CaseLight Security Overview
CaseLight Office 1.0 (build 31) for Windows | October 2026
CaseLight is a desktop case-management application for investigators. It runs on the customer's own computer or external drive. Case files, subject profiles, notes, timelines and evidence are stored there, encrypted, and are never uploaded to CaseLight or to any cloud service. CaseLight does not host, see or process customer case data.
CaseLight never sends case data over the internet. The only things it sends online are a small license check and, when the licensed person changes, a request to approve that change. Both are described in section 1, and neither contains case data.
This overview describes what CaseLight protects, what it leaves to the customer's own environment, and why a local-first design changes the security questions a buyer needs to ask.
1. Where your data lives, and what leaves the computer
| Information | Where it goes |
|---|---|
| Cases, subjects, notes, timelines, reports | Stay on the computer or external drive you choose. Never sent to CaseLight. |
| Evidence files and their fingerprints | Stay on that same computer or drive, stored encrypted. Never sent to CaseLight. |
| Account passwords | Stored on the device only as salted, one-way hashes. Passwords cannot be read back by CaseLight or by anyone else. |
| License check | When the computer is online, CaseLight confirms the license with our licensing provider (Keygen). The request carries the license key, a fingerprint of the computer, and a random per-session identifier. It carries no case data, evidence, file names or personal information. |
| Changing the licensed person | Each license is for one person and allows four changes of that person in any twelve months. When an administrator hands the license to someone else, CaseLight asks CaseLight's license service to approve the change. The request carries the license id and key, the computer's fingerprint and a short reason. It carries no names, no email addresses and no case data. This one step needs an internet connection; everything else works offline. |
| Payment | Handled entirely by Stripe. CaseLight never sees or stores card numbers. |
| Usage analytics and updates | None. CaseLight sends no usage analytics and does not install updates on its own. Customers choose when to install a new version. |
| Artificial intelligence | CaseLight sends nothing to any AI service and has no feature that processes case data with an outside AI system. |
| Optional Sandbox Browser | When an investigator chooses to capture web content, the Sandbox Browser connects to the sites that investigator visits, as any browser does. Content flows in from those sites; no case data is sent to them. It runs in its own window with sandboxing and context isolation turned on. |
Working offline: after activation CaseLight works without an internet connection. It re-checks the license periodically when online, allows 14 days without a successful check, and then switches to read-only until the next successful check. Existing data stays on the customer's drive.
2. Who is responsible for what
| Security area | Built into CaseLight | Customer's environment |
|---|---|---|
| Stored data | Case databases are encrypted with SQLCipher. Each evidence file is encrypted separately with AES-256-GCM. The key is bound to the signed-in Windows account; on a portable drive it is protected by the drive's password. | Full-disk encryption (for example BitLocker) is recommended as an additional layer on laptops. Customer controls physical custody of the computer, drive and backups. |
| Data in transit | Case data is not transmitted. The application and its server talk only inside the computer itself (the 127.0.0.1 loopback address). | The customer decides how backups and exports are moved or shared. |
| Access control | Password sign-in, lockout after 5 wrong attempts for 15 minutes, automatic screen lock after inactivity (3 minutes to 1 hour, or never, set by the administrator), administrator and officer roles, an exclusive editing lock on each case, and one licensed person per license. | Windows account security, device lock and screen-lock policy, and who is given administrator rights. |
| Evidence integrity | A SHA-256 fingerprint is recorded when a file is added. The file is checked again when read, exported or backed up, and a file that no longer matches is refused and reported. Activity is recorded in an append-only log whose entries are chained together with SHA-256 hashes. | Physical custody of the device and any removable media. |
| Software authenticity | The installer is digitally signed by CaseLight Systems, Inc. (certificate issued by SSL.com, time-stamped). The SHA-256 fingerprint of every release is published on the download page. | Confirm the publisher name when the installer runs, and compare the download's fingerprint with the published one. |
| Code and component security | Components are checked for known vulnerabilities before each release and monitored continuously, and the code is scanned automatically with static analysis (section 3). | Install new versions promptly; installing over the top keeps data and the license. |
3. Security features in detail
Protecting stored data
- Encrypted databases. Case, user, timeline, task and agency data are kept in SQLCipher-encrypted databases.
- Encrypted evidence. Every evidence file, preview and thumbnail is stored encrypted with AES-256-GCM, using a separate key for each file. Each 64 KB block is authenticated, so a file that has been altered, truncated, reordered or partly deleted fails to open.
- Encrypted backups. Case backups hold the evidence in encrypted form and are verified before they are relied on. A restore is refused if the backup is damaged.
- Portable drives. On a CaseLight drive the keys are protected by the drive password, so the drive is unreadable if it is lost or taken to another computer without that password.
