Privacy Policy

SOF Suite provides source-of-funds software to EB-5 immigration law firms (“firms”). This policy explains what information we collect and how we handle it.

For case data uploaded into the platform, the firm is the data controller and SOF Suite acts as a processor, handling that data only on the firm’s instructions.

• Account information — name, work email, firm, and role of the attorneys and staff who use SOF Suite.
• Case data — the investor identity details and financial and immigration documents a firm uploads for processing (bank and brokerage statements, tax records, identity and travel documents, and similar), which may contain personal and sensitive information about the firm’s clients. SOF Suite processes this content on the firm’s instructions; by default it is kept in storage the firm controls and is not stored on SOF Suite’s servers (see “Storage & security” below).
• Usage & device data — log data, IP address, and browser information, used for security, reliability, and support.

We use information to operate the platform — intake, document classification, declaration drafting, exhibit lists, binders, and filing-packet assembly — and to secure, support, and improve the service.

We do not sell personal information, and we do not use a firm’s client case data to train third-party foundation models.

Document text and case data may be processed by AI models — both our own pipelines and vetted third-party model providers — to extract, classify, and draft materials. These providers act as subprocessors under contract and do not retain your data to train their models. Every AI output is a draft for attorney review, never a final filing.

By default, SOF Suite runs local-first: uploaded documents and case content are kept in storage the firm controls, not on SOF Suite’s servers. Our servers retain only per-case metadata — the case name, status, and progress — in per-organization isolated storage in the United States, protected by encryption in transit, access controls, and strict tenant isolation so one firm can never access another firm’s data. See our Security overview for details.

We share data only with subprocessors that help us operate the service (such as cloud hosting and AI model providers), when required by law, or at the firm’s direction. We never sell or rent personal information.

Because case content is kept in storage the firm controls, the firm decides how long it is retained and can delete it at any time. On our servers we retain only the case metadata described above for as long as the firm maintains its account or as set out in the firm’s agreement, and we delete or return it on request. Backups of that metadata are purged on a rolling schedule.

Because firms control their clients’ case data, an end client’s privacy requests (access, correction, or deletion) are directed through the firm that represents them. Firm users may access and update their own account information, or contact us for help.

We may update this policy from time to time. We will notify firms of material changes, and continued use of the service after an update means you accept the revised policy.

Questions about privacy? Email [email protected].