What security features should immigration case management software have?

A single adjustment of status package concentrates almost every category of regulated personal data in one record. USCIS instructs that "When you file Form I-485, you must also submit Form I-693, Report of Immigration Medical Examination and Vaccination Record," and applicants filing online must open the civil surgeon's sealed envelope and upload that medical form with the package [4]. The same file carries the client's A-Number, identity documents, and financial records [4]. In immigration court, EOIR's electronic filing system has been mandatory since February 11, 2022, and registered attorneys use it to file documents and download electronic records of proceedings [5]. One login to a case management system therefore opens a client's full identity record, and often a family's.

What the confidentiality rule requires

Model Rule 1.6(c) states that "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client" [1]. Comment 18 names no specific technology and instead lists non-exclusive factors: the sensitivity of the information, the likelihood of disclosure without additional safeguards, the cost and difficulty of those safeguards, and the extent to which they would adversely affect the lawyer's ability to represent clients [1]. Sensitivity leads that list, which puts an immigration practice at a higher setting than a general commercial firm.

The duty follows the data to the vendor

Buying software is a supervision decision. Opinion 477R instructs lawyers to "Conduct Due Diligence on Vendors Providing Communication Technology," because Model Rule 5.3 requires reasonable efforts to ensure a nonlawyer's conduct is compatible with the lawyer's professional obligations [1]. Colorado holds that "A lawyer must make reasonable efforts to prevent, monitor for, halt, and investigate any security breach of data the lawyer controls" [2], and California requires "a reasonable inquiry to determine the extent and consequences of the breach" plus notice to any client whose interests have a reasonable possibility of being negatively impacted [3].

Encryption

Ask for the algorithm and the protocol version, because every vendor in this category says its data is encrypted. Docketwise's security page states that data is "encrypted with 256-bit keys (AES-256)" and that the product "is served 100% over https" [9]. eImmigration by Cerenade's security page describes data encrypted "using the same security protocols employed by banks and governments," whether "sitting in your database or in transit between systems," without naming an algorithm or a TLS version as of July 2026 [6]. The second wording is common in this market and is not disqualifying; the difference is what a buyer can check. Four follow-ups close the gap: which cipher and TLS version, who holds the keys and how often they rotate, whether documents and backups get the same treatment, and which internal roles can decrypt production data.

Multi-factor authentication and single sign-on

Require MFA that an administrator can force firm-wide, and confirm the price before signing. As of July 2026, eImmigration's pricing page lists "2FA & SSO Advanced Authentication" among 17 premium features, with Starter at $60 per user per month including one premium feature and Complete at $110 including all of them; extra premium features run $15 per feature, per user, per month on the lower plans [8]. Docketwise's security page says two-factor authentication is "available on all pricing plans" [9]. Those are two published positions, not a ranking, and the reason to check yours is the failure mode: the April 2026 incident described below began with valid credentials, not a software flaw [11].

Password policy, lockout, and offboarding

eImmigration's security page describes controls that require strong passwords, force resets at set intervals, and lock a user out after repeated incorrect attempts [6]. Ask about session timeout, whether access can be limited by device or network, and how fast a departing paralegal's account can be disabled and their sessions ended.

Tenant isolation

Isolation is what stops one customer's data from surfacing in another customer's account, and vendors implement it very differently. eImmigration publishes one of the more specific architectures in this category: its security page states that "Your data is housed in a single-tenant database, separate from any other eimmigration customer," and its June 2025 post adds that data is "physically separated from all other users, not just virtually partitioned" [6][7]. Most legal software is multi-tenant with logical separation, which is not unsafe by itself, so the useful question is how the boundary gets enforced and verified. Ask whether each customer gets a separate database, schema, or row-level filter, and how the vendor tests that a bug cannot cross the line.

