Security & Trust
We're the tool, not the filing cabinet.
CaseFlo helps you write documents faster — without ever becoming the place your agency's data lives.
About CaseFlo
CaseFlo Limited is a UK-registered company (Company No. 17181579), incorporated in England and Wales on 27 April 2026. Our registered office is 16 Kirchen Road, London W13 0TY. CaseFlo is built for UK fostering practice. Your data is processed under UK GDPR and the Data Protection Act 2018. Some processing is carried out by trusted sub-processors outside the UK under Standard Contractual Clauses — see our Privacy Policy for the full list and locations.
CaseFlo is a Data Processor — not a Data Controller
Under UK GDPR, your agency stays in control of every piece of information about the children and carers on your books. We only process the notes you give us to draft a document, then we hand that document back to you. We never own your data. We never build profiles of children or carers. We never become your system of record.
What this means in plain terms
Your data stays yours
If a birth parent submits a Subject Access Request, it goes to your agency, not to us. If your agency changes software providers, you don't have to extract years of case data from our servers — because we're not storing years of case data. We only hold what we need, for the time it takes to help you write one document.
Your work is safe while you're writing it
Your drafts save automatically as you work. If your browser crashes, your laptop dies, or you accidentally close the tab, your draft is still there when you log back in. You can't lose an assessment because of a technical problem at our end.
Zero-Retention mode — once it's done, it's gone
On our Scale tier, the voice recordings and working drafts you create are automatically deleted 24 hours after you export your final document to Word. Your agency keeps the final document on your own systems. CaseFlo keeps nothing.
Your document, on your systems
When you export your finished document to Word, the file is yours to save wherever your agency stores its records. CaseFlo does not retain the finished export on its servers.
UK data protection
CaseFlo is designed for UK fostering practice and operates under UK GDPR. Where data is processed by sub-processors outside the UK (such as our AI and transcription providers), this is done under Standard Contractual Clauses, as detailed in our Privacy Policy.
We encrypt everything. Data travelling to and from your browser is protected by TLS 1.3. Data at rest on our servers is encrypted with AES-256. We log who accessed what, and when.
Our infrastructure providers (Supabase and Vercel) hold ISO 27001 certification. We're working toward Cyber Essentials Plus for CaseFlo itself.
Who sees your data
A small, defined list of services help us run CaseFlo. Every one of them is GDPR-compliant and audited. Full list:
Documents for your records
Before you use CaseFlo with real case data, we'll send you a signed Data Processing Agreement and help you complete your own Data Protection Impact Assessment. Request these from us directly.
Request DPA and DPIA templateIf you have a specific data protection question this page hasn't answered, email cheyenne@caseflo.co.uk and Cheyenne or Ramayne will reply personally within one working day.