We use essential cookies to keep you signed in and your case data secure. We do not sell your data or use third-party advertising trackers. See our Privacy Policy for details.
A plain-English summary of the security and privacy controls that guard your immigration paperwork on GreenCardsUSA. This system was designed by Thomas Williams, Esq. — a fully licensed U.S. immigration attorney with 35+ years of experience exclusively handling U.S. immigration cases — every safeguard below was chosen with immigrant families in mind. For the formal versions see our Privacy Policy and Terms of Service.
We know why you might be nervous. Putting your immigration paperwork online — sometimes for the first time — feels risky. Here is what we promise, in plain words:
Your documents and case data are stored on secure, U.S.-based infrastructure. Nothing is ever mirrored or backed up to servers outside the United States. Your immigration file does not travel — ever.
We do not voluntarily share your case with ICE, DHS, USCIS enforcement, or any government agency. We release your data only when we receive a lawful U.S. subpoena or court order — and whenever the law allows, we notify you first so you can consult your attorney.
Passwords are hashed with bcrypt before they touch our database. Even our own team — and anyone who ever manages to read our database — cannot recover them.
Your login token is stored in an HttpOnly, Secure, SameSite=Lax cookie. It cannot be read by JavaScript and it does not travel to other websites — two of the biggest defenses against session theft.
The site is invitation-only. Registration requires a code you received from us, so opportunistic visitors can’t create accounts to poke around.
Every API endpoint that touches a case verifies you own it. There is no code path in which one user can read, download, or modify another user’s petition — and this is protected by an automated test suite that runs on every deploy.
All traffic is encrypted in transit with TLS. The connection between your browser and our server cannot be read or altered by anyone in between — not your coffee shop’s Wi-Fi, not your ISP.
When you upload a document, we send the page images to Anthropic’s Claude Sonnet 4.5 model to read them, translate them, and fill your form fields. That data is used strictly to serve your request. We do not sell your data. We do not train models on it.
When you drop a stack of documents through Smart Sort, the raw page images sit in a temporary staging area only long enough for you to review and apply them. If you don’t confirm within an hour, the staged images are automatically deleted.
No Google Analytics. No Facebook pixel. No ad networks. No hidden third parties reading your immigration data. Just you, our servers, and the OCR provider needed to fill your forms.
Every edit to a case field is recorded to a per-case audit log with timestamp, source (typed, OCR, or corrected), and the person who made the change. If a form goes out with a wrong value, you can trace where it came from.
Ask us to remove your account and all its data at any time by emailing privacy@greencardsusa.ai. Depending on your jurisdiction (California, EU, others) you may have additional formal rights spelled out in our Privacy Policy.
Our server sends security headers on every response —X-Frame-Options,X-Content-Type-Options,Referrer-Policy — to protect against clickjacking, MIME sniffing, and referer leaks.
Our codebase is reviewed by an independent security audit tool before every deploy. Findings are triaged and remediated with automated regression tests that lock in the fixes.
Found a vulnerability or noticed something unusual? Please email security@greencardsusa.ai — we investigate every report and respond within 48 hours. We do not pursue legal action against good-faith researchers who follow responsible disclosure.
Last reviewed: February 14, 2026 · This page is a plain-English summary. See our Privacy Policy and Terms of Service for the formal versions.