Your records are safe with us — on paper and in digital form.

Independently audited: SOC 2 Type II

CASO Document Management has completed a SOC 2 Type II examination covering the Security Trust Services Criteria. An independent auditor tested our controls over a 12-month period ending June 2025, covering our scanning facilities, document conversion services, and hosted software.

Our next SOC 2 Type II examination is currently underway. A bridge letter covering the period since our last report is available on request.

Need the report? Current and prospective clients can request a copy of our SOC 2 Type II report under a standard non-disclosure agreement.

Compliance for regulated industries

We work in industries where privacy rules aren’t optional. Here’s how we support your obligations.

Healthcare | HIPAA / HITECH
We handle protected health information (PHI) for hospitals, clinics, and laboratories in line with HIPAA Security and Privacy Rule requirements. Staff who work with medical records receive annual HIPAA training, and we sign Business Associate Agreements (BAAs) with covered entities.

Education | FERPA
Student records are handled under strict confidentiality controls that support school districts, colleges, and universities in meeting their FERPA obligations.

Financial services | GLBA, FINRA, and SEC recordkeeping
For credit unions, broker-dealers, banks, and insurers, our controls support your obligations to protect customer financial information and retain records.

Government | Public records and accessibility
We help state, county, and municipal agencies digitize records to FADGI imaging guidelines and make public PDFs accessible to WCAG, PDF/UA, and Section 508 standards.

Legal | Confidentiality and discovery
Litigation and discovery documents are processed under confidentiality controls, with privilege handling and audit trails.

Chain of custody: from your office to ours and back

Every box we handle is tracked from the moment it leaves your hands.

• Secure pickup and transport. CASO-employed drivers or bonded couriers collect records in sealed, locked, or tamper-evident containers and transport them in locked, GPS-tracked vehicles.
• Documented hand-offs. Each transfer is logged with barcodes and timestamps, so you know exactly where your records are at every step.
• On-site option. For records that can’t leave your building, our team can scan at your location.
• Return or destruction. When scanning is complete, originals are returned to you, stored securely, or destroyed according to your instructions, never on our own initiative.

Secure facilities

Our production centers are designed for confidential work.

• Badge-controlled access to production and storage areas, with visitors escorted at all times
• 24/7 video surveillance and monitored alarm systems
• Locked, restricted-access storage for records awaiting scanning, return, or destruction
• Clean-desk policy and restrictions on personal devices in production areas

Our people

Security depends on the team doing the work.

• Every CASO employee passes a criminal background check or background screening before handling client records.
• Employees complete annual security and privacy training, with additional HIPAA training for teams working with medical records.
• Access to client records is limited to the people working on your project.

Protecting your digital files

Once your documents are digital, we protect them with the same care.

• Encryption. Files are encrypted in transit using TLS 1.2+ and at rest using AES-256.
• Secure delivery. Images are delivered by secure file transfer (SFTP), encrypted media, or direct import into your ECM system.
• Access control. Our ECM Toolbox software lets you set user permissions at the document level, so you always know who can view, edit, or delete each record.

Certified destruction

When you no longer need your originals, we shred them and provide a certificate of destruction for your records.

Report a security concern

If you believe you’ve found a security vulnerability in a CASO system, please email info@caso.com. We review every report and will respond promptly.