The AAF Tool is a hosted web service that monitors case status for immigration law professionals. It provides secure storage for client information and uses that information to do regular checks of case status with the USCIS. Firms are alerted whenever a client’s case status changes.

SUMMARY OF OPERATION

Immigration law firms that use the AAF Tool are issued login credentials to the AAF Tool hosted service. Once logged in, they upload one or more spreadsheets with client information:

• A unique Client ID assigned by the firm.
• The Alien Number assigned to the client by USCIS.
• The Receipt Number for the client’s case assigned by USCIS.

The AAF Tool then uses the uploaded client information to check case status with the USCIS either once or on a regular basis, making the retrieved status available to the law firm via spreadsheet download. The AAF Tool also alerts the firm via email whenever one of their clients changes status.

CLOUD SERVICE AND DATA PROCESSING AGREEMENTS

Use of the AAF Tool is governed under our Cloud Service Agreement (sample CSA) and Data Processing Agreement (sample DPA). Firms which contract with ClickOneTwo receive cover sheets which customize the sample CSA and DPA to contain the latest terms and list of sub-processors.

PRIVACY POLICY

The material that follows gives you a plain-language overview of how ClickOneTwo Consulting LLC (“ClickOneTwo”) handles data in the AAF Tool. It is for information only. The legally binding terms are in the Cloud Service Agreement and Data Processing Agreement mentioned in the prior section. If anything here differs from those documents, they control.

What data we handle

• Firm-uploaded information. Your firm uploads a firm-assigned client identifier, plus USCIS Alien Numbers and Receipt Numbers. We treat everything your firm uploads as personally identifiable information (PII).
• Status information from USCIS. When the AAF Tool runs status checks on your behalf, the results we retrieve are stored for your firm and protected the same way as your uploaded data.
• Service logs. We keep logs of service behavior for maintenance. They are kept for one month and do not contain any PII, case status information, or information about your firm.
• Usage Data. We may analyze usage data to maintain and improve the AAF Tool.

We do not use any of your data to train AI or machine-learning systems. We do not share any of your data with other parties except as needed to run the service or as required by law.

What is sent to USCIS

To check case status, the AAF Tool submits clients’ Alien Numbers and Receipt Numbers to the USCIS Case Status API and other USCIS web-hosted services. These connections are encrypted in transit. USCIS is a government agency, not a ClickOneTwo subprocessor, and it handles the information under its own policies, which we don’t control.

Who can see your data

• Your Firm. Your firm is issued credentials that allow access to data through the UI. Your firm is responsible for determining the users that are authorized to use those credentials.
• ClickOneTwo Support. In the normal course of operation, all data processing is automated and no person is involved. If the service has an outage or other incorrect behavior, ClickOneTwo support personnel may access your firm’s data during a support investigation. If that happens, we will notify your firm within 24 hours, use the data only for that investigation, and not keep it afterward.
• Legal Requests. If we receive a court order, agency request, or other inquiry about your firm’s data, we will tell you of the request (unless prevented by law) and we won’t respond to it without your consent (unless required by law).

How your data is protected

• In transit. All information uploaded to or downloaded from the AAF Tool, and all firm-supplied PII sent to USCIS web-hosted services, travels over encrypted HTTPS connections.
• At rest. All stored information is encrypted with AES-256, including both customer-uploaded PII and status data retrieved from USCIS.
• Separate keys for each firm. ClickOneTwo creates encryption keys specific to each firm, and holds and maintains them. The same per-firm keys protect both uploaded PII and retrieved status data, so another firm’s keys cannot unlock your data.
• Backups. Encrypted backups of stored data are taken once a day and kept for 6 days. If we ever have to restore from a backup after a catastrophic storage failure, we use the most recent one available. Customers are notified if their data is restored from a backup; those customers will need to redo data deletions that were done after the backup was created.
• Deletion. Your firm can delete data in the AAF Tool at any time. Deleting a client’s Alien Number and Receipt Number also deletes all case status data retrieved for that client. When your subscription ends or is terminated, all of your firm’s data is deleted automatically.
• Subprocessors. The AAF Tool is hosted using subprocessors whose facilities are certified SOC2 and SOC3 compliant. (The DPA provides an exact list of subprocessors and notice requirements for changes in subprocessors.)

Security incidents

If we learn of a security incident affecting your firm’s data, we will notify your firm without undue delay and no later than 72 hours after we become aware of it. We will keep you informed as we learn more and take reasonable steps to contain and investigate the incident.

Where the AAF Tool can be used

The AAF Tool must be used from within the United States, and your data is processed in the United States.

MORE INFORMATION AND SALES

Contact aaf-tool@clickonetwo.io for more information or to contract with ClickOneTwo for use of the AAF Tool.