Compliance Checklist | CaseFlow Automation

This document answers the questions most commonly raised by enterprise procurement, information security and data protection teams. For the underlying detail, see our Privacy Policy, AI Safety & Security Policy, Security & Compliance Overview, and How We Protect Your Data.

1. Data Protection & Lawful Basis

Are you registered with the ICO?

Yes - registration number ZC013423.

What is the lawful basis for processing?

Performance of contract (operating the Service) and legitimate interests (security, fraud prevention, product improvement). Where the customer processes personal data about claimants/third parties through the Service, the customer is the controller and we act as processor.

Where is data stored?

Within the EU/UK on managed cloud infrastructure with encryption in transit and at rest. International transfers (if any) are covered by appropriate safeguards (e.g. SCCs).

2. PII Masking Architecture

How is PII handled before it reaches the AI?

A mandatory server-side masking gateway sits in front of every AI analysis call. The one call it does not sit in front of is the OCR reading step for scanned documents, which receives the raw page for transcription only under no-training terms, as the scanned-documents Q&A below explains; the text it returns is masked before any analysis call. It detects and replaces common UK identifiers - person names (titled names always, bare names in field-label, salutation and sign-off contexts), emails, phone numbers, NI numbers, VRMs, DOBs, bank details, policy/claim references and street addresses - with neutral placeholders. UK postcodes are deliberately preserved because they are material to basic-hire-rate and locality arguments; a separate output-side scrubber removes any postcode the AI introduces that was not present in the original input.

What happens to PII at rest in your database?

A second masking pass runs at the database level via PostgreSQL triggers (public.mask_pii()) before persistence. Saved correspondence, AI replies, case advice and pre-emptive letters contain placeholders rather than raw identifiers, even when accessed directly.

Can residual PII be scrubbed if you find some?

Yes. Records can be re-masked or deleted on request. AI provider prompts are processed under terms restricting their use to delivering the service and prohibiting training. CaseFlow keeps no prompt history of its own to scrub.

3. Document & PDF Handling

Are uploaded PDFs stored on your server?

No, not for typed, text-based PDFs. On every upload surface they are processed entirely in the user's browser using PDF.js; only extracted text is sent to our backend. Scanned PDFs and photographs are the one exception, see below.

What about scanned (image-only) PDFs?

The browser cannot read these, because there is no text inside them to extract. The page itself is read by the AI (OCR) under no-training terms, and the personal identifiers we can detect are masked in the returned text before any analysis call. Depending on the tool the file is either placed in a private temporary storage bucket for OCR, deleted immediately after processing with a scheduled job removing any object older than 24 hours as a safety net, or held in memory for a single request and never stored.

What does the Loss-of-Use Chronology tool store?

Nothing. Uploaded documents are held in memory for the length of a single request, masked, read and returned to the browser. No row is written to any table and no file is written to any storage bucket. The tool ingests the engineer's report, the payment pack (hire agreement and invoice), the GTA Hire Period Validation Form, and repair and hire monitoring notes. It has no medical or injury document slot. Access is controlled by a per-client feature flag and the tool is currently limited to a single client in controlled beta.

3a. Recent Compliance Activity

Date	Entry
7 August 2026	Loss-of-Use Chronology tool entered controlled beta behind the per-client `loss_of_use_chronology` feature flag, defaulted off for all clients, with a zero-storage design (no table writes, no bucket writes).
18 August 2026	Compliance review of the Loss-of-Use Chronology tool completed: document categories, zero-storage design, PII masking coverage and feature gating confirmed and documented.
19 August 2026	Admin bypass removed from the Loss-of-Use Chronology route guard. Access is now governed purely by the per-client feature flag, which is enabled for the Icon client only. Administrators on other clients can no longer reach the tool by URL.
20 August 2026	Scanned-document and OCR accuracy wording round: public pages and policy documents updated so that local-extraction claims are qualified as applying to typed documents, and the OCR-then-mask path for scanned PDFs and photographs is described explicitly.
8 September 2026	Correction round and vendor withdrawal. In-app and public wording corrected to describe the scanned-document AI reading step accurately. A server-side PDF parsing engine (Fire-PDF, provided by Firecrawl Inc.) had been in use on the case upload surfaces since approximately July 2026; it was withdrawn on 8 September 2026 pending satisfactory data-processing terms from the vendor, and all PDF parsing returned to in-browser extraction plus the AI OCR reading step for scans. No change to masking, analysis or storage behaviour.

4. Retention

CreditHire Assist is designed not to retain personal case data. Uploaded text and the outputs the tool generates are deleted immediately on session close. A continuous scheduled purge runs as a backstop, so nothing is ever retained beyond 24 hours. Users save anything they need to keep to their own systems (a copy button is provided) and re-run if required.

