What is kept, what is not, and where it lives.

An A-Number identifies a person’s immigration case. It is never written into application logs, error trackers, analytics, or the text of an SMS or push notification. Even when the court’s own system echoes an A-Number back inside an error message, that message is redacted before it is stored — the underlying case is still identified by an internal case ID, so nothing about the failure is lost.

Connecting Google Calendar or Outlook stores an access token, not a password. Tokens are encrypted at rest (AES-256-GCM) and are never logged. If a provider refuses a refresh, the connection is marked as needing reconnection rather than silently dropped or retried with a stale token.

Case data, calendar connections, and acknowledgement records are partitioned by firm using Postgres row-level security, enforced on every query — not just checked in application code. One firm’s workspace cannot read another’s cases, even under a bug in the application layer.

When a client confirms a notice, the confirmation — the time, the language, the network it came from — and the certificate generated from it are kept with the case. The certificate is produced once, at the moment of confirmation, and stored with its checksum; it does not change afterward, because a record that can be edited after the fact isn’t evidence.

EOIR Tracker stores the A-Number, the case data the court’s own public system returns for it, and whatever your firm chooses to add — a client name, an email or phone number for notices. It does not collect Social Security numbers, immigration forms, or case documents.

For a specific question about how your firm’s data is handled, write to info@eoirtracker.com.