A cloud host's certifications are not the vendor's

Docketwise's help center article on data security says the product "stores client data on Amazon S3 (AWS Cloud Storage)" and lists "SOC 1, 2 and 3 Certified" among the attributes of that storage service [10]. eImmigration's security page states that the product is "built on Microsoft Azure" [6]. In both cases the named infrastructure controls belong to the hosting provider, which leaves the vendor's own application code, staff access model, and change management unaddressed. Ask whether those have ever been audited by a third party, and by whom.

Ask for the report, then read the scope

Request the vendor's own SOC 2 Type II report or ISO 27001 certificate, with the audit scope, observation period, and any exceptions the auditor noted, and expect to sign an NDA to see it. As of July 2026, neither eImmigration's security page nor its "Built to Protect" post uses the term SOC 2, and the security page states that the product "is fully compliant with GDPR" and with PCI DSS without publishing a report, an assessor name, or an attestation date [6][7]. Those frameworks cover different subject matter than US attorney confidentiality, so neither answers the Rule 1.6(c) question on its own [1]. Treat a compliance sentence as a claim to be evidenced, for every vendor, including the one already in use.

Role-based permissions

Permissions should map to the roles a firm actually staffs, because immigration practices run on paralegals, accredited representatives, interpreters, and file clerks who do not need identical access. Docketwise's security page says multiple administrators and permission groups can be configured on its Advanced plan [9], and eImmigration's security page describes admin controls that set visibility on a need-to-access basis [6]. Test this in the trial: create a paralegal-level account, then try to open a sealed matter, download a passport scan, and view a trust ledger. Whatever that account can reach is the real permission model.

Audit logs

Logs are what turn an incident into an answerable question, and the ethics rules assume they exist. Colorado requires a lawyer to investigate a breach and California requires a reasonable inquiry into its extent, neither of which is possible without a record of who touched what [2][3]. eImmigration's June 2025 post lists "Activity tracking and audit logs" among the core features to expect from any secure platform [7]. Push for the specifics a marketing page will not carry: whether the log captures views and downloads or only edits, how long it is retained, whether a firm administrator can export it, and whether anyone inside the vendor can alter it.

Client portal and document exchange

The portal is where the most sensitive documents enter the system, often from clients using a shared phone or a family email address. Confirm that portal access is individually authenticated instead of a shared link, that upload links expire, and that the platform never emails case documents as plain attachments. Ask what happens to a portal account after a matter closes, because a dormant account with a stale password is still a live entry point into the file [11].

Backups and geo-redundancy

Require two numbers in writing: the recovery point objective, meaning how much work can be lost, and the recovery time objective, meaning how long the firm is down. Vendors describe this loosely. eImmigration's security page says its "on-the-fly data geo-replication processes mean that no matter what disasters come your way, you can never lose more than a few minutes of progress" [6]. Docketwise's security page says data is "continuously backed-up via AWS Elastic Beanstalk snapshots every ~5 minutes" and that its infrastructure and data "are spread across multiple AWS availability zones" [9]. Both are published statements, and neither is a contract term. Ask when the last full restore was tested, who performed it, and whether the firm can pull its own independent copy on a schedule it controls.

Penetration testing and vulnerability management

An annual test by an outside firm is the baseline, and the evidence is the part to insist on. eImmigration's security page claims "annual cybersecurity penetration testing" and a "24x7x365 Security Response" team [6]; Docketwise's security page says it "uses third party security tools to continuously scan for vulnerabilities" and describes an incident response protocol covering escalation, mitigation, and post-mortem [9]. Neither page published a test report or a tester's name as of July 2026 [6][9], which is normal here and is why the request should be made privately. Ask for the date of the most recent application-scoped test, who ran it, findings by severity, and confirmation that high-severity findings were closed.

Data export, portability, and deletion

Settle export and deletion before signing, because a firm has no bargaining power the day it decides to leave. As of July 2026, eImmigration's pricing FAQ states that on cancellation "You may export one copy of all your data for no charge. Additional copies will incur a cost, depending on the size of your database" [8]. Whatever a vendor answers, pin down what "all your data" covers, because matter records, documents, notes, billing history, and audit logs are separate exports, and a CSV of case rows without the document store is not a migration. Ask in the same breath how deletion is certified and how long deleted records survive inside backup snapshots.

