CaseCite Software Review on MyTechDailyNews: Legal AI Workspace Selection

For a software-first audience, the useful way to judge CaseCite is to ignore product marketing and inspect workflow boundaries: which screens people use, which data leaves the deployment, which connectors need verification, and which defaults should be changed before a team depends on it. The platform is a self-hosted legal research workspace with document upload, chat, contract review, drafting, citation checking, judge analytics, and case-law lookups. The important trade-off is control versus configuration effort, so the review below separates user-facing functions, privacy paths, deployment steps, and selection decisions.

Feature map for legal workflow users

Eight modules sit behind one login and operate over the same indexed corpus. The table below is the fastest way for evaluators to compare what each area is for, and where the software still needs caution.

Module	What it does	Selection note
Research	Chat over the firm documents using semantic retrieval with keyword BM25 rescoring and inline citations back to the source.	Good for corpus questions; verify the cited passage before relying on it.
Documents	Uploads, indexes, and organizes the corpus. Imports from Google Drive, OneDrive, Box, Dropbox, iManage, NetDocuments, Filevine, or Clio by OAuth sync, or by file picker where OAuth verification is not needed.	Use the file picker for tightly scoped tests before whole-account sync.
Contracts	Analyzes an indexed contract or pasted text, chats with a single contract, compares 2–4 contracts clause-by-clause against a baseline, and exports a redline, draft, or analysis.	Baseline selection matters; use known good clauses for fair comparison.
Drafting	Drafts from up to four Knowledge Base documents, with server-side extraction and PDF conversion. For a 30-page agreement, set a target length, review a section plan, then draft each section in its own context window against full references, and reconcile the whole document. Revisions are scoped to the sections they touch.	Useful when a firm has a fixed house style plus reference documents.
Case view	Opens a CourtListener opinion and lets the user chat with that opinion.	Helpful for reading an opinion, not a substitute for citation validation.
Authority map	Maps authorities cited across selected documents.	Useful for visualizing authority relationships.
Judge intel	Presents judge analytics from CourtListener.	Review the underlying docket data before treating a result as complete.
Legal tools	Case lookup, citation check, a scan of citing opinions for negative-treatment language, precedents, dockets, oral arguments, and case-law trends.	Not a Shepard's/KeyCite substitute.

The product does not hard-code a practice area. A team states its focus, reviews the generated profile, edits it, and keeps it in Settings. That profile travels into review, redline, and draft outputs. Every AI-generated answer, analysis, or draft includes a reminder to verify it against source documents and current law. CaseCite is a research aid, not a lawyer judgment or a citator.

Privacy and data boundaries

Storage stays local: uploaded documents, vector index, chat history, and analyses remain on the deployment. AI features still send content to providers chosen by the user. There are three outbound paths that matter: the embeddings provider, defaulting to OpenAI, or Voyage or Cohere if configured; the LLM provider, OpenAI, Anthropic or Gemini; and CourtListener, which receives search queries and citations. Nothing is sent to CaseCite maintainers, and there is no telemetry.

To keep document text entirely on the network, run both models yourself. Set OPENAI_BASE_URL for chat and EMBEDDING_BASE_URL for embeddings to OpenAI-compatible servers you host. Setting only the first still sends document text to OpenAI for embedding. The full outbound inventory and restrictions are documented in docs/subprocessors.md.

BYOK key handling that evaluators should ask about

• Per-user keys are stored server-side, encrypted with AES-256-GCM using PBKDF2 key derivation and HKDF per-record separation, in a file store on the data volume.
• Keys are displayed masked-only and are never sent to the browser; the backend decrypts them on demand for each request.
• Environment-configured fallback keys, such as OPENAI_API_KEY, are shared by all users of the install; per-user cost attribution requires per-user BYOK keys.
• ENCRYPTION_SALT can be rotated without losing stored keys: keep the old value in ENCRYPTION_SALT_PREVIOUS and run python -m app.utils.reencrypt inside the backend container.
• SECRET_KEY cannot be rotated without making stored documents unreadable, so it must be kept safe and backed up off the server.

