SECURITY & PRIVILEGE

A litigation matter is privileged in its entirety. So we built it so we cannot read it.

Here is how Case Scaffold keeps your matters and your clients' communications private, written plainly, including the few things our servers do see.

Encrypted on your device, end to end

Each matter has its own key. Everything in it (cards, drafts, exhibits, uploads, comments) is encrypted on your computer before it is sent. Our servers store and pass along ciphertext only. They keep no readable copy, no text index and no preview.

Because the server cannot read a matter, the work happens on your device: editing, search, the Check, quotation comparison, compiling and the Verification Record. It works offline and syncs when you reconnect.

  1. 1You write or attach something in a matter.
  2. 2Your device encrypts it under the matter's key.
  3. 3The server stores the ciphertext, a receipt time and a hash, and relays it to the matter's other members.
  4. 4Only their devices, holding the key, can open it.

What our servers can and cannot see

Cannot see

  • Matter titles, clients, parties and case details
  • Cards, arguments, drafts and filings
  • Exhibits, transcripts and every file you attach
  • Comments, and everything in a client space
  • What you search for inside your matters

Can see

  • Your account and its email address
  • Which accounts are members of which matter
  • Sizes and times of changes, and how often a matter changes
  • The type letter of each card's short ID (for example, A for authority)
  • A citation you look up through our CourtListener connection; with your own token, the lookup goes from your computer instead
  • If your firm uses the shared calendar: who appears, when, where and the public docket number, nothing else

Keys and recovery

A printed recovery key

Shown once at setup, kept by you. A firm can also hold an escrow key for its matters.

No back door

Without a device, the recovery key or the firm's escrow key, nobody can recover a matter, including us.

Automatic re-keying

When someone leaves or a device is lost, their matters get a new key for everything written afterwards.

Fingerprint checks

Members can compare key fingerprints, and each comparison is recorded.

PRIVILEGE BY DESIGN

Built to keep attorney–client communications, and work product, where they belong

Client spaces

Clients sign in to their own space, sealed under its own key, to upload files, answer your requests and comment on what you share. They never hold the matter's key, and you bring their files into the matter yourself.

Content-free notices

Email says only that something happened ("Your client uploaded 2 files on one of your matters"). The details open in the app.

Facts never leave the matter

Your firm's shared library carries authorities and house style only. Facts, exhibits, testimony, parties, weaknesses and notes are refused by name.

No firm dashboard

Nobody sees a matter they are not on. A firm administrator sees which matters exist and who is on them, never their content.

Experts and consultants, confined

Outside professionals see only what a matter's lawyer shares with them.

A sealed conflicts check

Party names go into a sealed index opened only by people your firm gives the Conflicts role. A hit on a walled matter says only that a conflict is possible, and whom to ask.

Working with opposing counsel

A shared space for comments toward an agreed document, such as a protective order. Only your firm adds people. It is never a means of service.

Sealed reading links

A reviewer's link hands over a sealed copy of what you chose, never the matter's key, and opens in the app by default.

Case Scaffold is a tool. Whether privilege or work-product protection applies is a question of law and of how a matter is handled; no software can guarantee it.

Verifiably free of AI

No generative or language model, and no call to one, anywhere. A reproducible build lets your IT team confirm that the app you run is the one we published. Court libraries arrive as signed packages, and app updates are signed and checked before they install.

Your data stays yours

Export everything at any time. Set retention per matter, and purge a matter on request with written confirmation. Signing out clears local data from a shared computer. Firms can request our data processing agreement.