Security principles
Tenant isolation
Authenticated organization membership and database row-level policies restrict records to the correct firm.
Private-by-default files
Evidence and matter documents use private storage paths and authorized, time-bound delivery.
Least-privilege access
Privileged server credentials remain server-side, while user requests operate through scoped authorization checks.
Human-controlled outcomes
AI can organize facts and surface gaps, but attorneys control conflicts, case qualification, outreach, and representation.
Application and data controls
- Authentication: confirmed email sign-up, protected sessions, and support for time-based one-time-password multi-factor authentication.
- Authorization: organization membership and role checks are enforced in the application and database, including sensitive administrative actions.
- Database security: row-level security policies constrain authenticated access, while elevated service access is reserved for narrowly scoped server workflows.
- File security: private object storage, validated file types and sizes, controlled paths, and authorized download routes reduce unintended exposure.
- Transport and browser protection: HTTPS, restrictive security headers, content-security policy, clickjacking protection, and content-type protections are applied to production responses.
- Auditability: important assignments, reviews, document actions, engagement events, and workflow changes retain operational history.
- Secret handling: sensitive provider keys and privileged database credentials are kept on the server and outside public browser bundles.
AI and sensitive information
AI features are invoked for specific user-requested tasks and receive the relevant content needed to produce a response. ClaimVela preserves a human decision boundary: AI output is assistance, not verified fact, legal advice, medical advice, or an automated representation decision. Firms must review generated content before acting on it.
Infrastructure and providers
ClaimVela relies on established infrastructure providers, including Vercel for application hosting, Supabase for authentication, database, and storage, OpenAI for requested AI features, and Paddle for billing. Optional communication features may use Resend or Twilio. Access to provider systems is limited to operational need.
Shared responsibility
Customer firms are responsible for:
- using unique credentials and enabling available multi-factor authentication;
- granting the minimum role needed and promptly removing former users;
- securing devices, browsers, networks, and exported data;
- verifying portal recipients before sending sensitive links;
- maintaining lawful authority and professional safeguards for uploaded content; and
- reviewing AI output and maintaining independent deadline, conflict, and legal controls.
Current assurance scope
ClaimVela does not currently claim SOC 2 certification, HIPAA compliance, or coverage under a business associate agreement. Do not use the Service for protected health information that requires a business associate agreement unless the parties separately execute one. Security and compliance requirements should be evaluated by each firm before onboarding regulated or contractually restricted data.
Report a security concern
If you believe your account or ClaimVela data may be at risk, stop sharing the affected credentials or links and contact ClaimVela through the support channel in your account, order confirmation, or written agreement. Include a concise description, affected area, timing, and safe reproduction details. Do not include unnecessary client data.
Our handling of personal information is described in the Privacy Policy.