Licensing terms in plain operating language

CaseCite uses Elastic License 2.0. For internal adoption, the terms mean: free to self-host for a firm internal use, free to modify for your own deployment, no offering CaseCite to third parties as a hosted or managed service, and no removing or altering licensing or copyright notices. For paid private installs, support contracts, or hosted-SaaS licensing, see SUPPORT.md, and the project is available through GitHub. The licensing label is Source-available, not OSI open source.

Deployment steps for a pilot

Prerequisites

• Docker and Docker Compose are needed.
• Use openssl to generate secrets.
• Have a provider API key; OpenAI is the simplest start because it covers both chat and embeddings. It is optional at the server level because each user can save a key.

Self-contained server

Use git to clone the CaseCite repository and enter the casecite directory. Copy .env.example to .env. Prepare the three required secrets, because .env.example placeholders intentionally refuse to boot.

1. Generate each secret with openssl rand -hex 32 for SECRET_KEY and AUDIT_HMAC_KEY, and openssl rand -hex 16 for ENCRYPTION_SALT, then copy the values into .env.
2. In .env, set OPENAI_API_KEY, or leave it empty and save a key under Settings after signing in. Uncomment and set DOMAIN, POSTGRES_PASSWORD, and REDIS_PASSWORD in the Bundled production stack section. Also set REGISTRATION_BOOTSTRAP_TOKEN with openssl rand -hex 16, because it is needed to create the first account.
3. Set DISK_ENCRYPTION_ACKNOWLEDGED=true. The acknowledged point is that the app encrypts BYOK keys and uploaded documents at the application layer with AES-256-GCM, while derived text such as vector chunks, chat history, and analyses is stored in cleartext in the app, Postgres, and Redis volumes. Full-disk encryption of the host is the user responsibility.
4. Start the full stack bundled with Postgres, Redis, and Caddy by using docker compose -f docker-compose.prod.yml up -d.

Running python3 scripts/setup_production.py --create-env --domain <host> performs steps 1–2 automatically; it generates every secret and writes .env with mode 0600. Then open https://$DOMAIN, or https://localhost when DOMAIN=localhost.

On a localhost trial, Caddy redirects HTTP to HTTPS and serves a certificate from its own self-signed local CA, so the browser warning on first visit is expected. See TLS on Internal Networks to trust that CA or bring your own certificate.

The first account registered becomes the admin, and registering it requires the REGISTRATION_BOOTSTRAP_TOKEN from .env. The exact command is under Create the admin account in docs/deployment.md. After that, colleagues can be invited from Settings, and self-service registration is off by default.

When using Coolify or Traefik

Behind an existing reverse proxy such as Coolify or Traefik, use the root docker-compose.yml. It expects external Postgres and Redis and declares the persistent data volume. Read deploy/COOLIFY-SETUP.md, and set TRUSTED_PROXIES to the proxy subnet, because client IPs would otherwise collapse to one value.

Required configuration

The stack fails closed on startup if a required variable is missing or left as a placeholder.

Variable	Description
SECRET_KEY	JWT and CSRF signing key and root of at-rest encryption. Generate with openssl rand -hex 32 and never change after first run.
ENCRYPTION_SALT	At-rest encryption salt. Generate with openssl rand -hex 16 and never change after first run except through rotation.
AUDIT_HMAC_KEY	Audit-log chain key, at least 32 characters. Generate with openssl rand -hex 32.
POSTGRES_PASSWORD	Password for bundled Postgres.
REDIS_PASSWORD	Password for bundled Redis.
DOMAIN	Public hostname or localhost. CORS_ORIGINS and ALLOWED_HOSTS default from it.
DISK_ENCRYPTION_ACKNOWLEDGED	Set true to acknowledge that full-disk encryption of host volumes is your responsibility. Application-layer AES-256-GCM covers BYOK keys and document originals, while derived text is cleartext.
REGISTRATION_BOOTSTRAP_TOKEN	Needed to register the first admin account. Generate with openssl rand -hex 16.

