We know that "AI", "data privacy", and "GDPR" can sound intimidating. This guide explains what CaseFlow actually does, how it keeps your information safe, and what you need to know - all in plain English.
CaseFlow helps credit hire teams deal with insurer correspondence faster and with greater confidence. You paste in (or upload) a letter from an insurer, and the system analyses the legal arguments they're making, identifies which court cases they're relying on, and helps you draft a professional response.
Think of it as a very well-read assistant that's studied all the key credit hire case law - but one that always needs you to check its work before anything goes out the door.
CaseFlow uses Google's Gemini 3 Pro - one of the most capable AI models available - for tasks that need careful legal reasoning, like case advice and drafting argument letters. For quicker tasks like initial analysis, it uses Gemini 3 Flash, which is faster but still very capable.
These are the same models used by major businesses worldwide. We don't use an experimental or unproven system.
This is the biggest risk with AI in a legal context - it's called "hallucination", where the AI invents a case name or citation that doesn't exist. We take this extremely seriously and have built a three-layer protection system that every AI output must pass through before it reaches you:
That said, no AI is perfect. We always recommend checking case citations independently before using them. The system is a starting point, not a final answer.
On most screens your PDFs never leave your computer - with two exceptions, both set out below. When you upload a normal text-based PDF on one of those screens, it's read and converted to text right there in your web browser. The actual file is never sent to our servers.
Exception 1: scanned (image-only) PDFs and photos. There is no text inside them for the browser to read, so the page itself is sent to be read by the AI and turned into text. That reading step is transcription only: the model is asked to copy out the words exactly, not to interpret or analyse them, and it does so under no-training terms. The text that comes back is then masked before any analysis call. Depending on the tool the file is either held in a private temporary store and deleted immediately after reading (with a safety-net wipe of anything older than 24 hours) or held in memory for a single request and never stored at all. Scans are a routine part of credit hire work, so this path is used regularly rather than rarely.
Everywhere else, only the text content is sent for analysis - and even then, it goes through our privacy filter first (more on that below).
We understand that "trust us" isn't always enough - particularly if your IT team or a client wants proof. The short answer, for a digital text-based PDF on a local-extraction screen: any IT professional can watch your browser's network traffic while the PDF is being loaded. They will see zero outbound requests at that stage. The only call to our servers happens after you click Analyse, and it carries extracted text - not the original file. On those screens the document genuinely never moves.
This isn't just our policy - it's how the underlying technology works. PDF reading runs entirely inside the browser tab, using the same open-source library that Firefox uses to display PDFs natively. That library is physically incapable of uploading the file. The one exception above behaves differently: a scanned page or photo is sent to be read by the AI. On that path you will see an outbound request, and it is meant to be there.
Before any text is sent to the AI, it passes through our PII masking gateway. "PII" stands for Personally Identifiable Information - things like names, email addresses, phone numbers and registration plates.
Our system attempts to detect these and replaces them with placeholders. So instead of seeing "Mrs Lisa Chen", the AI sees "[NAME_REDACTED]". Instead of "john.smith@example.com", the AI sees "[EMAIL_REDACTED]". Instead of "AB12 CDE", it sees "[VRM_REDACTED]".
Here's what we try to catch:
Postcodes are deliberately kept. UK postcodes matter to locality and basic-hire-rate arguments, so we leave them in the text the AI sees. As a safeguard, an output check then removes any postcode the AI tries to introduce that was not in your original text.
An honest note: Automated pattern-based masking is a strong first layer, but it isn't a perfect filter. That's why we also ask you to send only the personal data the task actually needs. Anything that slips through is covered by the next layers: our AI provider does not use your data to train models, and the data itself is deleted shortly afterwards on session close, with a continuous purge as a backstop so nothing is retained beyond 24 hours.
The masking runs in two places: once before text is sent to the AI, and again at the database level when results are saved. That means the history we keep on our servers (your past analyses, replies, advice and letters) already contains placeholders like [NAME_REDACTED] rather than real names or contact details. If our database were ever accessed without authorisation, the personal information has already been stripped out.
No. CaseFlow does not train or fine-tune AI models on your data. Your correspondence and case details are processed to provide the response you request. Our platform provider's agreements with the AI model providers prohibit using your inputs and outputs for model training.
