Have a security questionnaire to fill out?
Send us your firm's or client's questionnaire and we'll return it complete within three business days.
Security & Compliance
Built for data your clients trust you with.
Immigration cases involve some of the most sensitive personal information your clients will ever share. We treat it like it's our own — and we document everything so your IT, malpractice carrier, or enterprise procurement team has what they need.
01 · The short version
What this means in plain English.
If you're an attorney evaluating GentleCase, here's what matters in three sentences. The technical detail is below, for your IT review.
Encrypted, end to end.
Every piece of client data — names, A-Numbers, passport numbers — is encrypted while it sits on our servers and while it travels over the wire. We can't read it. Neither can anyone else.
Documents stay isolated.
Client uploads — passports, birth certificates, RFE responses — go directly to secure cloud storage, separate from our application. The file contents never sit on our app servers.
Every action is auditable.
Status changes, document uploads, and messages are logged with the actor, timestamp, and IP address. Answer any malpractice or compliance question with one query.
02 · Access
Who sees what, and how they sign in.
Everyone who touches a case has a role, and every role sees only what it should. Access is assigned per case — not granted firm-wide by default.
Partner
Full access to every case, billing, and firm settings. Assigns roles and exports the audit log.
Associate
Full access to assigned cases — clients, documents, filings, and messaging. No firm-wide settings.
Paralegal
Works assigned cases day to day: prepares forms, uploads documents, drafts messages for attorney review.
Admin
Manages users, roles, and billing. Sees case metadata and the audit trail — not privileged case contents.
Forced password change on first loginConfigurable session timeoutOptional firm-wide MFASAML SSO on Enterprise
Log in to your firm →03 · The technical detail
For your IT review or vendor questionnaire.
If your firm runs a security review — or you're working with a malpractice carrier, large client, or enterprise procurement team — here's the full posture in one place.
Encryption
At rest
AES-256, with field-level encryption for SSN, passport numbers, and A-Numbers
In transit
TLS 1.3 on all connections, with HSTS enforced
Key management
Encryption keys held in a managed key vault, with periodic rotation
Hosting & data residency
Region
U.S. cloud regions (East / West) Custom region available on Enterprise
Tenancy
Logical multi-tenancy with strict per-firm data segregation
Document storage
Time-limited signed URLs; documents never pass through application servers
Backups
Encrypted, geo-redundant backups with point-in-time recovery
Access control
Roles
Partner, Associate, Paralegal, and Admin — with granular per-case assignment
Authentication
Forced password change on first login; configurable session timeout
Single sign-on
SAML SSO + SCIM provisioning Enterprise plans
Multi-factor authentication
Optional firm-wide MFA enforcement
Audit logging
Logged events
Every status change, view, upload, deletion, and message
Recorded fields
Actor, timestamp, IP address, action, and target record
Retention
2 years on Pro; up to 7 years on Enterprise
Export
Full audit log export available on request
Compliance
SOC 2 Type II
Third-party audit in progress · Q3 2026 Not yet certified
GDPR
Data subject access & deletion request workflow
CCPA
California consumer privacy rights honored
BAA / DPA
Signed Business Associate & Data Processing Agreements available
Data lifecycle & incident response
Right to deletion
Honored on request; verifiable destruction certificate available
Retention policy
Configurable per firm
Vulnerability management
Quarterly penetration testing; ongoing vulnerability scanning
Incident response
24-hour breach notification commitment to affected firms
04 · Documents
Agreements & policies on request.
The paperwork your firm or your client's procurement team will ask for. Available on request — most firms get the package signed within a week of asking.
Data Processing Agreement (DPA)
Standard DPA for GDPR / CCPA workflows
Business Associate Agreement (BAA)
Available for firms with regulated data needs
Privacy Policy
What we collect, why, and how long we keep it
Terms of Service
Service terms, SLA, and liability framework
Sub-processor list
Third-party vendors that touch firm data
Incident response policy
Notification timeline and escalation path