Security

Built for legal confidentiality. CourtFlow AI, a product of CourtFlow AI, Corp., a Florida corporation, was designed from the ground up to meet the data security expectations of litigation professionals. Your court documents never touch our servers — they go directly to your own Google Drive or OneDrive. We store only the metadata and AI analysis needed to power your dashboard.

Architecture Overview

CourtFlow AI follows a zero-document-storage architecture. For state court emails, our system reads the email body to locate the court portal download link, downloads the PDF from the court portal, processes it in memory, sends it to Google Gemini for analysis, files it directly to your cloud storage, and stores only the AI-generated summary and extracted metadata in our database. For federal court emails (CM/ECF NEF notifications), the system downloads the filing PDF via the one-time free-look URL provided by PACER, applies the same in-memory processing pipeline, and files the document to your cloud storage. In both cases, no court documents are stored on CourtFlow servers.

Authentication & Access Control

OAuth 2.0 Authentication

CourtFlow uses OAuth 2.0 via Google and Microsoft for authentication. We never see, handle, or store your password — authentication is delegated to your identity provider. Your OAuth access tokens and refresh tokens are stored in our database so that background processing (court-email ingestion, document filing) can continue between your sessions.

Session Management

Browser sessions are issued as signed JSON Web Tokens (JWT) with a 7-day maximum lifetime and a 1-hour sliding refresh window. Signing uses HMAC with a server-side secret (NEXTAUTH_SECRET); session tokens are not reversible into user credentials. Signing out immediately revokes your stored OAuth access and refresh tokens at the server so that background jobs cannot continue to act on your behalf. Access-token expiry is tracked explicitly and refreshed on next use via the provider's refresh endpoint.

Role-Based Access Control (RBAC)

Every user is assigned a role within their firm:

• Admin — Full access to all features including team management, billing, and settings
• Attorney — Full access to cases, documents, AI tools, and exports. Cannot manage team or billing.
• Paralegal — Access to cases, documents, calendar, inbox, and AI tools (chat, brief, discovery). Cannot process emails, create cases, or access team management and billing.
• Read-Only — View-only access to cases and documents. No write access, no AI tools, no email processing.

RBAC is enforced at both the API layer (server-side route protection) and the UI layer (component-level permission checks) to prevent privilege escalation. Role checks are centralized in a single permission matrix; routes call a shared authorization helper rather than open-coding the check each time, which reduces the chance of an inconsistent enforcement.

Route Protection

All /dashboard/* and /admin/* routes are gated by authentication middleware at the framework layer. Unauthenticated requests are redirected to the sign-in page. API routes independently validate the session and the tenant scope of any resource they access, so a direct API call from an authenticated session in Tenant A cannot read or modify data in Tenant B.

Administrative Access

Access to administrative routes (/admin/*) is restricted to a small allowlist of CourtFlow AI staff. Administrative mutations (suspending tenants, modifying billing, editing feature flags) are logged to an immutable activity log with the acting staff member, action, target, timestamp, and request metadata. The activity log is retained for audit purposes and is queryable by authorized reviewers.

Data Security

Encryption in Transit

All traffic between your browser and CourtFlow AI is encrypted using TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enforced with a 1-year policy and subdomain coverage, so browsers that have visited CourtFlow AI will refuse to downgrade to plaintext HTTP on subsequent visits. Connections between our application and our database, Redis cache, and third-party services (Google, Microsoft, Stripe, Resend, Sentry) are likewise encrypted in transit.

Encryption at Rest

Two layers of encryption apply to stored data:

• Database-level (infrastructure): Our PostgreSQL database, hosted on Supabase, encrypts all stored data using AES-256. This protects against unauthorized access to the underlying storage volumes.
• Application-level (OAuth tokens): OAuth refresh tokens — which grant long-lived access to your email and cloud-storage providers — are separately encrypted using AES-256-GCM before being written to the database. The encryption key is held as an environment variable in our production deployment and is not stored in the database itself, so a database-only compromise does not yield usable refresh tokens.

Short-lived access tokens cached in Redis use the Redis provider's transport encryption and at-rest encryption; the underlying cached values have a 1-hour lifetime.

Multi-Tenant Isolation

CourtFlow uses a shared-database, tenant-scoped architecture. Every database record that belongs to a firm carries a tenantId foreign key, and every query that reads or writes such records is required to filter by the authenticated user's tenant. Tenant resolution is centralized in a single server-side helper; API routes do not reconstruct it ad-hoc. Raw SQL usage is parameterized (values are passed as query parameters, never interpolated into SQL strings) to prevent injection attacks that could widen the scope of a query.

Secret Management

Application secrets (database credentials, OAuth client secrets, API keys, the token-encryption key, the cron authentication secret, webhook signing secrets) are stored as encrypted environment variables in our deployment platform. Secrets are not committed to source control, are not logged, and are redacted from error reports before they are forwarded to our monitoring provider.

Input Sanitization

All user inputs are validated and sanitized server-side. AI-generated HTML content displayed in the dashboard is processed through an allowlist-based XSS sanitizer that strips scripts, iframes, event handlers, and other potentially dangerous elements before rendering. Uploaded files are checked for size and MIME type before processing.

API Security

Rate Limiting

Critical API endpoints are protected by sliding-window rate limiters to prevent abuse:

Cron Job Authentication

Automated scheduled tasks (email processing, daily briefings, trash cleanup) are authenticated using a shared secret header. Only Vercel's cron infrastructure can trigger these endpoints.

