Most systems model access as a binary. A person can see a case or they cannot. Sealed court records access control does not work that way, and the mismatch between how courts actually restrict material and how software usually represents it is the source of a large share of accidental disclosures.
A single case can contain material that is public, material restricted to the parties, material restricted to counsel only, material sealed by order, material subject to a statutory confidentiality regime, and material a judge has restricted for a defined period. Those coexist, they change during the case, and the person administering them is usually a clerk with several other jobs.
The guide to remote and hybrid hearing technology treats confidentiality as one of four things that must hold simultaneously. This article covers how courts administer it.
The access levels a real court needs
Enumerating them makes the design requirement obvious.
| Level |
Who reaches it |
Set by |
Typical trap |
| Public |
Anyone, including through a public terminal or portal |
Default rules of access |
Assuming public means permanently public; access can narrow on appeal |
| Party |
Those on the case |
Case membership |
Party lists that are never updated when representation changes |
| Counsel-only |
Representatives but not the parties themselves |
Order, usually over sensitive personal or commercial material |
Systems that cannot express it, so it is administered by email |
| Court-internal |
Court staff working on the matter |
Practice |
Working notes treated as records, or records treated as working notes |
| Judicial |
The bench and authorized chambers staff |
Role |
Chambers staff inheriting a judge's scope by default |
| Sealed |
Named individuals, or nobody without further order |
Specific judicial order |
The restriction living in the order rather than on the item |
Statutory regimes overlay all six. Juvenile, family, and domestic violence matters frequently carry confidentiality by operation of law rather than by order, which means the restriction exists whether or not anyone applied for it, and a system that waits for an order will never apply it.
A system that cannot express these distinctly forces the court to approximate, and approximation in access control means either over-restriction, which frustrates legitimate access, or under-restriction, which is a disclosure.
Administering seals without relying on memory
The failure mode is specific and common. A judge orders material sealed. Someone applies the restriction. Months later, in a different hearing, someone else retrieves the file and the restriction is not obvious because it lives in an order rather than on the item.
What prevents this is attaching the restriction to the material rather than recording it beside the material. A sealed exhibit should be technically unreachable to anyone outside the permitted set, so that the protection does not depend on a person noticing a note.
The related requirement is a record of the restriction itself: who ordered it, when, on what basis, for how long, and who may lift it. Seals expire, are varied, and are sometimes lifted on appeal, and a court that cannot show the history of a restriction will struggle when it is challenged.
Partial sealing is where systems most often fail. A document may be public with specified passages sealed, which requires either a redacted public version alongside a full restricted version, or a system that can restrict at a finer granularity than the file. The redacted-version approach is more common and connects to AI redaction for court records and public release.
Protective orders and material that arrives already restricted
Protective orders differ from seals in an important way: they usually restrict what a party may do with material rather than what the court may disclose.
That creates an obligation the court has to support rather than merely observe. If material is disclosed to counsel under a protective order, the court's system should make it hard for that material to travel further, which means time-limited access, watermarking that identifies the recipient, download controls, and logging of every access.
the National Center for State Courts (NCSC) framing is useful here. It calls it essential that an application incorporate foolproof features to avoid users sharing files that were not intended to be shared (JTC resource bulletin). Avoiding is the operative word: a policy that relies on recipients behaving correctly is not a control.
During live proceedings, keeping restricted material out of a shared view is a related problem, covered in presenting evidence in a virtual hearing.
Access that changes over time
Restrictions are not static, and an archive built as though they were creates permanent manual work.
Seals expire. Protective orders end with the case or on a defined date. Juvenile confidentiality may persist into adulthood or lift at a threshold age depending on jurisdiction. Public access can expand after judgment and contract during an appeal.
A system that supports time-bounded restrictions, applied and lifted automatically with a record, removes a category of work and a category of error. One that requires a person to remember to lift a seal in four years will not have it lifted. The interaction with retention is covered in archiving court proceedings for retention and retrieval.
Auditing who saw what
Every access-control regime eventually faces the question of whether it held.
The audit requirement is specific: every view, download, share, and permission change, recorded with user, time, and action, in a form that cannot be altered afterward. That log needs to be queryable by case and by item, because the question when it arises is usually "who accessed this exhibit" rather than "what did this user do".
Retention of the audit log should match the retention of the material it describes rather than following an operational schedule, since a challenge to disclosure can arise long after the case closed.
How VIDIZMO DEMS handles tiered access
The capabilities divide along the line the section above draws, and it is worth keeping them separate when writing requirements.
Preventing the disclosure: role-based access control operating at case and item level, which supports the distinct levels described above rather than approximating them, and time-limited monitored access links, which allow disclosure to a defined recipient for a defined period rather than indefinitely. Both enforce rather than request, so neither depends on the recipient behaving correctly.
Establishing what happened if one occurs: watermarking, both static and dynamic, which identifies the recipient on material that has left the system, and tamper-resistant audit logging with alerting on defined events, which records every access in a form that survives a challenge. Neither prevents a disclosure, and a court that has to report a breach of a sealing order needs them anyway.
Where a court still has to do the work: the access model itself, the mapping of statutory regimes to levels, and the decision about who may lift a restriction are court determinations. A product enforces a policy; it does not supply one.
Getting this right before it fails
The practical sequence is unglamorous.
Write down the access levels your court actually uses, including the statutory regimes. Map each to a technical permission set. Attach restrictions to material rather than recording them alongside it. Make restrictions time-bounded where they should be. And test the audit log by asking it a real question before you need to.
Courts usually build this after an incident. It is considerably cheaper before.
Book VIDIZMO's Digital Evidence Management System (DEMS) demo to model your access levels and test audit queries against them.