Data type	Retention period
Account / profile data	Life of account + 30 days
Uploaded text, AI replies, case advice, pre-emptive letters and other case outputs	Deleted immediately on session close; continuous scheduled purge ensures nothing is retained beyond 24 hours
Activity / audit logs	12 months
Temporary scanned-PDF files (OCR only)	Deleted on completion; max 24h via scheduled purge
Database backups (disaster recovery)	Uploaded files are never included in any backup. Standard disaster-recovery backups exist for the database, but because case content is deleted within 24 hours those backups hold essentially no personal case data, and once a record is deleted there is nothing to restore it from.
AI prompts (after masking)	Sent to the AI provider for processing under terms restricting its use to delivering the service, including a restriction on training. Not retained by CaseFlow.

Special category data: The Service is not intended for special-category data and users are asked not to submit it. We recognise that in credit hire work, health, injury or vulnerability information can incidentally appear in free-text correspondence. Where it does, the same safeguards apply (masking, data minimisation, encryption and immediate deletion), and as data controller the customer remains responsible for the Article 9 lawful basis.

Data Processing Agreement: A Data Processing Agreement (DPA) is available to enterprise customers on request. Contact info@caseflowautomation.co.uk.

5. AI Governance

Do you train AI models on customer data?

No. We do not train or fine-tune models on customer data, and our AI provider is contracted not to use prompts/outputs for training.

How do you prevent hallucinated case law?

Closed knowledge base; prompts forbid uncited authority; deterministic model settings; mandatory limitation language when no authority exists; outputs presented as drafts requiring human review.

Is AI making decisions on behalf of users?

No. All outputs are decision-support drafts. A human reviews and approves before any action is taken.

6. Access Control & Authentication

Per-tenant data isolation enforced via PostgreSQL Row-Level Security.
Role-based access (handler, manager, admin) - admins do not see correspondence content.
Email-verified accounts; invite-only registration; concurrent session detection.
Suspended users are blocked at both the policy layer and the application layer.

7. Audit & Logging

All AI invocations and feature usage are logged (user, company, timestamp, function).
PII masking logs record categories and counts only - never original values.
Login attempts, suspensions and admin actions are logged for 12 months.

8. Sub-Processors

We engage the following sub-processors to deliver CreditHire-Assist. Their processing is governed by data processing terms no less protective than those we owe our customers. The list is reviewed regularly and updated on material change.

Sub-processor	Service provided	Location
Supabase Inc. (via Lovable Cloud)	Managed PostgreSQL, authentication, file storage; hosted on AWS	EU (eu-west-1, Ireland)
Lovable (platform & hosting)	Application hosting, CI/CD, AI Gateway routing	EU
Google LLC (Gemini, via Lovable AI Gateway)	AI inference under no-training enterprise terms. For scanned documents the raw page image is transmitted for transcription under the same no-training terms	Gateway entrypoint EU-hosted; inference at US-hosted provider endpoints. Transfers under UK IDTA / SCCs
Cloudflare, Inc.	CDN, TLS termination, traffic proxying	Global edge, EU-preferred
Resend, Inc.	Transactional and reporting email delivery. Receives the recipient email address and the full content of each message. Depending on the message type this content includes: account and authentication emails (name, email address, sign-in and password links); contact and enquiry emails (name, email address, company, message text); the monthly Insights digest (email address and article titles); and administrative usage and activity reports, which name individual users and carry their email address, last sign-in date and per-tool action counts for the reporting period. No claimant case content and no uploaded case documents are sent by email	EU / US, under DPA

Lovable's published Data Processing Agreement, including the published sub-processor list, is available at trust.lovable.dev and is incorporated by reference. The hosting region for our project is EU (Europe, Ireland). Transfers outside the EU at the AI inference layer are safeguarded through Standard Contractual Clauses at the Lovable-to-Google contractual layer; the formal IDTA / UK Addendum to the EU SCCs and Transfer Impact Assessment documentation is available via Lovable's Trust Center on B2B compliance request.

9. Incident Response & Breach Notification

Security incidents are logged in a dedicated incident register with severity, scope and remediation.
Where a personal data breach is likely to result in a risk to data subjects, we will notify affected customers without undue delay and the ICO within 72 hours, in line with UK GDPR Art. 33.

10. Policy Acknowledgements

All users acknowledge our Privacy Policy, AI Safety & Security Policy and Terms on signup. When we issue a material policy change, users are required to re-acknowledge the updated version on next login.