Case Scribe helps employment services professionals write IEA-aligned case notes. Because that work involves participant information, security and privacy are designed in — not bolted on. This page explains how your data is handled in plain language.
Last updated: July 2026
All application data is stored in Supabase (PostgreSQL) and the application runs on Railway. Data is encrypted in transit (HTTPS/TLS on every connection) and encrypted at rest by our hosting providers. Access to production systems is limited to essential personnel with multi-factor authentication enforced.
Every caseworker's participants, notes, and documents are isolated at the database layer using PostgreSQL Row Level Security. Isolation is enforced by the database itself on every query — not just by application code — so one user's data is never visible to another. Team Leader access, where enabled, is explicitly granted and cannot be self-assigned.
Security-relevant events — logins, failed login attempts, account creation, participant and note creation/deletion, AI generations, data exports, and account deletions — are recorded in a tamper-resistant audit log that application users cannot modify.
The database is backed up automatically on a daily basis with point-in-time recovery available, and restores are tested periodically.
We maintain a documented incident response process: contain, preserve logs, assess affected data, notify affected customers promptly, and notify the OAIC where required under the Notifiable Data Breaches scheme. A post-incident report is produced for any material incident.
For security or privacy questions, data requests, or to report a vulnerability: security@casescribe.com.au