GDPR and SOC 2 Compliant Client Portals for Immigration Firms

Disclosure: Immigration Copilot is our product. It holds no SOC 2 report or GDPR certification, and the section about it lists its controls only. Third-party details come from each vendor's public pages as of October 2026.

A single EB-1A client file can hold a passport scan, an I-94, a decade of tax returns, a medical exam, and letters naming the client's family. That file now lives in whatever portal your firm chose. Most portal vendors say "secure," "encrypted," and "compliant" on the pricing page. Very few hand you a document that proves it.

This guide is for immigration attorneys and firm operations staff choosing or re-checking a client portal in 2026. It covers what SOC 2 actually certifies, when GDPR reaches a US immigration practice, how the ABA's confidentiality rules shape vendor diligence, and a checklist you can send to any vendor this week.

SOC 2 Is an Auditor's Opinion, Not a Certificate

SOC 2 is an attestation report issued by a licensed CPA firm under standards set by the American Institute of Certified Public Accountants (AICPA). The AICPA's guide for these engagements covers controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy, the five Trust Services Criteria categories. A vendor chooses which categories are in scope. Security is the baseline. A portal holding client evidence should also include confidentiality, and ideally availability.

There are two report types. The Journal of Accountancy, the AICPA's own publication, describes the split this way:

• Type I: an opinion on the system description and the suitability of control design "as of a specified date."
• Type II: the same opinions plus an opinion on the operating effectiveness of the controls "throughout a specified period." AWS, for example, issues its SOC 2 reports on 12-month periods ending March 31 and September 30.

A Type I tells you the vendor wrote good policies on a Tuesday. A Type II tells you whether anyone followed them for a year.

The full SOC 2 report is a restricted document. The AICPA describes SOC 3 as the version that covers the same categories but does not provide the same level of detail, which is why SOC 3 reports can be freely distributed. In practice that means the SOC 2 report itself arrives under a nondisclosure agreement. AWS states plainly that an NDA is required to review its SOC 1 and SOC 2 reports.

What SOC 2 does not tell you

It does not mean the vendor is "SOC 2 certified" in any licensing sense. There is no government registry. It does not cover sub-processors unless the report says so (many reports use a "carve-out" method, which excludes them). It says nothing about GDPR, attorney ethics rules, or whether the vendor's AI provider trains on your data. And quality varies. In 2026 the Journal of Accountancy reported concerns about vendors promising "fast and easy" SOC reports, with one practitioner describing template reports that are "all exactly the same, with a different client logo on it." The AICPA itself now says it is looking into allegations about a compliance vendor's SOC practices and will act where auditors were unlicensed or skipped peer review.

So the report matters, and so does who wrote it.

When GDPR Reaches a US Immigration Firm

Most US immigration firms have no EU office, so the question is Article 3(2). GDPR Article 3(2) applies to a controller not established in the Union when its processing relates to "the offering of goods or services... to such data subjects in the Union" or "the monitoring of their behaviour as far as their behaviour takes place within the Union."

Two facts drive the answer: where the client is when you serve them, and whether you meant to serve people there.

The European Data Protection Board's Guidelines 3/2018 on territorial scope are the most useful reading here. Three points from the final version:

1. Location, not citizenship. The EDPB says the nationality or legal status of a person in the Union "cannot limit or restrict the territorial scope." A Brazilian researcher living in Munich counts.
2. Targeting must be intentional. A service offered only to people outside the EU that keeps working when they travel to the EU is not targeting. The EDPB's example is a US news app used by a US tourist in Europe, which is outside GDPR.
3. A website alone is not enough. Recital 23, as quoted by the EDPB, says mere accessibility of a website or an email address does not by itself show intent to offer services in the Union. Marketing in an EU language, mentioning EU clients, or pricing in euros can.

For an immigration practice, the realistic triggers look like this. You run campaigns aimed at European scientists considering O-1 or EB-1A. You onboard a client who lives in Amsterdam and collect her documents through your portal while she is there. Your intake form invites "researchers in the EU" to book a consult. In those cases, assume GDPR applies to that processing and plan accordingly.

A firm in scope under Article 3(2) generally must also designate a representative in the Union under Article 27, unless processing is occasional and does not include large-scale special category data. Many small firms miss this one.

What GDPR Requires From Your Portal Vendor

Under GDPR, your firm is the controller. The portal vendor is a processor. Article 28 says a controller may use only processors "providing sufficient guarantees" of appropriate technical and organisational measures, and requires a binding contract, usually called a data processing agreement (DPA). The contract must cover, among other things:

• processing only on your documented instructions, including for transfers outside the EU
• confidentiality commitments from everyone at the vendor who touches the data
• the security measures required by Article 32
• no new sub-processor without your prior written authorization, with notice and a chance to object under a general authorization
• help with data subject requests, such as access and erasure
• deletion or return of all personal data at the end of the service
• making available "all information necessary to demonstrate compliance" and allowing audits

Article 32 names encryption and pseudonymisation as example measures, along with the ability to restore access after an incident and "a process for regularly testing, assessing and evaluating" security. A SOC 2 Type II report is one of the more practical ways a vendor can show you that last item.