No. Every company on CaseFlow operates in its own completely separate space. Your correspondence, case advice, templates, and history are invisible to other companies. This is enforced at the database level - it's not just a setting that could be accidentally turned off.
GDPR (the UK's data protection law) requires organisations to only collect and process the minimum personal data necessary, to protect it properly, and to be transparent about what they do with it. Here's how we line up:
âś… Data minimisation: PDFs stay on your device. Text is masked before reaching the AI.
âś… Privacy by design: The masking gateway is mandatory - there's no way to bypass it.
âś… Transparency: We tell you exactly what we do (you're reading it now).
âś… Your rights: You can request access to, correction of, or deletion of your data at any time.
âś… ICO registered: We're registered with the Information Commissioner's Office (ZC013423).
No. CaseFlow is a decision-support tool. It helps you draft responses and understand legal arguments, but it's not a substitute for qualified legal advice. Every output should be reviewed by someone who understands the specific case before it's used.
We make this clear throughout the platform - you'll see reminders when you first log in, on every page that uses AI, and alongside every generated response.
đź“„ Your documents stay on your device - we only see the text, never the file (scanned PDFs are the one narrow exception, and are deleted within 24 hours).
🛡️ Personal details are filtered out of the text before the analysis AI sees it, and again before anything is saved to our database. There is one step in front of that: for a scanned page or photo, a reading AI sees the raw page in order to type it out, transcription only under no-training terms. The analysis AI only ever works on masked text.
🤖 We use Google's Gemini 3 Pro - a leading, enterprise-grade AI model.
đźš« No training on your data - CaseFlow does not train models on your data, and our platform provider's agreements prohibit the AI model providers from doing so.
🏢 Your data is completely separate from every other company on the platform.
đź”’ 3-layer protection against made-up case law - prompt rules, citation validator, and text-body scrubber all run automatically.
⚖️ We're GDPR compliant and registered with the ICO.
⚠️ It's a tool, not a lawyer - every output needs human review.
Behind the scenes, your digital PDFs stay in your browser and are never uploaded to our servers. Before any extracted text reaches the analysis AI, we mask common personal details (emails, phone numbers, registration plates, and more) so the model works on cleaned‑up text, not raw data. The one step in front of that is reading a scanned page or photo: a reading AI sees the raw page in order to transcribe it, under no-training terms, and the text it returns is masked before analysis. Because masking relies on the surrounding text, errors introduced when a scan is read can stop an identifier being recognised that would be caught in a typed document. Engineer reports and dashcam footage are also read by the AI as files, before masking. Postcodes are deliberately kept because they matter to locality arguments, and an output check stops the AI inventing a postcode that was not in your original text. CaseFlow does not train models on your data, and our platform provider's agreements prohibit the AI model providers from using it for training.
CaseFlow Automation Ltd is designed to minimise the personal data that ever reaches the AI model, while still giving you high‑quality legal drafts.
When you upload a typed, text-based PDF, it is processed directly in your browser on every upload surface. The original document is not uploaded to our servers; only extracted text is sent securely for analysis, and that text passes through the masking gateway before any analysis call.
Scanned PDFs and photographs work differently. There is no text inside them for the browser to read, so the page itself has to be read by the AI first. Depending on the tool, the file is either sent to a private temporary store so it can be OCR'd and then deleted immediately afterwards (with a safety-net purge of anything older than 24 hours), or held in memory for the length of a single request and never stored at all. Either way the AI reads it under no-training terms, and the personal identifiers we can detect are masked in the returned text before any analysis call.
The Loss-of-Use Chronology tool stores nothing at all: documents are processed in memory only, with no row written to any table and no file written to any bucket.
Before any text is sent to the AI model, it passes through our server‑side PII masking gateway. This gateway attempts to detect and replace common identifiers with neutral placeholders, so the model sees the structure of the case but not the underlying personal details.
The same masking is applied again at the database level via triggers, so the saved history of correspondence, replies, advice and letters contains placeholders rather than raw identifiers. If our database were ever accessed without authorisation, the personal details would already be redacted.
