Secure Client Document Upload Portal for Immigration Firms
What a secure client upload portal for immigration documents needs: encryption, firm and case isolation, client-only access, no AI training. A 2026 checklist.
The short answer
A secure immigration upload portal encrypts files at rest and in transit, scopes every file to the firm and the client's own case, lets the client upload but not browse, and sends files to AI only through business APIs whose terms exclude training. For EB-1A and O-1 evidence that feeds the petition, we recommend Immigration Copilot: clients upload straight into their own case, files are encrypted with AES-256 at rest and TLS in transit, and every query and file path is scoped to your firm and case. It holds no SOC 2 attestation; if you need one, ask vendors for the report.
Disclosure: Immigration Copilot is our product. Competitor details come from each vendor's public pages as of October 2026.
Count what an EB-1A client actually sends. Passport bio pages. Pay stubs and offer letters with salary. Tax returns. Marriage and birth certificates for derivatives. Then 30 to 200 pieces of career evidence on top.
At many firms, most of it still arrives by email. That is the problem a portal solves.
Why Email Fails as a Document Intake Channel
Email creates copies. The client's sent folder, your inbox, the paralegal it was forwarded to, the phone that synced it, the backup of that phone. Each copy is outside the controls you set for client files. One misdirected forward, and a passport scan is in the wrong inbox for good.
Email also loses structure. Attachment size limits split the evidence across a dozen messages. Filenames like "scan0003.pdf" tell nobody whether it is the award certificate or the translation of it. Under 8 CFR 103.2(b)(3), any foreign-language document submitted to USCIS needs a full English translation with the translator's certification, so the original and its translation have to stay paired.
Eight Controls to Require in an Upload Portal
| Control | Why it matters for immigration files | Question to ask the vendor | Immigration Copilot |
|---|---|---|---|
| Encryption at rest | Passports, salaries and family records sit on the server for years | Which algorithm, and who holds the keys? | AES-256 |
| Encryption in transit | Uploads from home Wi-Fi and phones | Is TLS enforced on every upload and download? | TLS |
| Firm isolation | Multi-tenant software holds many firms' clients | How is one firm's data kept from another's, at query level? | Every query and file path scoped to your firm |
| Case isolation | One firm, many clients | Can a client account reach another case? Show me. | Every query and file path scoped to the case |
| Client role limited to upload | Clients should add evidence, not browse the firm's files | What exactly can the client role see and do? | Clients upload to their own case only |
| Staff roles | Paralegals and attorneys need different access | Which roles exist, and who can change them? | Attorney, paralegal and client roles |
| No AI training on client files | Uploaded evidence often goes to an AI model next | Which model provider, and is no-training in the contract? | Business AI APIs whose terms exclude training on your data |
| Third-party audit | Some firms and corporate clients require it | Can you send a current SOC 2 Type II report? | No SOC 2 attestation |
The last row deserves a plain answer from every vendor. A missing badge on a web page is not proof of a missing audit, and a badge is not a substitute for reading the report.
Test isolation yourself
Create two test client accounts on two test cases. Upload a file as client A. Log in as client B and try to find it, by search, by URL and by guessing the file path. Then ask the vendor to explain what you just saw.
Portal Options Immigration Firms Use
Three kinds of products offer client upload. They solve different problems.
Case management portals. Docketwise has a client portal with document requests and multilingual custom intakes. LollyLaw has Client Bridge, with questionnaires in 20+ languages and texting. Mitratech INSZoom offers an HR portal for corporate contacts on its Enterprise tier and has previewed an AI client portal that extracts data from uploaded documents. These are the right home for intake questionnaires and form data. On security, Docketwise's public page describes AES-256 on AWS and two-factor authentication on every plan; LollyLaw describes multi-factor authentication and user permissions.
AI agents with intake. Parley offers client intake requests and email and calendar sync, and states SOC 2 Type II, GDPR compliance and no AI model training on its public site.
Petition-evidence upload. Immigration Copilot's client role uploads directly into the client's own case, and those files are what the system reads to draft the petition. Each document is classified, dated and tied to the person it is about. Certified translations, screenshots and scans are part of what it reads.
| Need | Best fit |
|---|---|
| EB-1A or O-1 evidence that feeds the petition draft | Immigration Copilot client upload (our pick) |
| Intake questionnaires, form data, multilingual clients | Docketwise or LollyLaw portal |
| Corporate HR contacts submitting for employees | Mitratech INSZoom HR portal |
| One AI system for intake, forms and drafting across visa types | Parley |
The Docketwise, LollyLaw, INSZoom and Parley comparison covers each vendor in depth, and our GDPR and SOC 2 client portal guide explains how to read a SOC 2 report.
Setting Up Client Uploads Without Creating New Risk
- Send one link, not a list of instructions. The client logs in to their own case and uploads there.
- Tell the client what not to send. Other people's passports, unrelated tax years, screenshots of chats with personal details.
- Pair originals with translations. Ask for the certified translation as a separate file next to the original.
- Turn off email intake for evidence. Keep email for the request; route files to the portal.
- Review roles every quarter. Departed staff and closed clients lose access.
- Write the AI question into engagement. Some clients will ask whether their files train AI. Have a one-sentence answer ready, based on your vendor's contract.
For the wider confidentiality setup, including how to handle general chatbots, see AI confidentiality for immigration attorneys.
Where Immigration Copilot Stops
It is not a case management, intake, forms, calendaring or billing system. Its client upload exists to get petition evidence into the right case. Keep your case management portal for everything else. For the full product view, see AI for immigration lawyers.
Frequently Asked Questions
Is Immigration Copilot SOC 2 certified?
No. It has no SOC 2 attestation. Controls are AES-256 at rest, TLS in transit, firm- and case-scoped access, role-based permissions and no-training AI APIs.
Can clients see other clients' documents in a shared portal?
They should not, and you should test it. In Immigration Copilot, clients upload to their own case only, and every query and file path is scoped to the firm and case.
Is email acceptable for sending passports and pay stubs?
It works, but it scatters copies outside your control. Use email for the request and the portal for the file.
Do uploaded documents get used to train AI models?
Not in Immigration Copilot: business AI APIs whose terms exclude training. Ask every vendor the same question and get it in the contract.
Do I still need a case management client portal?
Usually. Immigration Copilot handles petition evidence, not questionnaires, form data or invoices.
See the client upload and what happens to the files next. Book a demo, or download a sample cited petition built from an uploaded case file.
EB1A Practice Tips
Get bimonthly guides for immigration attorneys
Criterion deep-dives, workflow tips, and USCIS updates. No spam. Unsubscribe any time.
Immigration Copilot Editorial
EB1A & O-1 Practice Intelligence
In-depth analysis of AAO decisions, USCIS policy, and petition strategy for immigration attorneys handling extraordinary ability cases.
Sample output
See a petition where every sentence cites an exhibit
Two EB-1A criterion sections for a fictional researcher, with the exhibit list, the open questions sent back to the attorney and a sentence removed for lack of support.
Download a sample cited petitionRelated articles
