Data privacy

CaseFlow includes GDPR tools and data privacy controls to help your firm comply with data protection regulations.

GDPR tools

Go to Setup > GDPR to access privacy management features.

Data export (right of access)

If a client requests a copy of their data, you can generate an export:

1. Go to Setup > GDPR
2. Click Data Export
3. Search for the client
4. Click Export

CaseFlow generates a file containing all data associated with that client: contact details, matters, invoices, payments, documents, notes, and any custom field values.

Data erasure (right to be forgotten)

If a client requests deletion of their data:

1. Go to Setup > GDPR
2. Click Data Removal
3. Search for the client
4. Review what will be deleted
5. Confirm erasure

This permanently deletes the client record, contacts, and linked data. Invoices and payments may be retained for legal/tax compliance (configurable).

Be careful: erasure is irreversible.

Consent management

Track whether clients have consented to data processing. On client contact records, there are consent fields showing:

• Whether the contact agreed to data processing
• When they agreed
• What they agreed to

Data portability

The GDPR export generates data in a structured, machine-readable format (JSON or CSV) that can be provided to the client or transferred to another system.

What CaseFlow stores

For each client:

• Contact details (name, email, phone, address)
• Matter information
• Invoices and payment records
• Time entries
• Documents uploaded
• Communication history (emails sent)
• Notes
• Custom field values
• Portal login activity

For staff:

• Name, email, phone
• Login history
• Time entries
• Activity log

Data retention

CaseFlow does not automatically delete old data. Records stay until you remove them manually or use the GDPR erasure tool. This is intentional; law firms typically need to retain records for years (ethical obligations, statutes of limitation, malpractice insurance requirements).

Set your own retention policy and review old records periodically.

Firm data isolation

Your firm's data lives in a completely isolated workspace, separate from every other firm on the platform. There is no shared storage or pooled data. An administrator at another firm cannot see your data, and platform administrators can only see your firm's basic account information (firm name, subdomain, plan) without access to your client records.

What CaseFlow does not do

• CaseFlow does not sell or share your data with third parties
• CaseFlow does not use your data for training AI models
• CaseFlow does not serve ads based on your data
• CaseFlow support staff do not access your data unless you request debugging assistance

Brute force protection

CaseFlow locks accounts after multiple failed login attempts. After 5 consecutive wrong passwords, the account is locked for 15 minutes. This prevents automated password-guessing attacks.

The lockout is per-account, not per-IP. This means a targeted attack against one account triggers the lockout regardless of where the attempts come from.

Session security

Sessions are encrypted and configured with:

• HTTPS-only delivery (your session cookie is never sent over an unencrypted connection)
• Protection from in-browser scripts (no third-party script on a CaseFlow page can read your session cookie)
• Automatic sign-out after 30 minutes of inactivity, which your firm can set between 15 minutes and 8 hours and cannot switch off
• An unconditional 12-hour limit on any single sign-in, regardless of activity

You are warned a minute before either limit is reached, so you do not lose work you were part-way through. Staying signed in on a device you trust is capped at 7 days and requires two-factor authentication.

Automatic sign-out covers all of this in detail, including how to change it and what it means when a client asks.

When you log out, your session is destroyed server-side. You cannot log back in with an old session token.