These variables are not required to boot, but the product does little without them.

Variable	Description
OPENAI_API_KEY	Server-level provider key shared by all users. Without one, each user must save their own key under Settings before chat, analysis, or indexing works.
COURTLISTENER_API_TOKEN	CourtListener is the only case-law source in the app. Citation check requires a token; other case-law tools work without one but are heavily rate-limited. A free token is available from CourtListener.

When using root docker-compose.yml with external database and Redis instead of the bundled stack, set DATABASE_URL, REDIS_URL, CORS_ORIGINS, and ALLOWED_HOSTS directly, and set DB_SSL=require for a managed database.

Optional configuration

Variable	Default	Description
ANTHROPIC_API_KEY	—	Claude access.
VOYAGE_API_KEY	—	Voyage AI legal embeddings.
OPENAI_BASE_URL	—	OpenAI-compatible endpoint for chat, using a self-hosted model or gateway.
EMBEDDING_BASE_URL	—	OpenAI-compatible endpoint for embeddings. Set it with OPENAI_BASE_URL to keep document text on your network.
VECTOR_DB	chroma	Use chroma locally, or pinecone to store document text with Pinecone.
TRUSTED_PROXIES	127.0.0.1	Reverse-proxy IP or CIDR; required behind a proxy.
REQUIRE_MFA	false	Require every password account to enroll TOTP MFA.
SESSION_ABSOLUTE_TIMEOUT_HOURS and SESSION_IDLE_TIMEOUT_MINUTES	8 / 120	Session lifetime and idle timeout.
ALLOW_REGISTRATION	false	Allow self-service sign-up after the first account.
SENDGRID_API_KEY	—	Enables password-reset emails; change-password works without SendGrid.

The .env.example file documents every setting.

Connector behavior to test before rollout

• The sync API imports one folder using folder_id, or the whole account with an explicit sync_all. The UI has no folder picker yet, and Sync Now imports the whole connected account after a second confirmation that says so. Use the file picker to bring in selected files.
• Clio listing is account-wide, so Clio cannot sync a single folder.
• Filevine uses one firm-wide API key, so it remains off until FILEVINE_ENABLED=true, then it is available only to admins.
• iManage and NetDocuments are implemented against published APIs but have not been validated against a live tenant; test them before relying on them.
• Microsoft and Google connections request read-only scopes. Connections made before this release keep their broader grant until reconnected.

CourtListener token realities

Legal tools, Judge intel, Case view, and the case-law side of the strategy engine read from CourtListener. CourtListener is the only case-law source. The app starts without a token, but the case-law half is not usable without one.

• Citation check hard-fails without it. validate_citation refuses to run and returns a token required error that names where to set the token.
• Every other CourtListener call falls back to anonymous access, which is rate-limited enough that research features become unusable under real load.

A free token can be obtained from CourtListener. Set COURTLISTENER_API_TOKEN in .env, save it instance-wide as an admin through Settings, or POST /api/v1/admin/integrations/courtlistener. The stored token overrides the .env value at runtime without a restart.

Repository layout for integrators

• backend contains app, where main.py runs the FastAPI app with middleware and health endpoints; config.py uses Pydantic settings; routers hold API routers; services contain the RAG pipeline, ChromaDB and Pinecone abstraction, multi-provider embeddings, JWT auth, Matter strategy briefs, and the CourtListener API. middleware handles security and CSRF, and migrations contain Alembic migrations.
• frontend contains src with App.tsx, per-domain API clients, page views, Zustand stores, shared components and modals, and the app shell layout.
• scripts include backup and restore, production setup, key rotation, and the NOTICE generator.
• docs cover deployment, data flows, secret rotation, incident response, and architecture decisions.
• Dockerfile builds one unified image for frontend and backend. docker-compose.prod.yml bundles Caddy, Postgres, Redis, and backend. docker-compose.yml is intended for use behind an existing proxy such as Coolify or Traefik, with external Postgres and Redis. docker-compose.dev.yml supports local development.

