Privacy Policy
Last updated: September 15, 2026
Operator: CaseRail Technologies Inc.
Contact: privacy@caserail.app
1. Roles Under Privacy Law
- Tenants are data controllers.
- CaseRail is a data processor acting solely on Tenant instructions.
2. Categories of Data Processed
Depending on how a Tenant configures the platform, CaseRail may process:
- Account data (name, email, hashed password)
- Government-issued identifiers (driver’s license, health card numbers)
- Demographic and health-adjacent data
- Financial identifiers appearing in uploaded documents
- National ID numbers (e.g., SIN)
- Law-enforcement/bylaw enforcement data
- Location data
- Uploaded files
- Tenant-defined custom fields
- Audit logs
3. Data Residency
CaseRail stores data in regions selected by the Tenant, where a supported region option is enabled for that Tenant’s deployment. CaseRail does not guarantee residency unless contractually agreed.
4. Subprocessors
CaseRail uses vetted subprocessors listed at /legal/subprocessors. Some integrations (maps, OCR, e-signature) are Tenant-configurable, so the applicable subprocessors can vary by Tenant.
5. Security Measures
CaseRail implements the following security measures:
- Tenant data isolation
- Separation of public-facing and internal data stores for portal-exposed record types
- Role-based access control and audit logs
- Automated malware scanning of uploaded files where a scanning provider is configured for the deployment
Field-level encryption and multi-factor authentication are supported capabilities of the platform but are not enabled by default in every deployment; a Tenant should confirm with CaseRail whether these controls are active for its specific deployment before relying on them.
6. Data Retention & Deletion
Tenants configure retention policies for the record types they manage. CaseRail deletes backups according to configured expiry metadata. Data subject export and erasure requests are supported through CaseRail’s data subject request tooling, to the extent enabled and used by the Tenant, who remains responsible as data controller for responding to requests under applicable law.
7. Cookies & Analytics
CaseRail uses essential cookies and product analytics. See the Cookie Policy for details.
8. International Transfers
Data may be transferred to subprocessors in other jurisdictions. Appropriate transfer safeguards are applied where required by applicable law.
9. Changes
CaseRail may update this Privacy Policy.