For your director and whoever reviews your software
What stays on the machine, what doesn’t, and why
Overview
CaseLoop is local-first. Client records, mail and attachments are stored on the computer that syncs them and are not uploaded to us. What travels the other way is software — the interface, and the signed definitions that tell it how your systems are shaped.
Your device holds the data and does the work. Our servers hold the software and send it down. That is the whole architecture, and it is why there is no central copy of your families’ records to breach.
The language model and the document index both run locally. No prompt, note, email or client name is sent to OpenAI, Anthropic, Google or anyone else — there is no such request anywhere in the software.
The logins CaseLoop uses to reach your practice systems are stored encrypted on the device, using the operating system’s own keystore. They are not held by us.
This describes CaseLoop 2.3.8. If you are reviewing us formally and want any of it confirmed against a specific control, ask — we would rather answer precisely than have you infer from a marketing page.
On the device
Everything CaseLoop syncs lands in one folder in the user’s home directory, ~/.ollama-chroma-app/. It holds a small number of SQLite database files, one per connected system, plus the local document index and the AI model.
| What | Where |
|---|---|
| Client records, sessions, assessments | A database file per connected practice system, on the device |
| Mail, attachments and the tags derived from them | A database file on the device |
| Referral packets and their extracted fields | On the device, alongside the mail they arrived with |
| The AI model and the searchable document index | On the device — several gigabytes, which is why setup downloads for a while |
| Logins for your practice systems | On the device, encrypted with the operating system keystore |
| Staff document files | On the device and in CaseLoop’s storage — see the exceptions below |
Each computer syncs its own copy. There is no shared server holding one master copy, which means two things worth planning for: a lost laptop is a lost copy of real data, and full-disk encryption is doing real work in your control set. Turn on FileVault or BitLocker.
Across the network
This list is complete as of 2.3.8, and it is short by design. Anything not on it stays where it was created.
Name, email address and password — held by us so you can sign in, and so we know which agency an install belongs to. No client information is attached to an account.
The Staff area is the one part of CaseLoop where our servers are the system of record. Staff fields — names, roles, licence numbers, expiry dates — are stored in CaseLoop’s database, not on the device.
Uploaded staff documents are stored in both places: a copy on the device, so they can be read offline and filed automatically, and a copy in CaseLoop’s file storage.
This is staff and credentialing information, not client information. It is worth naming separately in any assessment, because it is the one place where “it stays on the machine” is not the answer.
When someone assigns a referral to a therapist from the Referrals page, that referral travels through our servers to your own practice-system account, which is where the credential for it lives. We pass it on; we do not keep it.
This only ever happens when a person clicks the button. Nothing is pushed automatically.
Sharing a report sends the recipe, not the results: the report’s name, description and the definition of each card. The rows are stripped out before it is sent, and the recipient’s own machine runs the report against the data it already has.
Two people sharing a report never exchange a single client record.
Your own systems
Separately from the four above, CaseLoop talks directly from your machine to the systems you connect it to — your practice management system, your mailbox, your document system. That traffic goes from the device to that vendor. It does not route through us.
Mail is read on the device and stored there. It is not uploaded to us — not the bodies, not the attachments, not the addresses. The tags and case links CaseLoop derives from mail are computed on the device by the local model.
If someone connects a personal mailbox rather than their work one, CaseLoop marks it in the app as “Personal account — outside your organisation’s BAA.” That label exists because a personal account is outside your agreement, and the app should say so rather than let it pass unnoticed.
Controls
| To stop | Do this | Effect |
|---|---|---|
| One person’s mail access | Remove the mailbox in the Email settings, or revoke CaseLoop from their Google or Microsoft account | Immediate |
| All mail access, agency-wide | Delete the credential in your Google Cloud or Entra console | Immediate — see the setup guides |
| A practice-system connection | Remove the integration in Settings | Immediate; the data already synced stays on the device |
| Everything on one machine | Uninstall CaseLoop and delete ~/.ollama-chroma-app/ | Removes every local copy |
Pushing a referral to your practice system creates a record there, and those systems generally have no delete. Treat the push button as permanent. It is the only action in CaseLoop with that property, and the app warns before it.
Troubleshooting
| What you see | What to do |
|---|---|
| “Does our client data touch your servers?” | No. Client records, sessions, mail and attachments stay on the device. The four things that do cross the network are named above, and none of them is a client record — the closest is a referral you explicitly push to your own practice system, which we pass through and do not keep. |
| “Do you send anything to an AI provider?” | No. The model runs on the device. There is no request to any external AI service anywhere in the software, which is a thing you can hold us to rather than take on trust. |
| “Where are our staff credentialing documents?” | In two places: on the device, and in CaseLoop’s storage. Staff records are the one area where our servers are the system of record. Say so explicitly in your assessment. |
| “What happens if a laptop is stolen?” | That machine holds a real copy of the data it synced. Full-disk encryption is the control that matters; so is removing the person’s mail access and practice-system access, both of which are immediate. Tell us too — we can help confirm what that install had. |
| “Can we get everything back out?” | Yes. Reports export to CSV, and the underlying data is in standard SQLite files in a folder you own. There is no export request to file and nothing held hostage. |
| “Do you need a BAA?” | You already have one if you are running CaseLoop with client data. If you cannot find it, ask and we will send the current copy. |
If you are working through a security questionnaire and a question does not map cleanly onto this page, send it over. A precise answer is faster for both of us than a guess drawn from a website.