No. Here's exactly why.
You're being asked to trust a platform with privileged case material. That trust has to be earned with specifics, not slogans. This page explains our technical guarantees and lets you verify them yourself.
Every table that stores your data has Row-Level Security (RLS) policies enforced by the database itself — not just the UI. Even if opposing counsel signs up on LitiGateAI, the database physically refuses to return your rows to their session.
Your uploads, drafts, notes, and case metadata are never sold to data brokers, publishers, or any third party. Our business model is subscription-based — we have zero incentive to expose client data.
All traffic uses TLS 1.2+. Files in storage buckets and database records are encrypted at rest on managed cloud infrastructure. Only your authenticated session can decrypt and view them.
Your private case documents are not used to train any AI model. Prompts are sent to the model to generate your specific output and are not retained for training. Only public-source judgments power the research engine.
No LitiGateAI staff member has ad-hoc read access to your private case files. Sensitive admin actions are recorded in an immutable audit log.
Delete a document, a case, or your entire account from the dashboard. Soft-deleted documents are permanently removed after 30 days.
Runs real queries against your own account, right now, using the same client the app uses. If a row from another user ever appeared, you'd see it here.
Cases table (your matters)
Query returns only rows where user_id = your account id.
Case documents (uploads)
Every document row is scoped to its owner. No cross-account reads possible.
Saved drafts
Drafts you generate stay in your workspace only.
Notifications & alerts
Case alerts and hearing updates are delivered only to you.
This check queries live tables using your JWT. Pass = the database refused to return any row that isn't yours. It runs on every visit — you don't need to take our word for it.
Every table that stores private data — cases, uploaded documents, drafts, notifications, hearings, analyses — has a Row-Level Security (RLS) policy written directly on the database. When your browser queries the database, the query is executed as your user identity (from the JWT), and the database silently filters out every row that doesn't belong to you.
Because the rule lives in the database, it can't be bypassed by a bug in the frontend, a curl request, a rogue browser extension, or even a compromised API route. The database itself is the gatekeeper.
Storage buckets (where uploaded PDFs and images live) use the same principle — files are stored under paths keyed to your user id, and the storage layer refuses to serve a file to any other authenticated user.
If the opposing counsel also uses LitiGateAI, can they search for my case and read it?
No. Search on your dashboard runs only against your own cases. Opposing counsel searching from their own account will only ever see cases they created themselves.
Are my uploaded documents used to train AI models?
No. Private documents you upload are never used for training. When you use an AI feature, only the specific text needed for that request is sent to the model provider and not retained for training on their side either.
What about the eCourts case data — is that private?
eCourts case status is already public information published by the judiciary. What is private is the fact that you are tracking it, your notes, your linked documents, and your analyses — all of which are scoped to your account.
Who inside LitiGateAI can read my files?
No product, sales, or support staff has ad-hoc access to your case files. Infrastructure access is limited to a small operations group under least-privilege controls, used only for legitimate incident response, and every such action is audit-logged.
What happens if I delete a case or my account?
Deleting a case removes the row from the live database immediately. Uploaded files are soft-deleted and permanently purged within 30 days. Account deletion removes all personal records within 30 days, subject only to lawful retention obligations.
How do I test all this without uploading real client data?
Use /demo — it's a full walkthrough on synthetic cases. Evaluate every feature without uploading a single real file, then bring real data once you're comfortable.