CaseFlow Automation Ltd

How We Protect Your Data

How our PII masking protects your data
Last Updated: 25 June 2026

CaseFlow Automation Ltd is designed to minimise the personal data that ever reaches the AI model, while still giving you high‑quality legal drafts.

Three‑Layer Privacy Design

Layer 1 - Local Processing (typed documents)

When you upload a typed, text-based PDF, it is processed directly in your browser. The original document is not uploaded to our servers; only extracted text is sent securely for analysis.

Scanned PDFs and photographs work differently. There is no text inside them for the browser to read, so the page itself has to be read by the AI first. Depending on the tool, the file is either sent to a private temporary store so it can be OCR'd and then deleted immediately afterwards (with a safety-net purge of anything older than 24 hours), or held in memory for the length of a single request and never stored at all. Either way the AI reads it under zero-retention, no-training terms, and the personal identifiers we can detect are masked in the returned text before any analysis call.

The Loss-of-Use Chronology tool stores nothing at all: documents are processed in memory only, with no row written to any table and no file written to any bucket.

Layer 2 - PII Masking Gateway (in transit)

Before any text is sent to the AI model, it passes through our server‑side PII masking gateway. This gateway attempts to detect and replace common identifiers with neutral placeholders, so the model sees the structure of the case but not the underlying personal details.

Layer 3 - At-Rest Masking (in storage)

The same masking is applied again at the database level via triggers, so the saved history of correspondence, replies, advice and letters contains placeholders rather than raw identifiers. If our database were ever accessed without authorisation, the personal details would already be redacted.

What We Try to Mask

Our gateway uses pattern‑based rules tuned for UK claims data. It attempts to detect and replace items such as:

UK postcodes are deliberately preserved. Postcodes are material to basic-hire-rate and locality arguments, so they reach the model by design. A separate output-side scrubber then removes any postcode the AI introduces that was not present in the original input.

Each masked item is replaced with a generic placeholder (for example, [EMAIL_REDACTED] or [VRM_REDACTED]), so you can still understand the draft, but the AI model does not see the raw identifier.

Always‑On, Logged, and Auditable

The masking gateway is a mandatory step for all AI‑related features (such as analysing correspondence, generating replies, and case advice). There is no bypass path: all text that reaches the model for analysis passes through the gateway, including text produced by OCR of a scanned page.

Every call records how many items were masked and which categories (e.g. "3 items redacted: email, VRM, reference"), but we never log the original values.

This supports GDPR principles of data minimisation, privacy by design, and accountability, and gives you an audit trail for your own DPIA and compliance checks.

How Can You Be Sure?

We understand that "trust us, it's local" isn't enough - especially when dealing with client data. Here's a plain-English explanation of why this is verifiable, and what to tell a sceptical client or IT team.

đź“„
Think of it like a photocopier with a shredder built in.
When you load a letter into a photocopier, the machine reads it and produces a copy - but the original letter never leaves the room. CreditHire Assist works the same way. A typed PDF is "read" inside your own browser. The system extracts the words, then the original document stays put. Only the extracted words, with personal details stripped out, are sent anywhere. A scanned page or photo is the one exception: it has no words inside to extract, so the page is passed to the AI to be read, then masked.

The Technical Reason

PDF processing is performed using a standard browser technology called PDF.js, which is the same open-source library used by Firefox to display PDFs natively. It runs entirely within the browser tab - no server connection is made during this step. This is not a policy choice; it is how the technology is architected.

What an IT Team Can Verify

Any IT professional can confirm this using their browser's built-in traffic monitor. If they watch the network traffic while a PDF is uploaded, they will see:

🔍 In plain terms: Your typed PDF document never travels across the internet. The words inside it do - but only after personal details have been replaced with placeholders like [NAME_REDACTED]. The document itself stays on your computer at all times.

What This Means for You

âś… The AI works on masked text, not raw personal identifiers.

âś… Typed PDFs stay on your device. Scanned PDFs and photos are the exception: they are sent to be read by the AI, then masked, and either deleted straight after OCR or never stored at all.

âś… The Loss-of-Use Chronology tool stores nothing at all, in memory only for the length of the request.

âś… Saved history is masked at rest in the database, not just in transit to the AI.

âś… We do not use your data to train AI models, and we design our architecture to send as little personal data as possible to the external model.

Our PII masking gateway acts as an automated safety net - users are not required to manually redact documents before upload. The system is designed to handle data hygiene on their behalf as a mandatory, always‑on processing step.