> ## Documentation Index
> Fetch the complete documentation index at: https://help.casaconect.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security overview

> How Casa Conect protects client documents and correspondence: where data lives, who can reach it, how the AI agent is contained, and which third parties are involved.

Law firms, notaries and property professionals hold some of the most sensitive documents their clients will ever produce. This section explains how Casa Conect protects them. It describes what is built, and it says where something is not yet in place.

<Note>
  This page describes our security practices at the level of a help page. We share detailed security documentation, architecture reviews and completed questionnaires with customers on request. Write to [support@casaconect.ai](mailto:support@casaconect.ai).
</Note>

## At a glance

<CardGroup cols={2}>
  <Card title="Hosted in the EU" icon="map-pin" href="/security/hosting-and-infrastructure">
    Casa Conect runs on Amazon Web Services in the European Union, in a private network behind a web application firewall.
  </Card>

  <Card title="Encrypted everywhere" icon="lock" href="/security/encryption">
    TLS in transit and AES-256 at rest, with separate managed keys for different kinds of data.
  </Card>

  <Card title="Passwordless sign-in with MFA" icon="scan-face" href="/security/authentication">
    Email-code sign-in, authenticator-app MFA, session management, and re-authentication for sensitive changes.
  </Card>

  <Card title="Tenant isolation by design" icon="building" href="/security/access-control">
    Every request is authorized against a verified identity and organization, and data is separated by organization at every layer.
  </Card>

  <Card title="A contained agent" icon="https://mintcdn.com/casaconect/g6qw6FHesaxDKWMA/icons/agent.svg?fit=max&auto=format&n=g6qw6FHesaxDKWMA&q=85&s=7cf2f3ed529df1b044f76d5ac609a64f" href="/security/agent-safety" width="24" height="24" data-path="icons/agent.svg">
    The agent acts with the user's access and no more, treats outside content as data, and loses its riskiest tools whenever nobody is watching.
  </Card>

  <Card title="Transparent AI data handling" icon="cpu" href="/security/ai-data-handling">
    Which AI services see your content, what they receive, and how to keep model processing in the EU.
  </Card>

  <Card title="Hardened email" icon="mail" href="/security/email-security">
    Inbound mail is authenticated, scanned and gated before the agent sees it. Unknown senders wait for a person.
  </Card>

  <Card title="Scanned uploads" icon="scan-search" href="/security/hosting-and-infrastructure#uploads">
    Every uploaded file is scanned for malware before it can be opened.
  </Card>
</CardGroup>

## Principles

<Steps>
  <Step title="Least privilege, enforced in code">
    Access is decided on the server from a verified identity, never from what the browser claims. The agent inherits the acting user's access. It has none of its own.
  </Step>

  <Step title="Fail closed">
    When a check cannot be completed, the answer is no. An incomplete virus scan holds the email. A failed safety review holds the action. A PIN check that cannot run refuses the attempt.
  </Step>

  <Step title="A person decides what leaves">
    Email to anyone outside the organization is drafted for approval. Sharing with outside parties always asks first. Edits to existing documents are tracked changes.
  </Step>

  <Step title="Keep content out of telemetry">
    Analytics never record document text, email bodies or conversation content. Session replay masks all text and blocks content areas entirely. Error reports carry the shape of a request, not its values.
  </Step>
</Steps>

## Shared responsibility

| Casa Conect is responsible for                                | You are responsible for                                                                                                      |
| :------------------------------------------------------------ | :--------------------------------------------------------------------------------------------------------------------------- |
| The security of the platform, its infrastructure and its code | Who you invite, and the roles you give them                                                                                  |
| Encrypting, backing up and isolating your data                | Turning on [two-factor authentication](/admin/account-and-sign-in) for your account                                          |
| Containing the agent and gating inbound email                 | Your [sender rules](/inbox/sender-rules), [reply policy](/inbox/approvals) and [permission levels](/agent/permission-levels) |
| Vetting and listing [subprocessors](/security/subprocessors)  | Reviewing the agent's work before it reaches a client                                                                        |
| Providing account and organization deletion                   | Deciding what to upload, and honouring your own retention duties                                                             |

## Certifications and assurance

Casa Conect does not currently hold an independent security certification such as ISO 27001 or a SOC 2 report. Our infrastructure is continuously checked against the cloud provider's security best-practice benchmarks. These are internal posture checks, not certifications. If you need a completed security questionnaire or a data processing agreement, [contact us](mailto:support@casaconect.ai).

## Report a concern

If you believe you have found a vulnerability, or you suspect unauthorized access to your organization, see [Reporting a security concern](/security/responsible-disclosure).