Security

Where your files are stored

Case files are stored exclusively in the United States, in SOC 2 Type II–attested data centers — on every plan, not as a paid upgrade.

They do not sit in one provider's vault. Each file is encrypted, then erasure-coded into many fragments distributed across nodes in that vetted pool; each file rebuilds from a subset of them. Every fragment is ciphertext, and the decryption keys are never present on a storage node — so a breached node yields encrypted bytes of one segment, and even an operator holding every fragment of a file would hold encrypted bytes, not a viewable file. There is no single conventional vault holding every customer's evidence behind one lock.

Our application and database infrastructure runs on SOC 2 Type II–attested providers as well.

What we claim, and what we do not

MyCaseViewer does not hold a SOC 2 attestation of its own, and you should be wary of any small vendor that claims one loosely.

What we can tell you is precisely where your files sit and what protects them. The controls a vendor review actually asks about — encryption in transit and at rest, no publicly readable storage, expiring signed links, enforced retention, and a complete access audit trail — are built in rather than optional. The section near the end of this page lists, in plain terms, the things we have not built. We would rather you learn them here than discover them later.

Encryption

In transit. Every connection is HTTPS. We send a two-year HSTS policy covering all subdomains, with preload, so a browser that has seen the site once will refuse to connect over plain HTTP.

At rest. Case files are encrypted before they are distributed to storage, and the fragments are meaningless individually. Database and application storage are encrypted at rest by their providers.

Files are temporary, and deletion is enforced

Every case has a retention period, set by your plan and by any per-case timer you choose. When it ends the case is deleted — the files, and any converted display copies, are permanently removed from storage and your quota is released, after a 24-hour grace period. A case you delete yourself is purged after seven days.

This is enforced by a scheduled job, not by a policy someone remembers to follow. It is also the single most effective security control on this page: material that no longer exists cannot be exposed by any future breach, subpoena, or mistake.

The one exception is a case under legal hold, which stops expiring on purpose, and only when you place the hold.

Your client views without downloading

Regulated organizations — banks, insurers, corporate legal departments — routinely forbid staff from downloading attachments, because downloads are how ransomware and malware arrive. MyCaseViewer shows the material instead.

Video, audio, images, and documents play and render inside the viewer. You decide per case, and per file, whether downloading is permitted at all. A recipient who is only meant to look at something never receives a copy of it.

Office documents never leave the recipient's browser

Modern Word and Excel files are parsed and rendered entirely on the recipient's own device. They are fetched through the same metered access route as any other file and displayed locally. They are never handed to a conversion service, ours or anyone else's.

Only legacy formats a browser genuinely cannot display — older .doc and .ppt files, HEIC photos, unusual video containers — pass through a conversion service, pinned to its US East region so processing stays on US soil, and only for as long as the conversion takes.

Getting into a case

The link. Each case link carries a 24-character random identifier drawn from a 64-symbol alphabet — about 144 bits of entropy. Guessing one is not a practical attack. Viewer pages are served with no-index directives and are not reachable from any listing.

Passwords. You can require a password on any case. It is stored only as a hash. When a viewer enters it correctly, the proof they hold is a signed token in a cookie scoped to that one case, valid for four hours — not the password, and not usable anywhere else.

Per-recipient links. Instead of one shared link you can issue a separate link per recipient, each carrying its own 128-bit random token. You then see exactly who opened what, and you can revoke one recipient's access without disturbing anyone else's.

Every one of those signed values is verified with a constant-time comparison, so the check itself leaks nothing.

Every file request is checked, and every URL expires

Storage is never publicly readable. There is no such thing as a permanent URL to one of your files.

Each time a file is opened, the request passes through our own route, which re-checks the password gate, the download permission, the per-IP rate limit, and the account's bandwidth quota before issuing a signed URL that expires almost immediately: 60 seconds for a download, four hours for a video or audio stream that a viewer may need to seek through. A URL that leaks is a URL that has already stopped working.

