Transfer Room

What you can do

• Per-tenant AES-256-GCM encryption

  Every file uploaded by you or your client is encrypted under your tenant's data key before it lands in storage. One tenant cannot decrypt another tenant's files even with full database access.

• Private client portal

  Clients access their room at a one-time-code-gated URL — no client login, no shared password. The session is HMAC-signed with a 30-minute idle timeout.

• Automatic activation per Service Agreement

  Each fully-signed Service Agreement can auto-open its own Transfer Room when the first bill is paid in Stripe. Legacy matters can be added manually.

• Bidirectional file exchange

  Send files to your client OR receive uploads from them in the same room. Up to 110 MB per file, 500 MB per transfer, multi-file ZIP download.

• Short-by-design retention

  Transfers expire after 14 days by default (1–30 days tenant-configurable). Downloaded files purge 72 hours later. Drive-copied files purge 24 hours later. The room is for exchange, not long-term storage.

• Optional Google Drive sync

  Connect Drive once; copy any received file into a per-client folder structure (RCIC App → Clients → <client> → <AGMT>) with one click. Idempotent — re-clicking is safe.

• Append-only audit log

  Every room event — activation, transfer sent, viewed, downloaded, revoked, deleted — is written to a tamper-evident ledger. Replay exactly who did what when, with redacted IP addresses.

• Notification controls

  Per-participant notification settings on both client and tenant sides. Cap of 3 recipients per side; primary contact + sponsor + designated person default to opt-in on the client side; RCIC + co-counsel + Owner default to opt-in on the tenant side.

• Bilingual portal (EN / fr-CA)

  Clients open the portal in English or Quebec French. All notifications follow the tenant's default client-page language.

• No email attachments

  Every notification is plaintext with a portal link. Filenames are omitted by default — the bytes only flow through the encrypted portal, never through the email channel.

• Email replies become transfers

  When a client replies to a Transfer Room notification email, the reply and its attachments materialize as a new Received transfer in the room — up to 20 files at 25 MB combined. Same per-tenant encryption, same audit log, same retention as a portal upload. Replies from an unexpected address quarantine for your review before they land.

• Text-only messages, end-to-end encrypted

  Send a Transfer Room message without attaching files. Works from your dashboard, from the client portal, and from a plain email reply. The full message lands in the room with the same audit log and retention as any file transfer, so every exchange between you and your client lives in one place.

• Daily activity summary archived to your Drive

  Each agreement folder on your connected Google Drive or Microsoft OneDrive gets a Transfer Room Summaries subfolder. A daily PDF lands there listing every file your client downloaded that day. The daily summary email you already receive becomes a permanent record next to the rest of the matter.

• Pinned Information Card for the matter

  Every Transfer Room opens with a collapsible Information Card at the top: applicant + family identity, passport + UCI + application numbers, multi-citizenship chips, government authority blocks (IRCC, ESDC, CBSA, IRB). Some fields the RCIC owns alone; the primary client edits contact details + Authority blocks from the portal. Every change is masked + audited.

• Pull-from-Service-Agreement + revert

  Seed the Information Card with one click from the linked Service Agreement — names, date of birth, address, phone, email, matter type, family roster. Made a mistake? Revert restores the pre-pull state for 30 minutes. Card-typed passport + UCI data is never clobbered by a re-pull.

• AI auto-fill from an uploaded ID

  Drop a passport, PR card, or national ID into the card. Gemini reads surname, given names, date of birth, passport number, issuing country, and expiry. You confirm which values to apply before anything is written. The image is NOT stored — extraction only.

• Verify-before-swap sign-in email

  Update the client's portal sign-in email from either side. A 6-digit code is delivered to the new address; the swap only takes effect once the client confirms. Open sessions on the old email lose access on the next request.

• Internal Matter Work Ledger

  Pinned inside every matter-linked Transfer Room: an internal time + billing log keyed to a fixed catalogue of work codes (MWL-100..259, MWL-500..507, MWL-999 catch-all — extensible). Any teammate on the room — RCIC, co-counsel, or staff — logs entries against the matter. Each entry carries one or more codes, optional encrypted description, time spent, and a work date. Internal use only — never shown to the client, no portal surface.

• Live fee math + Gemini code suggester + PDF export

  Set three hourly rates (RCIC / co-counsel / staff) and a per-entry round-up rule (none / 15 / 30 / 60 min) once in Settings. The ledger multiplies rounded time by each entry's role rate at read time — change a rate and every entry recomputes. Describe a task in plain language and Gemini suggests the best-fitting catalogue codes (Premium only, counts toward your shared 50/day AI quota). Download a bilingual internal PDF with per-worker subtotals + grand total any time.

• Paginated list with per-member size memory

  Browse your Transfer Rooms 10, 25, 50, or 500 at a time. Each teammate picks the page size that fits their screen; their preference sticks across sessions. The Owner sets the firm-wide default for new teammates from the TR Settings page. The most recently active rooms come first; clicking a column header reorders the current page so you can fine-tune what you're looking at without losing your place.

• Owner-only TR Settings page

  A single place under the Transfer Room module — visible only to the Owner — gathers every tenant-wide control: the default page size, the tenant-wide viewer toggle, and the default-contacts roster (below). Teammates who navigate there see a friendly Owner-only card.

• Tenant-wide TR viewer access for paid Assistants

  Grant a paid Assistant blanket access to every Transfer Room your firm has open, without listing them as a participant on each room one by one. Viewers can read every room, scalar-edit the Information Card, write to the Matter Work Ledger, and download received files. They cannot send documents to clients, run AI auto-fill from an ID, or add/remove family or authority rows — those structural moves stay verified-RCIC only. Toggle the flag per Assistant from the TR Settings page.

• Default contacts roster from your seats

  Save the staff you add to Transfer Rooms most often as default contacts on the TR Settings page. Each contact is backed by an existing seat in your firm — pick the seat, customize the display label if you want (Mehdi Yavari → Marketing Lead), and the sign-in email is snapshotted from the seat itself. Then when adding a tenant-side participant to any Transfer Room, the contact list surfaces as a quick picker above the manual fields. Five role categories (Accounting / Marketing / Processing / Management / Other) keep the roster tidy. Click Refresh emails from seats any time a teammate updates their login email to re-snapshot every row.