Built for legal confidentiality. CourtFlow AI was designed from the ground up to meet the data security expectations of litigation professionals. Your court documents never touch our servers — they go directly to your own Google Drive or OneDrive. We store only the metadata and AI analysis needed to power your dashboard.
Architecture Overview
CourtFlow AI follows a zero-document-storage architecture. When court emails arrive, our system processes the attached PDFs in memory, sends them to Google Gemini for analysis, files them directly to your cloud storage, and stores only the AI-generated summary and extracted metadata in our database.
Court Email → Email API (Gmail / Graph) → PDF Extraction (in memory)
→ Google Gemini AI Analysis (in transit) → Summary stored in DB
→ PDF filed to YOUR Drive/OneDrive (your storage, your control)
Authentication & Access Control
OAuth 2.0 Authentication
CourtFlow uses industry-standard OAuth 2.0 via Google and Microsoft for authentication. We never see, handle, or store your password. Authentication tokens are encrypted using JWT with rotating secrets and automatic token refresh.
Role-Based Access Control (RBAC)
Every user is assigned a role within their firm:
- Admin — Full access to all features including team management, billing, and settings
- Attorney — Full access to cases, documents, AI tools, and exports
- Paralegal — Access to cases, documents, calendar, and inbox. Restricted from team management, billing, and administrative settings
RBAC is enforced at both the API layer (server-side route protection) and the UI layer (component-level permission checks) to prevent privilege escalation.
Route Protection
All dashboard routes are protected by authentication middleware. Unauthenticated requests are redirected to the sign-in page. API routes validate session tokens on every request.
Data Security
Encryption
- In transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3
- At rest: Our PostgreSQL database (hosted on Supabase) encrypts all data at rest using AES-256 encryption
- Tokens: OAuth access tokens and refresh tokens are encrypted before storage using industry-standard JWT encryption
Multi-Tenant Isolation
CourtFlow uses a multi-tenant database architecture with strict row-level isolation. Every database query is scoped to the authenticated user's tenant ID. There is no mechanism by which one firm can access another firm's data — even in the event of an application-level vulnerability, data is partitioned at the query layer.
Input Sanitization
All user inputs are validated and sanitized server-side. AI-generated HTML content displayed in the dashboard is processed through an allowlist-based XSS sanitizer that strips scripts, iframes, event handlers, and other potentially dangerous elements before rendering.
API Security
Rate Limiting
Critical API endpoints are protected by sliding-window rate limiters to prevent abuse:
Cron Job Authentication
Automated scheduled tasks (email processing, daily briefings, trash cleanup) are authenticated using a shared secret header. Only Vercel's cron infrastructure can trigger these endpoints.
Error Handling
API error responses are structured to provide user-friendly messages without exposing internal implementation details, stack traces, or database schema information.
Infrastructure
Hosting
CourtFlow AI is hosted on Vercel's edge network with automatic geographic distribution, DDoS protection, and SSL termination. Serverless functions execute in isolated containers with no persistent state between requests.
Database
Our PostgreSQL database is hosted on Supabase with connection pooling (pgBouncer), automated backups, and point-in-time recovery. The database is hosted in a SOC 2 Type II compliant data center.
Third-Party Security
- Google Cloud: SOC 1/2/3, ISO 27001, FedRAMP certified
- Microsoft Azure: SOC 1/2/3, ISO 27001, FedRAMP certified
- Supabase: SOC 2 Type II compliant
- Vercel: SOC 2 Type II compliant
Document Handling
We never store your documents. Court PDFs are processed entirely in memory and transit. They are downloaded from your email, sent to Gemini for analysis, filed to your Google Drive or OneDrive, and then discarded from our systems. The only data we retain is the AI-generated summary, extracted deadlines, and case metadata.
If you revoke CourtFlow's access to your Google or Microsoft account, we immediately lose the ability to access your documents. Your files remain in your Drive exactly as they are — we have no independent copy.
Incident Response
In the event of a security incident affecting user data, we commit to:
- Notifying affected users within 72 hours of confirmed breach discovery
- Providing a detailed incident report including scope, root cause, and remediation steps
- Cooperating with applicable regulatory authorities
- Implementing additional safeguards to prevent recurrence
Compliance Considerations
CourtFlow AI is designed with legal industry compliance in mind. While we are not yet formally certified, our architecture aligns with:
- ABA Model Rules — Rule 1.6 (Confidentiality) and Rule 1.1 Comment 8 (Technology Competence) regarding reasonable measures to prevent unauthorized access to client information
- State Bar Ethics Opinions — Cloud storage of client data is generally permitted when reasonable security measures are in place, which our zero-document-storage architecture exceeds
- CCPA / GDPR — We support data access, portability, and deletion rights
Responsible Disclosure
If you discover a security vulnerability in CourtFlow AI, please report it to us responsibly. We ask that you:
- Email your findings to security@courtflow.ai
- Provide sufficient detail to reproduce the issue
- Allow reasonable time for us to address the vulnerability before public disclosure
- Do not access, modify, or delete other users' data during testing
We appreciate security researchers who help us keep CourtFlow safe and will acknowledge valid reports.
Security Questions?
For security inquiries or to report a vulnerability, contact us at security@courtflow.ai.