What we have built, and what we have not done yet.

Where CaseFlyte is today

CaseFlyte is in a synthetic-data beta. Every patient, case and document in it is invented. The beta is configured to refuse real patient information, and it will not start if that setting is changed.

We do not claim HIPAA compliance. Compliance is an organizational program — executed business associate agreements, a documented risk analysis, workforce training and incident response — and it is not something software can declare on its own.

What the software does

• Each organization sees only its own work. Isolation is enforced by the database itself, with row-level security forced on every tenant table. Each release is checked for it before it is accepted.
• Access is decided in one place. Every permission in the product comes from a single authorization model, not from checks scattered across screens.
• Nothing is shared by default. A document stays with the practice that filed it until someone shares it, and sharing is its own recorded step.
• Access leaves a trail. Reading case information and every security event are recorded, and the application cannot rewrite its own audit history.
• Encryption. Connections to CaseFlyte use TLS. Stored data and files are encrypted at rest with managed keys, and authenticator secrets are encrypted again inside the application.
• Sign-in protection. Two-step sign-in with an authenticator app is available, recovery codes are stored only as hashes, and repeated failed attempts are limited.
• No patient information to AI providers. CaseFlyte’s case summaries are composed from the case’s own records, and every statement links to its source.

What has not been done yet

An independent penetration test, a SOC 2 examination and business associate agreements have not been completed. Real patient information stays blocked until the work it depends on is finished and signed off.

Questions from your security team

We are glad to walk through the architecture in detail. Request a conversation.