Security
How the product protects the record
This page describes controls that are in the product and documented. It shows no certification badges and claims no compliance with a named standard.
Where the data lives
The record stays on your installation
Cases, alerts, evidence, and audit records live in the PostgreSQL database and the object storage of your installation. CaseBender does not host them, and the product does not send them to us.
Data leaves your network only through services you turn on.
- Connectors and enrichment providers you configure
- A cloud model, if you point AI at one
- Liveblocks, for real-time co-editing of case documentation
Access
Roles, scopes, and TLP ceilings
Authorization is evaluated on the server for the organization and team in each request. Roles supply permission templates, and each role has a TLP ceiling. TLP is an extra restriction: a high ceiling never grants a missing permission.
- Protected system roles, plus roles your organization defines
- Case grants to one user or one team outside the normal boundary
- API keys with their own scopes and TLP maximum, separate from user roles
Sign-in
Strong authentication
MFA enrollment is part of first-run activation. Organizations can sign in through their identity provider, and sensitive operations ask for step-up authentication.
- TOTP and WebAuthn or FIDO2 hardware keys
- SAML 2.0 single sign-on
- Account lockout and step-up for sensitive operations
Audit
An audit trail you can verify
Audit records are hash-chained with an integrity secret shared by every process that writes them, so a gap or an edit shows up when the chain is verified. Records under legal hold are preserved.
- Tamper-evident audit chain with integrity verification
- Legal hold and e-discovery support
- Forwarding to your SIEM
Data
Encryption where it matters
Integration credentials, API keys, and other sensitive fields are encrypted by the application before they are stored, with versioned keys. Production traffic runs over TLS, and the data services stay on internal networks.
AI governance
Your model, your record, your decision
AI is optional, and CaseBender does not ship a model. AI features use providers you configure, including Ollama and OpenAI-compatible private endpoints. An assessment has to be supported by quotes from the record, and an analyst accepts or rejects it. Nothing is concluded on the analyst's behalf.
- Prompts and answers are not stored.
- Usage records (calls, latency, tokens) are kept for 90 days by default.
- An organization's AI data policy can allow private models only. A cloud model, if you allow one, needs a path out.
Questions about a control?
The security docs describe each control in detail. For anything they do not cover, send your question and a person replies by email.