SECURITY & DATA

Where your case data actually lives.

ImmiFlo is architected so that your case files never leave your device by default, and anything we do store server-side is designed to stay within the United States. Below is the specific, honest breakdown — not marketing language.

How your data moves

01

Your files stay on your device

Import, evidence indexing, and consistency checks run entirely on your Windows machine, in a local database. No account required, no upload.

02

You opt in, per action, to send text

Only when you use an AI feature (assessment, drafting, RFE analysis) does ImmiFlo send the necessary extracted text — never the raw file — over an encrypted connection.

03

Processing, not retention

That text is used to generate the requested output and is not retained by ImmiFlo for training or any other purpose beyond serving your request.

EX. STORED

What we store, server-side

usersEmail address, account settings
billing_purchases / case_entitlementsPurchase records, keyed by case_key (a random ID) — not by case content
ai_usage_logsWhich AI feature was used, token counts, cost — not the input/output text
desktop_eventscase_key + event name (e.g. "index exported") — structured, no file names or content
uscis_case_trackingsUSCIS receipt number, for opt-in automatic status polling
EX. NOT STORED

What we never store

  • Your original case files, evidence documents, or scans
  • Applicant names, employer names, or other content extracted from documents
  • File names or folder paths
  • Drafted petition or RFE response text, once generated
SUB-PROCESSORS

Who else touches your data, and why

A vendor's SOC 2 certification is not the same as ours. We list it here because it's a real, verifiable signal about the infrastructure we build on — not a substitute for our own compliance work.

AWS (us-east-1)
Application hosting, database
SOC 2 Type II
Cloudflare
DNS, CDN, installer distribution (R2)
SOC 2 Type II
Stripe
Payment processing
SOC 2 Type II
Resend
Transactional email delivery
OpenRouter + upstream model providers
AI drafting, extraction, and analysis (only when you use an AI feature)
PostHog (US Cloud)
Product analytics
SOC 2 Type II
COMPLIANCE ROADMAP

ImmiFlo's own SOC 2 Type II certification is in progress, not yet completed. We rely on infrastructure providers who are already SOC 2 Type II certified (see above), but that does not itself make ImmiFlo certified. We'll update this page the moment our own audit completes.

ImmiFlo is not a law firm and does not provide legal advice. See our Terms of Service and Privacy Policy for the complete legal terms.

← Back to ImmiFlo