What security features should immigration case management software have?

A phished or reused password puts every file that account can reach at risk, which makes sign-in the first control to settle. A second factor protects each account that has one, and requiring it for everyone removes the unprotected exceptions. So ask whether an administrator can require it, and whether your plan includes it.

The two vendors answer differently. Docketwise's security page says 2FA is available on every pricing plan, and its 2FA help article says the second factor is mandatory once a trial ends. Users choose an authenticator app, a text message to a US mobile number, or email. Ask whether the firm can limit staff to the authenticator app, since a code sent by email is only as safe as the mailbox it lands in.

eImmigration's security page lists "optional MFA," and its pricing page sells "2FA & SSO Advanced Authentication" as one of 17 premium features. Starter includes one premium feature, Essentials four and Complete all 17, and an extra one costs $15 per user per month. Confirm that the quoted plan includes the feature, and ask whether an admin can turn on a requirement for all users.

eImmigration also offers single sign-on with Google or Microsoft Azure AD. A firm on Google Workspace or Microsoft 365 can then manage staff access from accounts it already controls. Ask whether password sign-in can be switched off once SSO is on. With it off, a disabled Google or Microsoft account can no longer start a new session. Ask separately how sessions and tokens that are already open get revoked.

Password rules deserve one question. eImmigration lists password requirements, periodic resets and automatic lockout after repeated failed logins. NIST SP 800-63B-4, the federal digital identity guideline, handles resets another way. It tells systems to check new passwords against a blocklist of common and compromised ones, and to force a change when there is evidence of compromise instead of on a schedule. The guideline doesn't bind law firms, but it is a reasonable benchmark. Ask whether an admin can set the reset interval and whether new passwords are screened.

Inside the firm, the risk is a staff member opening files outside their work. At the portal, it is one client seeing another client's documents. Role permissions address both, and what matters is how finely they divide access. A useful set of roles restricts cases, documents and billing separately, and limits each portal login to that client's own matters.

Both vendors publish role controls at a summary level. eImmigration lists role-based permissions. Docketwise says admins set permissions for each user, and its Advanced plan adds multiple admins and permission groups. Neither page shows how far the roles go, so design the roles your firm needs first and confirm which plan supports them.

Offboarding is the same control at a different moment. When someone leaves, deactivating the account should end any session that is still open and let an admin reassign that person's cases. Neither security page describes this, so it belongs in the demo.

Encryption protects data that is intercepted in transit or taken from stolen storage. Both vendors state it. Docketwise names AES-256 and says the application is served entirely over HTTPS. eImmigration says client, case, form and practice data is encrypted at rest and in transit and doesn't name the algorithm, so ask for the cipher, the TLS version and who holds the keys.

eImmigration also gives each customer its own single-tenant database. Its June 2025 security post describes customer data as "physically separated from all other users, not just virtually partitioned." You can verify that design by asking whether uploaded files and backups are separated the same way. A multi-tenant product separates customers by other means, so compare the evidence each vendor gives for isolation and leave the architecture's name out of the scoring.

A backup has two jobs: surviving an outage and undoing a mistake. eImmigration describes continuous geo-replication on Microsoft Azure, with a maximum loss of "a few minutes" of work if the primary region fails. That covers the outage. Replication copies changes as they happen, so ask separately how a case deleted on Tuesday is restored as it stood on Monday, and how long earlier versions are kept.

Docketwise describes snapshot backups about every five minutes across multiple AWS availability zones. A snapshot is a copy from a moment in time, so the questions there are how long snapshots are kept and whether a single case can be restored from one. With either vendor, ask for the recovery point and recovery time as contract terms and for the date of the last restore test.

After an incident, an audit log can show who viewed or exported a file, if it records those events. eImmigration's security post mentions "built-in admin controls, audit trails," and Docketwise's security page doesn't describe logs. In both cases ask which events are recorded, how long they are kept and whether an admin can export them. Sign-ins, views, downloads, exports and permission changes are the events to look for.

Outside testing tells you whether anyone besides the vendor has checked its claims. eImmigration lists annual penetration testing, a 24-hour technical incident response team, and GDPR and PCI DSS compliance. Docketwise says it scans for vulnerabilities with third-party tools. Neither page names an auditor or an audit report. Ask for a dated summary letter from the penetration tester, and for any independent report that covers the vendor's own application as well as its cloud host.

The response team works the incident. When your firm hears about it is a contract question, so the subscription agreement should give a number of days for notice and a named contact.

ABA Formal Opinion 477 is the reason to keep these answers on file. It lists the sensitivity of the information first among the factors that decide what security effort is reasonable. It names encryption and multi-factor authentication as available tools, and it tells lawyers to review a vendor's security and reassess it periodically. The ABA Model Rules are a framework each state adapts, so the binding confidentiality rule is your own state's.

The access and offboarding controls can be checked in a demo with two browsers open, one signed in as an admin and one as a test user, on a made-up case. Encryption, outside testing, log retention and incident notice are confirmed in documents and the contract. Have the admin require a second factor, and watch whether the test user is stopped until one is enrolled. Sign in as a paralegal-level user and try to open a restricted case, view billing and export the client list. Sign in to the portal as a test client and look for anything that belongs to someone else. Then deactivate the paralegal while that browser is still signed in. From that point the deactivated user should be unable to open or save anything. Ask how long an open session can last.

Finish with recovery and export. A document created minutes ago may not be in any backup yet, so ask the vendor to show a restore from an earlier backup, using a test document it prepared before the demo. Ask how far back a restore can reach. Export the test case, and check that the file opens without the product and includes the uploaded documents. eImmigration's pricing FAQ gives one copy of all data at no charge on cancellation, so the file format is the part to confirm.

A demo shows how a demo account behaves, so have the settings you saw confirmed for your plan in the contract. Because 2FA and SSO come from the same premium allotment as e-filing and billing, ask for the premium features and their costs in the quote. The same test client is useful for checking multilingual client intake, including which roles can open a client's original answers.