On breaches, Article 33 gives the controller 72 hours to notify the supervisory authority where feasible. The processor must notify the controller "without undue delay." Your DPA should turn that phrase into a number of hours. Your 72-hour clock depends on it.

Transfers: the Data Privacy Framework and its limits

Sending an EU client's documents to a US server is an international transfer. The cleanest route is the EU-U.S. Data Privacy Framework (DPF). The EDPB's DPF FAQ for European businesses (version 2.0, adopted January 15, 2026) explains that the European Commission adopted the adequacy decision on July 10, 2023, that the DPF is a self-certification mechanism, and that certifications must be renewed annually. Before relying on it, the exporter must check the Data Privacy Framework List maintained by the US Department of Commerce, which also shows companies that have been removed.

Two practical notes. First, the DPF covers the vendor only if the vendor itself is on the list, and only for the data types its certification covers. Second, a vendor not on the list can still use other Chapter V tools, most often Standard Contractual Clauses. AWS, for instance, states that its service terms include the SCCs adopted by the European Commission in June 2021 and that they apply automatically to customer data transferred outside the EEA.

Finally, be skeptical of "GDPR certified." Article 42 allows certification mechanisms, but a certification "does not reduce the responsibility of the controller or the processor." Ask for the DPA instead.

For the upload side specifically (encryption, firm and case isolation, client-only access, no model training), we keep a separate checklist: what a secure client document upload portal needs.

ABA Rule 1.6(c) Applies Whether or Not GDPR Does

GDPR may never touch your practice. The ethics rules always do. ABA Model Rule 1.6(c) requires a lawyer to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Your state's version of the rule is the one that binds you.

The ABA has written three opinions that bear directly on choosing a portal.

Formal Opinion 477R (2017). Opinion 477R says what counts as reasonable efforts is "not susceptible to a hard and fast rule" and depends on the sensitivity of the information, the methods used, and the safeguards available. It also says particularly strong measures can be warranted for highly sensitive information. An asylum declaration is highly sensitive information.

Formal Opinion 483 (2018). Opinion 483 addresses obligations after a data breach, including the duty to tell current clients when material client information is compromised. You cannot meet that duty if your vendor's contract lets it stay silent.

Formal Opinion 512 (2024). For portals with AI features, Opinion 512 says a client's informed consent is required before a lawyer inputs representation information into a self-learning generative AI tool, and that "general, boiler-plate provisions" in an engagement letter are not enough. A vendor that does not train on client data removes the self-learning problem. It does not remove your duty to understand the tool. Our guide to AI confidentiality setup for immigration practices walks through Opinion 512 in more detail.

The Vendor Due Diligence Checklist

Send this table to every portal vendor on your shortlist. Ask for a document or a screenshot for each row, not a yes.

Control	What to require	How to verify
SOC 2 report	Type II, period ended within the last 12 months, security plus confidentiality in scope	Read the report under NDA; check the auditor's opinion and period dates
Bridge letter	Covers the gap from audit period end to today	Signed letter from vendor management
Encryption at rest	AES-256 or equivalent for stored files and database	SOC 2 control description or security whitepaper
Encryption in transit	TLS 1.2 or higher on every connection	Run the portal URL through a TLS checker
SSO and MFA	MFA available for every user, enforceable by the firm; SAML SSO for larger firms	Admin settings screenshot
Role-based access	Clients see only their own case; paralegals and attorneys have distinct permissions	Demo with a test client account; try opening another case URL
Tenant isolation	Firm data separated from other firms at the application and storage layer	Ask how queries are scoped; look for it in the SOC 2 system description
Audit logs	Who viewed, uploaded, downloaded, or deleted which file, and when	Ask to see a sample export
Retention and deletion	Defined retention after cancellation; deletion on request, including backups on a stated schedule	DPA clause plus privacy policy
Sub-processor list	Named list of every company that touches client data, with notice of changes	Public page or DPA annex
DPA	Article 28 terms if you serve anyone in the EU; a confidentiality addendum otherwise	Signed copy in your vendor file
Breach notification	A fixed number of hours, not "without undue delay"	DPA clause
AI training opt-out	Written commitment that client documents are never used to train any model, including third parties	Terms of service, DPA, and the AI provider's own terms
Data residency	Region where files and backups are stored; EU hosting if your EU clients require it	SOC 2 system description or written confirmation
Transfer mechanism (EU clients)	Active DPF certification or SCCs	Check the DPF List yourself

For the AI-specific side of the same decision, our 2026 comparison of AI tools for immigration attorneys covers which tiers come with contractual data protections and which do not.

Seven Red Flags in a Vendor Security Page

Some answers end the conversation early.

• The vendor says it is "SOC 2 compliant" but cannot produce a report, only a badge.
• The only report on offer is Type I, and it is more than a year old.
• "We use AWS, so we're SOC 2." The cloud provider's report covers the cloud provider. AWS lists which of its own services are in scope on its SOC services-in-scope page. It says nothing about the application built on top.
• No sub-processor list, or a list that leaves out the AI model provider.
• The privacy policy allows use of "content" to "improve our services," with no carve-out for model training.
• No DPA, or a DPA that only the vendor can amend.
• The audit firm is unknown, has no public peer review history, and turned the report around in weeks. Ask.