Controlling access
- Strong password storage. Passwords are salted and hashed with Argon2id, with an additional secret value kept separately. They cannot be recovered, only reset.
- Brute-force protection. Five wrong passwords lock the account for 15 minutes. The same limit applies to recovery codes.
- Recovery without a back door. The first administrator receives a one-time recovery code. Only a hash of it is stored, and using it issues a new code.
- Role separation. Investigators see only the cases assigned to them. Administrator-only functions refuse ordinary accounts, and the last administrator cannot be removed.
- Privacy screen. After the chosen idle time the screen goes blank, with nothing from the open case visible, until the password is entered again.
- One licensed person per license. Each individual needs their own license. A one-person license cannot have a second account added. Handing it to a different person (a new email, a different name, or removing an account) is limited to four changes in any twelve months and must be approved by CaseLight's license service. The count is kept with the license at the license provider, so reinstalling or wiping the computer cannot reset it. Further changes need CaseLight's approval.
- Account activity is recorded. Creating, changing and deleting accounts is written to the activity log, and a hand-over to a different person is marked as such.
- One editor at a time. A case is opened with an exclusive editing lock, so two people cannot overwrite each other's work.
Showing that evidence has not changed
- Fingerprint at intake. A SHA-256 fingerprint is calculated when a file enters a case.
- Checked on use. The stored file is checked against that fingerprint when it is read, and again when it is exported. An export is re-hashed at its destination, so a bad copy is caught before success is reported.
- Tamper-evident activity log. Actions on a case are written to an append-only log: the database itself refuses edits and deletions. Each entry is also chained to the one before it with a SHA-256 hash, so an entry that is changed, removed or planted outside CaseLight stops the chain from checking out. The exported Court Discovery Log states whether the chain verified and prints its current head hash, so a filed copy can be compared with the live log later.
Keeping the application itself contained
- Local only. The application's server listens only on the computer itself. It rejects requests addressed to any other host name, which blocks attacks that try to reach it from a web page.
- Sign-in required. Reading or writing case data requires a signed-in session.
- Hostile files. Oversized or malformed images, archives, PDFs, Word files and videos were tested and did not crash or compromise the application. File names crafted to escape the data folder stayed inside it.
- Crash safety. Forcibly stopping the application in the middle of an upload or write lost no data in testing.
- Controlled exports. Exports and backups go to external drives chosen by the investigator.
- Sandboxed browsing. The optional Sandbox Browser runs with its own isolation and a separate profile.
- Safe previews of web pages. An HTML file kept as evidence is shown as a picture of the page, drawn by CaseLight's built-in browser engine in a locked-down mode: scripts are off, every network request and every other file is refused, nothing is saved, and no windows can open. The original file is stored unchanged, byte for byte. In testing, a deliberately hostile page (scripts, remote images, frames, redirects, an attempt to read a local file) made no outside connections and could not show another file's contents.
- Documents are never run. Evidence is stored as inert files and is never executed. Office files that can carry macros are not opened by any converter.
Software integrity
- Signed installer. Every release is signed by CaseLight Systems, Inc. and time-stamped, so Windows shows the publisher and warns if the file has been changed.
- Checked components. The third-party components in CaseLight are checked for known vulnerabilities by a scripted pre-release check on both the application and the server. GitHub Dependabot then watches both for newly published problems. A finding with no available fix in a build-only tool is reviewed before a release is made, not ignored.
- Automated code scanning. Semgrep static analysis runs on both code bases whenever changes are merged and weekly, and findings are resolved or documented with a reason.
- Verify your download. The SHA-256 fingerprint of each release is published on the download page. Comparing it with your downloaded file confirms it is exactly the file that was released.
- Tested on every release. Each build is tested for encryption, upgrades from earlier builds with a case inside, backups and restores, drives, hostile files, one-running-copy enforcement and large evidence files before it ships.
- No silent updates. CaseLight never downloads or installs itself. The customer decides when to install a new version, and installing over the top keeps existing data and the license.
4. How local-first compares with a cloud or AI-based records system
| Question | Typical cloud or AI-based system | CaseLight |
|---|---|---|
| Who holds the case data? | The vendor, in its cloud. | The customer, on their own computer or drive. |
| Can vendor staff see it? | Possible, governed by vendor policy. | No. The vendor holds no copy. |
| What does a vendor breach expose? | Every customer's cases at once. | No case data. The vendor holds only license and billing records. |
| Is case data used by AI systems? | Often passed to AI providers or models. | No. Nothing is sent to any AI service. |
| Shared infrastructure risk | Multi-tenant servers and databases. | None. There is no shared service. |
| Where is the data physically? | Vendor data centers, sometimes in several regions. | Wherever the customer keeps the computer or drive. |
| Internet needed to work? | Yes, continuously. | No. Only a periodic license check (with a 14-day allowance) and, when the licensed person changes, an approval request. |
| If the vendor disappears | Access to the data depends on the vendor. | The data is already on the customer's drive. |
5. Security questionnaires
Most vendor security questionnaires are written for hosted services: data centers, tenant isolation, vendor administrators, cloud sub-processors and breach notification. Because CaseLight holds no customer case data, many of those questions do not apply. We still answer questionnaires, and the points below are the ones that usually decide the review.