Error Handling

API error responses are structured to provide user-friendly messages without exposing internal implementation details, stack traces, or database schema information.

Email Authentication

All emails sent from courtflow.ai are authenticated using industry-standard protocols to prevent spoofing and phishing:

• SPF — Sender Policy Framework validates that emails originate from authorized servers
• DKIM — DomainKeys Identified Mail provides cryptographic signature verification for both Google Workspace and Resend sending domains
• DMARC — Domain-based Message Authentication set to p=reject with 100% enforcement, instructing receiving servers to reject any email failing authentication checks

AI Citation Verification

CourtFlow AI generates case law citations as part of document analysis and draft responses. To mitigate the risk of AI-generated hallucinated citations, all case law citations are automatically verified against CourtListener, a legal database operated by the nonprofit Free Law Project containing millions of federal and state court opinions.

Each citation is assigned a verification status:

• Verified — Citation confirmed to exist in CourtListener's database with a matching case
• Probable — Citation format recognized but multiple possible matches or minor discrepancies detected
• Unverified — Citation not found in CourtListener's database. May be accurate but could not be independently confirmed

Only citation text is sent to CourtListener for verification. No client data, case details, or document content is shared with this service.

Infrastructure

Hosting

CourtFlow AI is hosted on Vercel's edge network with automatic geographic distribution, DDoS protection, and SSL termination. Serverless functions execute in isolated containers with no persistent state between requests.

Database

Our PostgreSQL database is hosted on Supabase with connection pooling (pgBouncer), automated backups, and point-in-time recovery. The database is hosted in a SOC 2 Type II compliant data center.

Third-Party Security

• Google Cloud: SOC 1/2/3, ISO 27001, FedRAMP certified
• Microsoft Azure: SOC 1/2/3, ISO 27001, FedRAMP certified
• Supabase: SOC 2 Type II compliant
• Vercel: SOC 2 Type II compliant
• Stripe: PCI DSS Level 1 certified. CourtFlow never handles or stores credit card data.

Document Handling

If you revoke CourtFlow's access to your Google or Microsoft account, we immediately lose the ability to access your documents. Your files remain in your Drive exactly as they are — we have no independent copy.

Incident Response

CourtFlow AI maintains a written incident response plan that classifies incidents by severity, assigns response ownership, and prescribes a specific checklist for the first fifteen minutes after detection. The plan covers suspected data breaches, service outages, and security vulnerabilities, and is rehearsed against a set of named scenarios (AI-provider outages, database connection exhaustion, payment-webhook failures, mass re-authentication events).

In the event of a security incident that affects user data, we commit to:

• Notifying affected users within 72 hours of confirmed breach discovery
• Providing a detailed incident report including scope, root cause, and remediation steps
• Cooperating with applicable regulatory authorities
• Implementing additional safeguards to prevent recurrence

Every severity-1 and severity-2 incident produces a post-mortem document recording the timeline, root cause, and corrective actions. These records are retained for three years and are available to auditors on request.

Your Rights Over Your Data

You can exercise the following rights directly from your account settings, without contacting support:

• Export your data — Download a JSON bundle of your user profile, firm settings, cases, document metadata, deadlines, case notes, time entries, and recent activity log. Settings → Privacy & Data → Download Export.
• Delete your account — Request permanent deletion of all your account data. We immediately revoke OAuth access and schedule hard deletion within thirty days. Settings → Privacy & Data → Delete Account.
• Revoke OAuth access — You may revoke CourtFlow AI's access to your Google or Microsoft account at any time from your provider's account settings. We lose the ability to process further court emails on your behalf immediately.

Compliance Considerations

CourtFlow AI is designed with legal industry compliance in mind. While we are not yet formally certified, our architecture aligns with:

• Public Tool Isolation — Public tools (/try and /rules) are completely isolated from tenant data. Files uploaded to the free analyzer are processed in memory only and never written to disk or database. Public tool users cannot access any tenant data, cases, or documents. Rate limiting (by IP and email) prevents abuse.
• Deadline Delegation Security — Deadline assignments are validated server-side to ensure the assignee belongs to the same tenant. Cross-tenant assignment is not possible. Email notifications contain only the deadline title, due date, and case name — no document content or analysis text.
• Audit Trail Integrity — Audit trail exports are generated on-demand from the database and include tamper-evident timestamps. All deadline actions (creation, completion, assignment, verification) are logged with the acting user's identity and timestamp.
• Data Export Controls — Audit trail and timeline exports are only accessible to authenticated users within their own tenant. Export requests are logged. CSV files are generated server-side and streamed to the client — they are not cached or stored on the server.
• ABA Model Rules — Rule 1.6 (Confidentiality) and Rule 1.1 Comment 8 (Technology Competence) regarding reasonable measures to prevent unauthorized access to client information
• State Bar Ethics Opinions — Cloud storage of client data is generally permitted when reasonable security measures are in place, which our zero-document-storage architecture exceeds
• CCPA / GDPR — We support data access, portability, and deletion rights

Responsible Disclosure

If you discover a security vulnerability in CourtFlow AI, please report it to us responsibly. We ask that you:

• Email your findings to security@courtflow.ai
• Provide sufficient detail to reproduce the issue
• Allow reasonable time for us to address the vulnerability before public disclosure
• Do not access, modify, or delete other users' data during testing

We appreciate security researchers who help us keep CourtFlow safe and will acknowledge valid reports.

Security Questions?

For security inquiries or to report a vulnerability, contact us at security@courtflow.ai.