How we handle your case files.
Case files hold medical records and private details. Here is who can see them, where they're kept, which services read them, and what we don't have yet.
Who can see a case?
Only your firm. Every member of your firm can see its cases, and no one outside it can. Cases are never shared outside the firm.
Roles decide who can change what. Read-only members can look but can't change anything, and only attorneys approve plans and letters. People join your firm only by an invitation from its Owner or an Admin.
There is no self sign-up. We approve every firm after a call.
How do people sign in?
With a passkey, or a one-time code sent to their email. There are no passwords to steal or reuse.
A session ends after 30 minutes without activity, and after 12 hours in any case.
Where are the files kept?
In a private Amazon S3 bucket in the United States (Ohio), encrypted at rest. Files travel only over encrypted connections.
A file is downloaded only through a signed-in request from someone with access to its case. There are no public links to your files.
Which services see case data?
Two AI providers do the reading, writing and checking, and a third turns speech into text. Amazon stores the files.
- Google Gemini
Reads the pages, finds the facts, builds the plan and writes the letter.
Receives: Page images and text, the facts, client details, and your firm's sample letters.
- Anthropic Claude
Checks that uploaded files belong to the case, checks the facts, the plan and the letter, prices future care with a web search, and answers questions in Ask Whitegate.
Receives: The first pages of each uploaded file, the facts, the plan and the letter. For Ask Whitegate, the question and the parts of the case it looks up. A new case's description when one is started from a chat. The price search gets only the name of the care item.
- OpenAI
Turns speech into text when someone uses the microphone instead of typing.
Receives: The recording, or the speech as it's spoken. Nothing else.
- Amazon Web Services
Stores the files, in one private bucket in Ohio.
Receives: Everything you upload, and the documents Whitegate produces.
We don't train AI on your files, and our AI providers don't either.
The emails we send, such as sign-in codes and notices, don't carry case documents.
What runs in the browser?
Only Whitegate's own code. The app's content security policy blocks third-party scripts, outside fonts and analytics.
When you open a source, the quoted lines are found on the page image inside your browser, with software served from our own servers.
Is there a record of what happened?
Yes. Important actions are written to an append-only audit log, kept for six years.
What we don't have yet
We would rather you hear it from us.
- A SOC 2 report.
- A penetration test by an outside firm.
- Business associate agreements (BAAs).
- Malware scanning of uploaded files.
- A screen where your firm can read its own audit log.
Until your firm has signed our data processing agreement, demos and pilots run on sample or de-identified files.
Questions
Send security questions to support@whitegate.ai, or request access and ask on the call.