Security & ownership
Built so the firm stays in control
CaseSteward is designed around three ideas: the firm owns its data, the AI runs under the firm’s own key, and a person approves everything the AI does.
Your AI key, your account
Each firm connects its own AI provider key: OpenAI, Azure OpenAI, Anthropic or Google. A firm can’t finish setup without a working key. AI requests run under the firm’s account with its provider, so the firm’s own agreement with that provider applies, and the firm can see its usage.
Runs in your cloud
CaseSteward is deployed in the firm’s or vendor’s own cloud environment and is ready for Azure. It isn’t a black box: the firm knows where its data lives.
Permissions on every screen and every AI action
Access is layered by practice area and matter type, matter, assignment to a matter, party and feature, and denied by default. The same rules apply to the AI. The assistant, search and the action queue only use what the person asking is allowed to see. The client portal assistant answers only from that client’s own case.
A person approves every action
The AI prepares actions. It doesn’t send, file, sign or bill on its own. Each action waits in the queue until an authorized person approves it.
Append-only audit log
Sign-ins, views, edits, approvals, rejections and exports are recorded with who, when, and before-and-after values. Entries can’t be edited or deleted from the application.
Keys and secrets
AI provider keys are encrypted at rest and shown only as their last four characters after they’re saved.
Questions
For security questions or a review of the architecture, write to [email protected].