AES-256 Encryption
Documents are encrypted with AES-256-GCM before storage.
Each file uses a unique IV and authentication tag. Encryption keys are never stored beside ciphertext.
SeraCase Trust Center
Security
Plain-language explanations of the controls that protect confidential case materials.
TLS Encryption
Traffic between your browser and SeraCase uses HTTPS/TLS.
Sessions and API calls travel over encrypted connections to protect credentials and case materials in transit.
Private Storage
Uploads live in private cloud buckets — not public links.
Objects are not publicly listable. Access uses short-lived signed URLs or authenticated decrypt proxies.
Row-Level Security
Database policies restrict each account to its own records.
Supabase RLS and ownership checks help ensure users cannot read another user’s cases, files, or chats.
Malware Scanning
Uploads are scanned before processing continues.
Heuristic checks and optional remote scanning run before OCR/AI. Suspicious files are quarantined.
Virus Detection
Executable payloads and known test signatures are blocked.
Dangerous extensions, magic-byte executables, and EICAR-style signatures are rejected with clear user messages.
Encrypted Backups
Platform backups rely on provider encryption at rest.
Infrastructure-level encryption complements application-layer file encryption for stored materials.
Signed URLs
Preview and export links expire quickly.
Document previews and case export downloads use short TTLs to reduce risk if a link is shared accidentally.
Audit Logging
Security-relevant actions are recorded for accountability.
Login, upload, download, delete, export, and related events can be reviewed in your activity history.
Role-Based Access
Admin tools are allowlist-gated; users own their cases.
Ordinary accounts cannot access admin diagnostics. Cross-user browsing of workspaces is not permitted.
MFA Support
Authenticator-app MFA can be required after password sign-in.
When MFA is enrolled, protected areas require a second factor (AAL2) before the workspace opens.
Automatic Session Protection
Idle sessions expire; activity cookies are integrity-checked.
Signed last-activity cookies and trusted-device options reduce risk on shared machines.
Secure Password Reset
Reset flows use email recovery links and session controls.
Password changes are audited. Prefer a strong unique password and MFA for mediator and firm accounts.
Security Headers
Browser protections help reduce common web attacks.
CSP, HSTS, X-Frame-Options, and related headers harden the application surface.
Rate Limiting
Sensitive routes throttle abusive traffic.
Login, uploads, downloads, and AI routes apply request limits to slow credential stuffing and cost abuse.
Where to manage security in the product
Signed-in users can open Security Center and Settings → Security to enable MFA, review trusted devices, and download audit activity. Admins can run the internal security diagnostics scorecard.