API-only capabilities without UI yet

These capabilities are implemented and reachable over the API, but the frontend does not expose them yet. Treat them as preview.

• Matters manage matter records, membership, and sharing of documents and chats between members. Creating matters and changing membership requires the matters.manage permission.
• Strategy briefs search each proposition on CourtListener, read candidate opinions, and keep a citation only when a verbatim quote can be located in the real opinion text. Unsupported citations are dropped rather than shown.
• Azure AD SSO performs backend token exchange only, and there is no sign-in button. SAML, generic OIDC, and SCIM are not supported.

Everything else has a UI, plus user administration and the audit log for admins.

Security defaults and gaps

• Password sign-in uses PBKDF2-SHA256 and supports optional or mandatory TOTP MFA plus recovery codes. Password reset is available by email, and change-password is available in the app.
• JWT access tokens use rotating refresh tokens in httpOnly cookies, with JTI revocation in Redis required in production, and a sign out everywhere action.
• Sessions are capped at 5 per user, with an 8-hour absolute lifetime and an idle timeout.
• Role-based permissions are adjustable per role by an admin.
• Every document, chat, and analysis can be scoped per user, and also per matter.
• CSRF double-submit cookies are HMAC-signed; per-IP rate limiting and account lockout are enabled.
• AES-256-GCM at-rest encryption protects uploaded originals, API keys, connector tokens, and MFA secrets. The vector index and database depend on disk encryption provided by the user.
• CSP, HSTS, X-Frame-Options, and Permissions-Policy headers are set.
• The audit log uses HMAC-SHA256 chain hashing and is verified at startup and on demand.
• CaseCite holds no security certification such as SOC 2, ISO 27001, or HIPAA. SECURITY.md describes what it does and does not do, and ROADMAP.md lists known gaps.

Data citation map

• Licensing terms are defined in the LICENSE file, while paid install, support, and hosted-SaaS licensing are described in SUPPORT.md.
• Outbound flows and restriction guidance are listed in docs/subprocessors.md.
• Deployment details are covered in docs/deployment.md and deploy/COOLIFY-SETUP.md.
• Security expectations and certification status are documented in SECURITY.md and ROADMAP.md.

Common misconceptions

• Self-hosting does not automatically mean no third-party AI calls. BYOK still sends embeddings and chat requests to configured providers unless both endpoints are self-hosted.
• A localhost certificate warning is expected because Caddy uses its own self-signed local CA.
• Source-available, not OSI open source, does not mean a firm can resell the service to third parties.
• Citation check is not a Shepard's/KeyCite substitute; it scans citing opinions for negative-treatment language.
• Per-user cost attribution needs per-user keys, not one shared environment key.

FAQ before choosing CaseCite

Can a team avoid cloud AI entirely? Yes, only by setting OPENAI_BASE_URL and EMBEDDING_BASE_URL to OpenAI-compatible self-hosted services. Setting only the chat endpoint still sends document text to OpenAI for embedding.

Should an IT pilot start with connectors or file picker? Start with the file picker for a bounded corpus, then test OAuth connections, because some connectors import whole accounts and live validation can differ by vendor.

What should be backed up first? SECRET_KEY, because rotating it breaks access to stored documents, and REGISTRATION_BOOTSTRAP_TOKEN for the initial admin workflow.

Action recommendations for a software pilot

1. Create an isolated Docker Compose trial, set the required environment values, and acknowledge the disk encryption limitation.
2. Load a small corpus with the file picker, run one research question, and inspect the inline citations.
3. Save per-user BYOK keys rather than relying on one server key when cost attribution matters.
4. Set the CourtListener token before testing case-law features, otherwise citation checks hard-fail.
5. Enable MFA, session limits, and admin-only invites before inviting colleagues.
6. Review docs/subprocessors.md, LICENSE, SUPPORT.md, SECURITY.md, and ROADMAP.md before making an internal policy decision.

Written by Sarah Chen for Tech Daily. For follow-up coverage of software tools, contact MyTechDailyNews at hello@techdaily.com.