CaseSolo Trust Center (RFP Pack)

> Status: living document. Every claim below carries a date and an owner. > Anything without both is a roadmap item, not a claim. Last reviewed: > 2026-09-12 (engineering).

What ships today

• Authentication: JWT sessions, password policy, MFA, IP allow-listing,

session tracking, login audit. Owner: engineering. Verified: 2026-09-12.

• Authorization: firm-scoped tenancy (firmId in session, proxy

cross-check); 7 firm-wide roles; per-route ownership checks. Owner: engineering. Verified: 2026-09-12.

• Audit trail: Activity rows with read/export API. Mutable store — see

roadmap for the tamper-evident ledger. Owner: engineering. Verified: 2026-09-12.

• Backups: Postgres backup runbook with a locally executed dump drill

(2026-09-12). In-app backup proof: admin Settings card reads live backup-job receipts, never a static claim (2026-09-12). Production restore drill: roadmap. Owner: engineering.

• Uptime visibility: public /api/health/deep reports per-component state

including cache degradation. Owner: engineering. Verified: 2026-09-12.

• Marketing honesty: no SOC 2, rating, or outcome claims on public pages

(swept 2026-09-12).

What we do NOT claim

• No SOC 2 Type I/II. No pen-test cadence yet. No DPA/BAA template pack

yet. No public status page yet. No SSO/SCIM yet (IdP config records exist; no live handshake). Say so on every RFP — do not imply otherwise.

Roadmap (dates + owners required before any customer commitment)

| Item | Target | Owner | Status | |---|---|---|---| | Tamper-evident audit ledger | uncommitted | unassigned | roadmap | | SSO (SAML/OIDC) live handshake | uncommitted | unassigned | roadmap | | SCIM lifecycle | uncommitted | unassigned | roadmap | | DPA/BAA templates | uncommitted | unassigned | roadmap | | Pen-test cadence | uncommitted | unassigned | roadmap | | Public status page | uncommitted | unassigned | roadmap |

Questionnaire answers

• Data location: customer Postgres + S3-compatible storage (see deployment

docs for topology). Region pinning: roadmap.

• Encryption: TLS in transit; at-rest per provider defaults. CMK: roadmap.
• Subprocessors: none beyond the customer's own Postgres/storage/email

providers. Confirm per-deal before signing.

• Incident contact: see /.well-known/security.txt.