01
The parties
The Customer is the firm or practitioner that holds the account and its matters. The Customer decides what is written, who is on each matter, and how long each matter is kept.
The Provider is KRDL Solutions, organized in Virginia, which runs the Case Scaffold service and publishes its apps. The Provider processes data only on the Customer's behalf and on its instructions, which are the service's settings and the actions of the Customer's users.
Who it covers: the Customer's lawyers and staff, and everyone the Customer invites into its work: its clients, the consultants and experts it engages, outside co-counsel, and opposing counsel in a negotiation space. Their account data is processed on the Customer's behalf.
When and where: from the Customer's first use, including the free beta. The service is offered in the United States, and data is stored and processed in the United States.
02
What we process, and what we cannot read
Matter content is encrypted on your users' devices. The keys are made there and never reach us in a form we can open.
| Data | Readable by KRDL Solutions? |
|---|---|
| Matter content: cards, filings, titles, comments, attachments, versions | No. Stored and relayed sealed |
| Client spaces: clients' uploads, messages and shared documents | No. Sealed under the space's own key |
| Consultant engagements and spaces shared with opposing counsel | No. Each sealed under its own key |
| The firm's conflicts index of party names | No. Sealed; opened only by the firm's Conflicts role |
| Keys | Public keys only. A firm's escrow key is the firm's |
| Account data: email address, name, plan, sessions | Yes |
| Membership: who is on which matter, in what role; a firm administrator's list of matters and members, without content | Yes |
| Notifications: which space, who acted, when, how many | Yes; no titles, file names or message text |
| Metadata: sizes and receipt times of sealed items; device records | Yes |
| Firm calendar, if the firm uses it: who appears, when, where, and the public docket number | Yes, by the firm's choice; nothing else of the matter |
| Firm and document templates, master court forms, conflict rules and house style | Yes; they hold no matter content |
| Which parts of the public reference library a device downloads | Yes; this can indicate a matter's court |
| A published library of authorities | Yes, by the publisher's choice. It can never carry facts, exhibits, testimony, parties or notes |
| A citation looked up through our CourtListener connection | Passed through when a user asks. With the user's own token, the lookup goes from their computer instead |
| Operational logs | Yes, with share tokens and sign-in addresses redacted |
Nothing is sent to any language model or analytics service, nothing a Customer writes is used to train anything, and there is no advertising.
03
Retention and deletion
- Users may export any matter's complete archive, in open formats, at any time.
- Deleting a matter can be undone. Purging removes it from the server for good, on the owner's request or after a retention date the owner sets, with notices 30 and 7 days before.
- Each purge ends with a written confirmation of what was removed, in counts and identifiers, never content.
- Nightly backups hold sealed bytes until they age out: daily copies after 30 days, monthly copies after 12 months.
- At the end of the agreement, the Customer has six months to export; after that, every matter is purged and the purge confirmed in writing.
04
Our obligations
- Process the Customer's data only to provide the service, and on the Customer's instructions.
- Bind everyone who operates the service to confidentiality. No administrative screen shows a matter's content, and every administrative change is recorded.
- Maintain the security measures in the agreement's annex, reviewed at every release.
- Notify the Customer of a security breach affecting its data as soon as practicable, saying what could have been exposed.
- Help the Customer answer a person's request about their data, to the extent we can read it.
- On a request from a public authority, we as the data processor notify the Customer immediately on receiving any request for disclosure, binding or non-binding, unless the law prohibits it. We can produce only what we can read; we hold no key to any matter.
- Make available what shows we meet these obligations: this agreement, our security review and the reproducible build.
05
Subprocessors
We will tell Customers before adding or replacing one.
| Subprocessor | Purpose | Region |
|---|---|---|
| Railway | Hosts the server and database (sealed content, account data, metadata) | United States (US East) |
| Cloudflare R2 | Nightly database backups (matter content stays sealed) | Eastern North America |
| Resend | Sign-in codes and content-free notices | United States |
| CourtListener (Free Law Project) | Answers citation lookups | United States |
| Stripe | Merchant of record for subscription payments, once billing begins (not used in the beta) | United States |
06
Legal terms
The agreement is governed by the laws of the Commonwealth of Virginia. Stripe is the merchant of record for subscription payments, so payment is between the Customer and Stripe under Stripe's terms. Each party's total liability for data-protection claims is capped at two times the fees paid or payable in the twelve months before the event, and neither party is liable for indirect or consequential damages, as the agreement sets out.
Request the data processing agreement
We will send the agreement to your firm when it is final, and answer questions from your IT or compliance team.
Please do not enter client information in this form.