Security & Privacy

Counsel is built and operated by Castopia Inc. This page describes the safeguards that are in place in the product today.

We have not completed a third-party certification such as SOC 2 or HITRUST. If your organization needs a security questionnaire answered, contact us and we will answer it directly.

• Encrypted in transit. Every connection to the app and API uses HTTPS (TLS). Browsers are instructed to never connect over plain HTTP.
• Private file storage. Photos, signed forms, and documents are stored in private Cloudflare R2 storage, filed under your organization. Files are never public: each view uses a signed link that expires after 15 minutes by default and never lasts more than an hour.
• Encrypted at rest. Records live in a PostgreSQL database hosted by PlanetScale, and files in Cloudflare R2. Both providers encrypt stored data at rest.
• Integration secrets. Tokens for third-party integrations you connect are additionally encrypted by our application (AES-256-GCM) before they are stored.

• Dedicated sign-in provider. Sign-in is handled by Clerk, a specialist authentication provider, using one-time codes sent to the user’s email address or Sign in with Apple or Google. We never store user passwords.
• Separated by organization. Every request is checked against the user’s active membership in that specific business, so one business’s records are never served to another.
• Role-based permissions. Each team member has one of five roles — Owner, Admin, Manager, Staff, or Read-only. Business-wide financial reports are visible to the owner only.
• Minimum necessary. Staff-level accounts don’t receive date of birth, home address, or Social Security numbers in client records; read-only accounts also don’t receive contact or financial details.
• Privacy lock on shared devices. An optional 4-digit lock on the mobile app lets your team hand a device to a client to fill in forms without exposing other records.

• Every change is logged. Each change your team makes is recorded with who made it, what changed, when, and from which IP address and device.
• Visible to you. Owners and admins can review the full history in the Activity log.
• Kept for seven years. Audit records are retained for seven years by default.

Your records belong to your business. The account owner can request a full export of the business’s data, or deletion of the account and its data, by emailing support@castopia.com. We verify the request comes from the owner before acting on it.

Clients and patients who want to see, correct, or delete their information should contact the business that holds their record; we help that business fulfill the request.

After deletion, limited copies may remain in encrypted backups until they are overwritten on the normal backup cycle.

Privacy choices

AI features run only when someone on your team uses them. The information needed for that request is sent to our AI provider to produce a draft or suggestion, which a person must review before it is relied on, signed, or sent.

We do not sell your data or your clients’ data, and we do not use it for advertising.

We rely on established infrastructure providers. Depending on the features you turn on, these may process data on our behalf:

• Vercel — application hosting and AI request routing
• PlanetScale — PostgreSQL database
• Cloudflare — file storage (R2)
• Clerk — sign-in and account security
• Anthropic — AI features you choose to use
• Stripe and Square — card payments you choose to accept
• Resend and Twilio — email and text reminders you send
• Expo — mobile app delivery and push notifications
• PostHog — product usage analytics

If you believe you have found a security vulnerability, or think your account has been accessed without permission, email us right away. Please don’t include patient information in the email.

support@castopia.com