Data Security

Last updated: July 2026

Casely holds some of the most sensitive information a business can hold — privileged client communications, case files, and trust-account records. Security is not a feature we bolt on; it is how the platform is built.

Encryption everywhere

In transit. All traffic to casely.cc and the Casely application is served over HTTPS/TLS. We do not accept unencrypted connections.
At rest. The database and file storage that back the platform are encrypted at rest by our infrastructure provider.
Application-layer encryption. The most sensitive fields — including matter notes, matter descriptions, trust-ledger entries, and uploaded documents — are additionally encrypted inside the application with per-firm keys before they are written to storage. A stolen database dump or a support engineer with database access sees only ciphertext, never your clients' data.

Access control

Role-based permissions. Every user is scoped by a role across a 20-module permission matrix, enforced on the server for every request — not just hidden in the interface.
Multi-tenant isolation. Each firm's data is strictly partitioned. One firm can never read another firm's records.
Ethical walls. Firms can wall specific staff off specific matters; walled users never see that case anywhere — lists, calendar, documents, or search.
Two-factor authentication. Time-based one-time-password (TOTP) 2FA is available and enforced at login when enabled.

Accountability

Tamper-evident audit log. Sensitive actions are recorded in an audit trail that can be verified for integrity.
Document access logs. Every view and download of a document is logged with the user, time, and context.
Trust-accounting safeguards. The trust ledger blocks overdrafts at the database level and never deletes entries — mistakes are voided, not erased, preserving a complete record.

Infrastructure & operations

The platform runs on hardened, industry-standard cloud infrastructure with encrypted storage and network isolation.
Passwords are stored only as salted one-way hashes (PBKDF2); they are never recoverable, even by us.
Session tokens are short-lived and rotate automatically.

Compliance alignment

Our controls are designed to align with SOC 2, ISO 27001, and GDPR expectations. See our GDPR & EU compliance page for data-subject rights and international-transfer details.

Reporting a concern

If you believe you've found a security issue, please reach us through the contact page so we can investigate promptly.