CaseFlow Automation Ltd is designed to minimise the personal data that ever reaches the AI model, while still giving you high‑quality legal drafts.
When you upload a typed, text-based PDF, it is processed directly in your browser. The original document is not uploaded to our servers; only extracted text is sent securely for analysis.
Scanned PDFs and photographs work differently. There is no text inside them for the browser to read, so the page itself has to be read by the AI first. Depending on the tool, the file is either sent to a private temporary store so it can be OCR'd and then deleted immediately afterwards (with a safety-net purge of anything older than 24 hours), or held in memory for the length of a single request and never stored at all. Either way the AI reads it under zero-retention, no-training terms, and the personal identifiers we can detect are masked in the returned text before any analysis call.
The Loss-of-Use Chronology tool stores nothing at all: documents are processed in memory only, with no row written to any table and no file written to any bucket.
Before any text is sent to the AI model, it passes through our server‑side PII masking gateway. This gateway attempts to detect and replace common identifiers with neutral placeholders, so the model sees the structure of the case but not the underlying personal details.
The same masking is applied again at the database level via triggers, so the saved history of correspondence, replies, advice and letters contains placeholders rather than raw identifiers. If our database were ever accessed without authorisation, the personal details would already be redacted.
Our gateway uses pattern‑based rules tuned for UK claims data. It attempts to detect and replace items such as:
UK postcodes are deliberately preserved. Postcodes are material to basic-hire-rate and locality arguments, so they reach the model by design. A separate output-side scrubber then removes any postcode the AI introduces that was not present in the original input.
Each masked item is replaced with a generic placeholder (for example, [EMAIL_REDACTED] or [VRM_REDACTED]), so you can still understand the draft, but the AI model does not see the raw identifier.
The masking gateway is a mandatory step for all AI‑related features (such as analysing correspondence, generating replies, and case advice). There is no bypass path: all text that reaches the model for analysis passes through the gateway, including text produced by OCR of a scanned page.
Every call records how many items were masked and which categories (e.g. "3 items redacted: email, VRM, reference"), but we never log the original values.
This supports GDPR principles of data minimisation, privacy by design, and accountability, and gives you an audit trail for your own DPIA and compliance checks.
We understand that "trust us, it's local" isn't enough - especially when dealing with client data. Here's a plain-English explanation of why this is verifiable, and what to tell a sceptical client or IT team.
PDF processing is performed using a standard browser technology called PDF.js, which is the same open-source library used by Firefox to display PDFs natively. It runs entirely within the browser tab - no server connection is made during this step. This is not a policy choice; it is how the technology is architected.
Any IT professional can confirm this using their browser's built-in traffic monitor. If they watch the network traffic while a PDF is uploaded, they will see:
🔍 In plain terms: Your typed PDF document never travels across the internet. The words inside it do - but only after personal details have been replaced with placeholders like [NAME_REDACTED]. The document itself stays on your computer at all times.
âś… The AI works on masked text, not raw personal identifiers.
âś… Typed PDFs stay on your device. Scanned PDFs and photos are the exception: they are sent to be read by the AI, then masked, and either deleted straight after OCR or never stored at all.
âś… The Loss-of-Use Chronology tool stores nothing at all, in memory only for the length of the request.
âś… Saved history is masked at rest in the database, not just in transit to the AI.
âś… We do not use your data to train AI models, and we design our architecture to send as little personal data as possible to the external model.
Our PII masking gateway acts as an automated safety net - users are not required to manually redact documents before upload. The system is designed to handle data hygiene on their behalf as a mandatory, always‑on processing step.