Accounts, sub-users, and administrators

Account passwords, case passwords, and sub-user access codes are all stored as non-recoverable hashes. Nobody at MyCaseViewer can tell you what your password is, because nobody here can read it.

Sessions last 30 days and refresh once a day. Clicking an email verification link does not sign you in — it confirms the address, and you still sign in with your password, so possession of a forwarded email is not possession of an account.

Sub-users sign in to a separate portal with your account handle, their name, and an access code you issue and can disable at any time. They can create cases and upload files under your quotas, and nothing else — a sub-user who navigates to the dashboard is bounced to the login page. Every upload is tagged with which sub-user made it.

Administrative access is gated at the layout and independently re-checked inside every administrative action, so a single missed check cannot expose the panel.

Rate limiting

Abuse budgets are applied per surface, so guessing attacks fail quietly:

The cap on outbound sends exists so the application can never be used as a mail relay.

The audit trail

Every view and every download is recorded: the time, the IP address, an IP-derived country, a description of the browser and device, which file, and — when per-recipient links are used — which recipient. From that record you can produce a Certificate of Delivery showing what was delivered and when it was opened.

The certificate states plainly what each field is and what it is not. An IP-derived country is not proof of where a person was standing, and saying so on the document is what keeps the rest of it credible.

Legal hold events — every placement and release, with a reason and the person responsible — are written to an append-only, hash-chained log. Each entry's digest covers the previous entry's, so removing or altering one breaks every digest after it, and the certificate reports whether the chain verifies. A custody record that could be quietly edited would be worth nothing.

Browser-level hardening

Every response carries a content security policy restricting where scripts, frames, and media may come from, plus X-Frame-Options, X-Content-Type-Options: nosniff, a referrer policy, and a permissions policy that denies camera, microphone, and geolocation outright.

No tracking, anywhere

There are no advertising or analytics trackers on this site or in the viewer. No Google Analytics, no ad pixels, no third-party session recorders. Every cookie we set is one the product needs to function, and they are listed in the Privacy Policy. Your clients are not profiled for opening your case.

What we have not built

A security page that lists only strengths is a sales document. These are the things a thorough reviewer will ask about and not find:

• No two-factor authentication on accounts yet. It is the first item on our security roadmap.
• No IP allowlisting.
• No independent penetration test has been performed to date.
• No SOC 2 attestation of our own, as stated above. Our storage and infrastructure providers hold theirs.
• No granular role-based permissions. There are account owners, sub-users who may only upload, and administrators. Access to case material is controlled per case and per file rather than by role.

If one of these is a requirement for your firm, tell us — it moves up the list.

Reporting a vulnerability

If you believe you have found a security issue, write to security@mycaseviewer.comwill acknowledge within two business days, keep you updated, and we will not pursue anyone who reports in good faith and does not access other people's data.

Questions we get asked

Is MyCaseViewer SOC 2 certified?

No. We do not hold an attestation of our own, and we will not imply otherwise. Your case files are stored exclusively in SOC 2 Type II–attested data centers on US soil, on every plan, and our application and database infrastructure runs on SOC 2 Type II–attested providers.

Is my data encrypted?

Yes — in transit over HTTPS with a preloaded two-year HSTS policy, and at rest. Case files are encrypted and split into fragments across independent storage operators before they come to rest anywhere.

Where is my data stored?

Entirely in the United States. We do not offer storage outside the US.

Do you support two-factor authentication?

Not yet. See "What we have not built" above.

Can I stop my client downloading files?

Yes, per case and per file. Viewing and playback still work; only the download is withheld.

What happens to my files when a case expires?

They are permanently deleted from storage, along with any converted display copies, after a 24-hour grace period, and your storage quota is released. Deletion is run by a scheduled job. Keep your own copies of anything you need to retain.

Who can see my case material at MyCaseViewer?

Our staff do not read the contents of your cases except when you ask us to for support, when strictly necessary to investigate a fault or a security incident, or when compelled by valid legal process. Such access is limited and logged. Our Terms of Service set out exactly how we respond to subpoenas.