Security

• All traffic to and from KASII uses encrypted connections (HTTPS), and browsers are told never to connect without it.
• Case details, the text read from documents, and spreadsheet rows are encrypted by KASII before they are stored. Each firm's connected-system passwords and keys are encrypted under a separate key.
• Chat, text, and email history, case summaries, and drafts of outgoing messages are stored without KASII's own encryption today. KASII can encrypt them, and we are switching that on. Contact details, file names, and the knowledge base stay unencrypted by KASII, because search and matching need to read them.

• Only that firm's staff. Every request is checked against the person's membership in the firm, and a case belongs to exactly one firm.
• Each person has a role (owner, admin, or case manager), and the server enforces what each role can do.
• Removing someone from a firm signs them out everywhere at once.
• Staff sign in with a one-time code sent by email, or with a Google or Microsoft work account where the firm turns that on. An owner can require Google or Microsoft sign-in, so the firm's own second-step check applies, and can set how soon idle staff are signed out. KASII has no second sign-in step of its own yet.
• A client sees only their own case, in the browser where they opened their invitation. Invitation links expire after 7 days, and staff can sign a client out.
• Changes to members, roles, and sign-in settings, and deletions, are recorded in a security log the firm's owner can read.

In the United States, with the companies on our privacy page: MongoDB Atlas for the database, Cloudflare for files, Vercel to run the app. That page lists every company that receives data and what each one gets, including the services a firm connects itself.

A firm decides how long a closed case is kept. Open cases are never deleted on a timer, a case can be put on hold, and the owner is told 30 days before a case is deleted. A firm can delete a case, a document, or a contact itself, and export a case or the whole firm.

• KASII sends messages, case details, and the text and images of documents to AI models (Anthropic's Claude, and OpenAI for search) through the Vercel AI Gateway.
• Social Security numbers, payment card numbers, and bank account numbers are removed from text before it is sent. Photos and scanned pages are sent as they are.
• Every request asks the provider not to keep what it is sent.
• We don't use firm or client data to train AI models.

KASII is not set up as a HIPAA service. A firm must not use it for health information it holds as a HIPAA business associate, or for Controlled Unclassified Information (CUI).

If you think you have found a security problem, email privacy@kasii.ai with what you found and how to see it. Please don't access data that isn't yours or disrupt the service while testing. Our security.txt has the same address.