The model, in full.

Every file is encrypted before it is written to storage, under a key unique to that case. This is envelope encryption: a per-case data key protects the files, and that key is itself protected. Evidence lives in object storage as ciphertext — the storage layer never sees a readable file, and one case's key opens nothing else.

All connections use TLS. Encryption at rest and in transit are complementary — CaseWeave uses both.

Uploads are never overwritten or edited. The file that entered the case is the file that stays in the case — with a SHA-256 fingerprint recorded the moment it arrived. Views, text layers, summaries and labels are separate objects layered on top; the original is untouchable underneath.

Exhibit sets and court packages carry the hashes out with them: an index with the manifest hash, and a separator page per exhibit printing that item's full SHA-256.

Every action in a matter — capture, classification, message, share, export, deletion request — is written to an audit trail that can be added to but never rewritten. The entries are hash-chained: each one seals the one before it, and the chain re-verifies every time the log is opened. For a firm, that's defensibility; for a client, it's how the history of their case stays exactly as it was recorded.

The log records that something happened — never the content of what was said.

Authorization is deny-by-default: nobody sees a matter they haven't been given, and access maps to roles — attorney, staff, client — with each side seeing what belongs to them. Accounts support authenticator-based multi-factor authentication, and access changes land in the audit trail like everything else.

Conflict checks are durable records across the firm's whole history — including access that was later revoked — written so an auditor could follow them.

When a case is deleted, CaseWeave destroys its encryption keys. Because the underlying files are ciphertext that can only be read with those keys, destroying them renders the data permanently unrecoverable — even to us. Deletion means gone — mathematical, not cosmetic.

Our rule for recovery: a backup you've never restored from is a hope, not a plan. Recovery is built to be rehearsed, so a bad day for infrastructure is not a bad day for your cases.

CaseWeave uses AI to read, classify, date and summarize case material, with source references to help your team review answers against the record. The approach has three commitments:

People decide. The intelligence layer organizes, cites and summarizes; judgment calls belong to the humans on the case.
Processed only to provide the service. Your content works for your case and nothing else.
Never training data. Case data is never sold, never advertised against, and never used to train models — ours or anyone else's.

CaseWeave runs on reputable, US-based cloud infrastructure, and we name our core processors plainly: Cloudflare for encrypted object storage and edge delivery, Neon for managed Postgres, TLS on every connection, US-based regions.

These providers act as processors under contract. They receive no right to use case content for their own purposes.