CV
CaseNote Vault™

Data Security

How we protect your data and your clients' information · Updated June 2026

CaseNote Vault is designed to handle sensitive youth-services documentation responsibly. This page describes application controls we can substantiate in CaseNote Vault and separates them from infrastructure, contractual, and regulatory assurances that must be confirmed before an agency uses the platform for regulated production data.

Transport & Storage Security

  • CaseNote Vault requires authenticated application access for agency workspaces
  • Tenant-scoped application rules restrict records to the active organization
  • Encryption-at-rest, backup encryption, key management, and exact TLS guarantees depend on the hosting platform and must be confirmed contractually before regulated production use

Role-Based Access Controls

  • Organization Owner — full administrative access
  • Program Admin — program management and reporting
  • Supervisor — approvals, team visibility, compliance
  • Staff — assigned participant records only
  • Auditor — read-only access for reviews

Infrastructure & Isolation

  • Each organization's data is logically isolated
  • Application data access is tenant-scoped and protected by organization-aware authorization controls
  • Hosting certifications, backup guarantees, recovery objectives, and geographic redundancy are infrastructure-provider assurances and are not represented here as CaseNote Vault certifications

Audit Logging

  • Key documentation workflow events are recorded with user identity and timestamps
  • Case-note, weekly-report, incident, participant-lifecycle, approval, goal, and selected export actions have application audit coverage
  • Audit coverage is workflow-specific; this page does not claim that every read, login, or infrastructure event is captured
  • Audit records support accountability but are not represented as independently certified tamper-proof logs

Authentication & Sessions

  • Secure session management with automatic expiration
  • Authentication is provided through the platform authentication service
  • CaseNote Vault applies role and tenant authorization after authentication
  • Password, token, lockout, and recovery guarantees are governed by the authentication provider and should be confirmed for an agency’s requirements

Incident Response

  • Security concerns can be reported to security@casenotevault.com
  • Confirmed incidents will be investigated and handled according to applicable contractual and legal obligations
  • No fixed breach-notification deadline or HIPAA incident-response certification is promised on this public page
  • Agencies requiring specific notification terms should establish them in a signed agreement before regulated production use

SOC 2 Alignment

CaseNote Vault uses security practices that are informed by common security principles. CaseNote Vault has not represented itself here as having completed an independent SOC 2 audit or holding a SOC 2 certification. Any infrastructure-provider certifications are separate from CaseNote Vault itself.

Security

System protected against unauthorized access

Availability

System available for operation and use as committed

Confidentiality

Information designated as confidential is protected

Processing Integrity

System processing is complete, valid, and accurate

Privacy

Personal information collected and used per policy

Regular Security Reviews

CaseNote Vault's engineering process includes automated production gates and targeted review of sensitive workflows. These are internal controls, not a substitute for an independent security assessment:

  • Periodic internal security assessments and code reviews
  • Automated build, authorization/security-gate, AI-kernel, and performance verification
  • Review of tenant isolation, role authorization, and sensitive workflow permissions
  • Retry, stale-write, and audit-integrity hardening for critical documentation workflows
  • Additional independent or customer-required assessments should be completed before regulated production deployment when applicable

Security Vulnerability Reporting

If you discover a potential security vulnerability in CaseNote Vault, please report it responsibly to security@casenotevault.com. We will acknowledge reports within 48 hours and work to address confirmed vulnerabilities promptly. We do not take legal action against good-faith security researchers.

Security Contact

Back to HomePrivacy PolicyTerms of ServiceBusiness Associate Agreement