sharing names a person, not “the client”: a petitioner may not want the beneficiary reading the engagement agreement, and the platform treats that as the ordinary case.

The Audit Trail

Every consequential action is written to an append-only log in which each row's hash includes the row before it. Altering or removing a past entry breaks the chain, and the verification command names the first row that no longer matches. The log records who, what and when, and nothing in the product can edit it.

Artificial Intelligence

Vigil — the research and drafting assistant — runs on hardware VisaVigilAI owns and operates. Client documents and case data are not sent to any hosted AI service. That is enforced in the code, not by policy.

A firm that would rather use its own model, or a vendor of its choosing, can set that instead. Sending client data to an outside vendor requires the firm's own acknowledgement first, and that acknowledgement is written to the audit log.

Payments

Card numbers never reach our servers. The card is exchanged for a token in the client's own browser, directly with the payment processor, and the platform charges the token. Bank details for eCheck are handled the same way. This keeps CaseVigil within PCI DSS SAQ A.

Backups

A consistent snapshot every 12 hours, copied off-site to storage that is versioned and write-once, so a copy cannot be altered or deleted for the length of its retention — including by us. Documents are mirrored the same way. The platform reports the age of the last successful off-site copy, so a backup that quietly stops working is visible rather than silent. Restore drills are quarterly, beginning October 2026.

Changes to the Software

Every change is a commit with a reason. A suite of more than 8,500 automated tests runs before a change reaches the staging system, and changes are exercised on staging before production. The deployment path carries code only. There is no route by which data from a test system can reach production, and a test in the suite exists to fail if one is ever added.

Policies

Five, signed and dated September 17, 2026: information security, access control, incident response, change management, and acceptable use. Every staff account reads and accepts the acceptable use policy inside the product before first access, recorded per version in the audit log.

If Something Goes Wrong

The incident response plan runs on the clocks the law sets: California's breach notification requirement, and 72 hours to the supervisory authority where the GDPR applies. A firm affected by an incident in CaseVigil hears from us within 30 days, and sooner wherever we can.

Your Data Leaves With You

An administrator can export the firm's entire record — every table as a spreadsheet file, and every document — at any time, without asking us and without a fee. We treat that as part of the security posture rather than as a courtesy: a firm that cannot get its files out is not in control of them.

What We Have Not Built Yet

Named here rather than left for someone to discover:

• Passkeys for staff sign-in. An authenticator app is the second factor today.
• A second factor for client portal accounts.
• Encryption of documents at the application layer, per firm, in addition to the encrypted disk.
• An external penetration test, which we intend to have before any firm outside our own is carrying live matters.

Asking Us About This

Security questions from a firm evaluating CaseVigil go to security@visavigilai.com, which reaches Rajesh Prasad, who owns this program — a named person, not a form. If your firm has a questionnaire, send it. If you would like the controls register, ask and we will send a non-disclosure agreement.

CaseVigil is software for licensed attorneys, made by VisaVigilAI, Inc. A firm's client information is handled under that firm's written agreement with VisaVigilAI, Inc.; the website privacy policy covers this public website only.