| Typical question | CaseLight answer |
|---|---|
| Does the vendor host or process our data? | No. Case data stays on the customer's device. |
| Who are the sub-processors? | Keygen (license validation: license key and computer fingerprint only), Stripe (payments), Cloudflare (hosts the installer download), and our website and email providers for order fulfillment. None receives case data. |
| SOC 2, ISO 27001 or other hosting certifications? | CaseLight is not independently certified. These certifications cover hosted services, and CaseLight does not host customer data. |
| Penetration testing? | Adversarial testing was completed before release (authentication, access control, tampering, hostile files, crash recovery and concurrency), and its findings were addressed. An independent third-party penetration test or code audit has not yet been performed. |
| Data retention and deletion? | The customer controls it. Deleting a case removes its files from the drive. The activity log keeps its entries, by design, so there is a record of what happened. Backups the customer made stay where the customer put them. |
| Breach notification? | There is no vendor-held case data to breach. If license or billing records were ever affected, affected customers would be told. |
| Multi-factor authentication or single sign-on? | Not currently offered. CaseLight signs in with a password on the customer's own computer, so there is no cloud account to attack. The computer itself is protected by the customer's Windows sign-in and policies (which can use Windows Hello, smart cards or security keys) and by CaseLight's automatic screen lock. |
| How many people can use one license? | One. The license is for one named person. Each individual needs their own license. The person can be changed up to four times in any twelve months (for example for staff turnover); further changes need CaseLight's approval. |
| Is the activity log tamper-proof? | It is append-only and tamper-evident. Entries are chained with SHA-256 hashes, and any edit, deletion or planted entry outside CaseLight breaks the chain. Someone who holds the database key could in principle rebuild a whole chain, which is why each export prints the chain's head hash for later comparison. |
| How is the software's own code kept secure? | Automated static analysis (Semgrep) and continuous dependency monitoring (GitHub Dependabot) cover both the application and the server, a scripted vulnerability check runs before every release, and each release is tested for encryption, upgrades, backups, hostile files and crash recovery. |
| Could evidence files carry malware or scripts? | Evidence is stored as inert files and never run. HTML pages are previewed in a locked-down renderer with scripts and all network and file access refused, and macro-capable Office files are not opened by any converter. |
| Where do we report a vulnerability? | info@getcaselight.com |
Items a customer's IT team will usually want to confirm on their side:
- Full-disk encryption (for example BitLocker) is turned on for laptops.
- Windows accounts are protected by a password or Windows Hello and an automatic screen lock.
- Backups are made to encrypted or access-controlled drives, and the drives are stored securely.
- Windows and security software are kept up to date.
6. Frequently asked questions
Where is my evidence stored or hosted?
On the computer or external drive you choose, and nowhere else. CaseLight does not receive or store case data.
How does CaseLight protect data on a lost or stolen device?
Databases and every evidence file are encrypted. The keys are bound to the Windows account, or to the drive password on a portable drive. Access then requires a CaseLight password, with lockout after repeated failures. Full-disk encryption adds another layer.
Does CaseLight need an internet connection to handle cases?
No. Case data never goes online. The only internet traffic is a periodic license check and, when the licensed person changes, an approval request. Neither carries case data. CaseLight checks the license when it can and allows 14 days without a successful check before it goes read-only. Handling cases, reading evidence and building reports all work offline.
How does CaseLight support chain-of-custody?
A SHA-256 fingerprint is recorded when evidence is added and checked again when the file is read or exported. A change to a stored file is detected and refused. A per-case activity log records actions. Whether evidence is admitted is decided by the court; CaseLight provides the integrity record.
Can one license be shared between people?
No. Each individual needs their own license. A license is for one person, and that person can be changed up to four times in any twelve months, for example for staff turnover. Extra accounts cannot be added to a one-person license.
What happens if my subscription ends or I cancel?
After a short grace period CaseLight becomes read-only. You can still open cases, view evidence and export everything, but you cannot add or change anything. Renewing restores full use. Your data stays on your own drive throughout.
Is CaseLight certified to cloud security standards?
No. Those standards are written for hosted services, and CaseLight is not a hosted service. Customers' own IT policies govern the computer it runs on.
Questions: info@getcaselight.com