Our gateway uses pattern‑based rules tuned for UK claims data. It attempts to detect and replace items such as:
UK postcodes are deliberately preserved. Postcodes are material to basic-hire-rate and locality arguments, so they reach the model by design. A separate output-side scrubber then removes any postcode the AI introduces that was not present in the original input.
Each masked item is replaced with a generic placeholder (for example, [EMAIL_REDACTED] or [VRM_REDACTED]), so you can still understand the draft, but the AI model does not see the raw identifier.
The masking gateway is a mandatory step for all AI‑related features (such as analysing correspondence, generating replies, and case advice). All extracted text that reaches the model for analysis passes through the gateway, including text produced by OCR of a scanned page. Coverage is enforced by an automated test in continuous integration: every function that calls the AI must apply masking, and any exception must be named in that test with a written reason. The named exceptions are scanned pages, engineer report PDFs and dashcam media, which the AI reads as files before there is any text to mask. Because masking relies on the surrounding text, errors introduced when a scan is read can stop an identifier being recognised that would be caught in a typed document.
Every call records how many items were masked and which categories (e.g. "3 items redacted: email, VRM, reference"), but we never log the original values.
This supports GDPR principles of data minimisation, privacy by design, and accountability, and gives you an audit trail for your own DPIA and compliance checks.
We understand that "trust us, it's local" isn't enough - especially when dealing with client data. Here's a plain-English explanation of why this is verifiable, and what to tell a sceptical client or IT team.
PDF processing is performed using a standard browser technology called PDF.js, which is the same open-source library used by Firefox to display PDFs natively. It runs entirely within the browser tab - no server connection is made during this step. This is not a policy choice; it is how the technology is architected.
Any IT professional can confirm this using their browser's built-in traffic monitor. If they watch the network traffic while a PDF is uploaded, they will see:
🔍 In plain terms: Your typed PDF document never travels across the internet. The words inside it do - but only after personal details have been replaced with placeholders like [NAME_REDACTED]. The document itself stays on your computer at all times.
âś… The AI works on masked text, not raw personal identifiers.
âś… Typed PDFs stay on your device on every upload surface. There is one exception. Scanned PDFs and photos are sent to be read by the AI, transcription only, then masked, and either deleted straight after OCR or never stored at all.
âś… The Loss-of-Use Chronology tool stores nothing at all, in memory only for the length of the request.
âś… Saved history is masked at rest in the database, not just in transit to the AI.
âś… We do not use your data to train AI models, and we design our architecture to send as little personal data as possible to the external model.
Our PII masking gateway acts as an automated safety net - users are not required to manually redact documents before upload. The system is designed to handle data hygiene on their behalf as a mandatory, always‑on processing step.
CreditHire Assist is a cloud‑hosted, AI‑assisted drafting tool for credit hire teams. It helps professionals analyse insurer correspondence, draft responses, and receive strategic case guidance - faster and with greater confidence.
đź“„ Typed PDFs stay on your device, we only receive extracted text. Scanned PDFs and photos are sent to the AI to be read first, then masked.
🛡️ Personal details are masked in all text before the analysis AI sees it (strong first layer, not a perfect filter); the one exception is the OCR reading step for scans, transcription only under no-training terms.
🗑️ Case data is deleted on session close, with a continuous purge so nothing is retained beyond 24 hours.
đź’ľ Uploaded files are never included in backups.
đźš« We do not use your data to train AI models.
🏢 Your data is completely isolated from every other company.
⚖️ We are UK GDPR aligned and registered with the ICO (ZC013423).
⚠️ AI is a decision‑support tool - every output requires human review.
Special category data: The Service is not intended for special-category data and users are asked not to submit it. We recognise that in credit hire work, health, injury or vulnerability information can incidentally appear in free-text correspondence. Where it does, the same safeguards apply (masking, data minimisation, encryption and immediate deletion), and as data controller the customer remains responsible for the Article 9 lawful basis.
This page is a summary. Full details are set out in:
Questions? Contact us at info@caseflowautomation.co.uk.
Got questions? If anything in this guide isn't clear, or you'd like more detail on any point, get in touch at info@caseflowautomation.co.uk.
For the full technical details, see our Trust & Security Pack and the PII Masking Architecture Summary.