None of these proves the vendor is unsafe. Each one shifts the burden back to the vendor to show you why it is.

How to Read a SOC 2 Report in 30 Minutes

A SOC 2 Type II report runs dozens to hundreds of pages. You do not need to read every control. Read these parts, in this order.

1. The auditor's opinion (usually the first section). Look for an unqualified opinion. A "qualified" opinion means the auditor found something serious enough to carve out of its conclusion. Note the CPA firm's name and look up its peer review.
2. The period. Check the start and end dates. If the period ended eight months ago, you need a bridge letter. AWS calls its version a SOC Continued Operations Letter and updates it monthly; most smaller vendors issue one on request.
3. The system description and scope. Confirm the product you are buying is in scope. A vendor sometimes audits its core platform and leaves out the newer AI feature or the mobile app. Read which Trust Services categories were included.
4. Complementary subservice organizations. This lists the carved-out vendors, typically the cloud host and sometimes the AI provider. Each one is a sub-processor you should see on the DPA list too.
5. Testing results and exceptions (usually the last major section). Search the PDF for "exception" and "deviation." One missed quarterly access review is common and usually minor. Repeated failures in access removal, change management, or encryption are not. Read management's response to each exception.
6. Complementary user entity controls. These are the things the vendor expects your firm to do: enforce MFA, remove departed staff promptly, review access. If you skip them, the report's assurance does not cover you.

One more test. Search the report for "client" and "customer data" and see how the vendor describes data deletion. If the system description never mentions deletion, ask how it works before signing.

What Immigration Copilot Does and Does Not Claim

We get asked this, so here is the plain version. Immigration Copilot is a petition-drafting platform for EB-1A and O-1 attorneys, not a general client portal or case management system; clients get a role so they can upload evidence to their own case. It does not hold a SOC 2 report today. We do not claim SOC 2 certification or attestation, and we do not claim any GDPR certification. Our privacy policy describes our practices as SOC 2-aligned. That describes intent, not an auditor's opinion. If your firm requires a vendor with a Type II report on file, we do not meet that requirement yet, and you should weigh that.

Here is what the product does today, from our code and policy rather than marketing copy.

• Firm-level tenant isolation. Each firm is its own organization. Every database query function in our codebase takes the firm's organization ID as a required parameter, and a record from another firm comes back as "not found."
• Clients see only their own case. A firm member is either an attorney (staff) or a client. The client role can view case status and the document checklist, upload documents, and read only the documents that client uploaded. A request for someone else's case or upload returns the same 404 as a missing record, so ids cannot be probed.
• Direct-to-storage uploads with short-lived links. Client files go from the browser straight to Amazon S3 using a presigned upload URL that expires after five minutes and is scoped to that firm's and that case's storage path.
• Encryption. Our privacy policy states that data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. The document bucket has versioning on, and in production it accepts browser uploads only from our own domains.
• No training on client documents. Client documents, drafts, and knowledge bases are not used to train any AI model, including third-party models. AI processing runs on Amazon Bedrock. AWS's Bedrock documentation states that model providers have no access to customer prompts and completions.
• Logs without client content. Our logger redacts patterns such as Social Security numbers, A-numbers, and passport numbers, and our rules forbid logging document text, prompts, or AI responses.
• Activity history. The platform records an activity log of attorney-visible events, including client invitations.
• Named sub-processors and retention. The privacy policy lists AWS (infrastructure and AI inference), Clerk (sign-in, account data only), and Google Analytics (usage analytics, no document content). Documents and petitions are retained for the subscription plus 90 days after cancellation, then deleted.

For the third parties we rely on, the public record is better documented than ours. AWS lists Amazon S3, Amazon Bedrock, AWS Lambda, and Amazon RDS as in scope for its SOC reports. Clerk states on its own site that it has been SOC 2 Type 2 certified since May 6, 2022 and self-certifies under the EU-U.S. DPF. Neither fact makes Immigration Copilot itself audited.

What we do not offer yet: SAML single sign-on, mandatory MFA for every account, a choice of hosting region, and a published standalone sub-processor page. If your firm serves EU-resident clients, talk to us about DPA terms before you upload their files.

If you want to run the checklist above against us, contact us and we will answer each row in writing.

What to Do This Week

1. List every system that holds client documents: portal, case management, email, e-signature, AI tools.
2. Send the checklist table to each vendor. Give them two weeks.
3. Ask for SOC 2 Type II reports and bridge letters, and read the five sections above.
4. Decide whether any of your clients are in the EU when you serve them. If so, get a signed Article 28 DPA and check the DPF List.
5. Update your engagement letter if any portal uses generative AI, using a specific explanation rather than boilerplate, per Opinion 512.
6. Put next year's review date on the calendar.

More on choosing and running practice systems lives in our attorney efficiency hub, and our frank assessment of AI safety in immigration practice covers the hallucination side of the risk. If you want to see how Immigration Copilot handles client uploads, book a walkthrough.