Breach notification, in the contract

The ethical duty to notify clients belongs to the lawyer, so the contract has to deliver the facts in time to act on them. ABA Formal Opinion 483, quoted by the California committee, holds that "lawyers must employ reasonable efforts to monitor the technology and office resources connected to the internet, external data sources, and external vendors providing services relating to data and the use of data" [3]. Colorado adopts the same opinion's definition of a breach and requires timely notice to current clients [2]. Neither standard survives a vendor's discretionary disclosure schedule.

One documented sequence to read before you negotiate

In April 2026, DocketWise notified individuals whose data was held by a portion of its immigration law firm customers. In the company's own notice, DocketWise says its forensic investigation confirmed that "an unauthorized actor(s) used valid credentials to clone certain third-party partner repositories, some of which were used as part of a data migration pipeline for the DocketWise application" [11]. Impacted information varied by individual and could include Social Security number, passport number, financial account number, tax identification number, and medical condition or treatment information; letters were mailed beginning April 3, 2026 [11]. The notice also reports no evidence of ongoing unauthorized activity, no evidence that personal information was published, and that DocketWise notified the FBI [11]. ComplexDiscovery's account of the incident puts the total at 116,666 individuals, with the compromise dated on or around September 1, 2025 and the scope confirmed on February 19, 2026 [12]. That sequence is a diligence fact rather than a verdict on any product, since any cloud vendor can end up on the receiving end of one. What it argues for is contract language: notice within a defined number of hours or days of discovery, an obligation to identify which of the firm's own records were affected, access to the forensic findings, and cooperation with client notifications.

A single-tenant database costs something

Dedicated databases usually carry a higher price and can mean slower feature releases, because the vendor maintains more instances. A well-run multi-tenant platform with tested logical isolation and a current SOC 2 Type II report can be the safer purchase than a single-tenant claim with no external audit behind it, so the comparison worth making is between the evidence each vendor can produce.

An attestation is scoped, and the scope is the point

A SOC 2 Type II report describes whether specified controls operated over a stated period. It can exclude the module a firm cares about and it can carry exceptions, so the scope section is the part of the report that produces information. Retention settings deserve the same scrutiny, because audit logs held for years also become discoverable material about how a firm handled a matter.

Controls create friction for the people doing the work

Comment 18 counts difficulty of implementation and the effect on a lawyer's ability to represent clients among the reasonableness factors, an acknowledgment that controls have costs [1]. Enforced MFA is harder in a legal-aid clinic where volunteers rotate weekly and share a workstation, so the answer is usually a different MFA method rather than an exemption.

The most-audited vendor is not automatically the right one

Rule 1.6(c) asks for reasonable efforts, not maximum security [1]. A general practice platform with a thicker compliance binder may lack the USCIS form library an immigration practice runs on, while a specialized vendor with thinner paperwork may fit the work better. Documenting the comparison on both axes is what makes the decision defensible.

It is not a substitute for firm-side practice

Opinion 477R's obligations run past software selection: understand how client information is transmitted and where it is stored, label privileged communications, and train lawyers and nonlawyer assistants in information security [1]. A platform with strong controls still fails if a caseworker emails an unencrypted I-589 draft from a personal account.

It is not statutory breach compliance

Ethical notification duties and state breach-notification statutes are separate obligations, and Colorado's opinion says so directly while pointing lawyers to their own state's statutory requirements [2]. A vendor saying it handled notification does not discharge the firm's duty to its clients under the ethics rules [3].

It is not immunity from a vendor-side incident

The DocketWise notice describes credentials at a third-party partner repository as the entry point rather than a flaw in the application a firm logged into [11]. Diligence lowers the probability and, more reliably, shortens the gap between a vendor's discovery and a firm's ability to tell clients something accurate [2][3]. Comment 18 frames reasonableness against evolving threats, so re-running these questions at renewal keeps the file current [1].