How to Manage Cases and Billing for a Private Investigation Firm

Most private investigation firms do not lose money on cases. They lose money on the seventeen minutes after each case. The surveillance log that gets transcribed twice. The mileage that nobody wrote down between Tuesday and Friday. The retainer that quietly dipped below the replenishment trigger four cases ago. The deposition exhibit that took three hours to find because the file lives on someone's desktop and the cloud copy is two revisions behind.

This is the operating reality of a 1-10 investigator firm in 2026. The cases are interesting. The licensing is real. The clients (mostly attorneys, insurers, and HR teams) are sophisticated buyers who will not pay a vague invoice and will not tolerate a chain-of-custody gap. And the software market is split: the legal practice tools (CasePeer, Clio, PracticePanther) are built for law firms, not PIs. The PI-specific tools (CROSStrax, OSMOSYS, Investigator's Toolbox) cover the basics but rarely cover everything. Most firms end up running four or five disconnected products plus a spreadsheet plus a shared Dropbox.

This post is the operator's guide to running a PI firm on a single system: how to structure clients and matters, how to track time and expenses in a way that holds up in a billing dispute, how to manage retainers without trust-account drama, how to handle evidence so the chain of custody is defensible, and how to bill attorneys and insurers in a format they will actually pay on first submission.

Private investigation in the United States is licensed at the state level, and every state has its own regulator and its own rulebook. Florida is run by the Department of Agriculture and Consumer Services (DACS), which issues Class C (investigator) and Class A (agency) licenses. California is run by the Bureau of Security and Investigative Services (BSIS), which issues the PI license and regulates firearm endorsements separately. Texas is run by the Texas Department of Licensing and Regulation (TDLR), which absorbed the old Private Security Bureau. Most states require continuing education, an active general liability policy (commonly $300K-$1M in coverage), a background check on every licensed investigator, and a fidelity bond.

The regulatory load matters for software because the records you keep are the records your regulator may audit. Case files, time logs, evidence handling, and client communication are all potentially discoverable in a license complaint or a civil suit. The rule of thumb most operators work from: assume every record could end up in deposition. Plan accordingly.

The five buckets most firms work in look different operationally, and the software has to bend to all of them.

Insurance defense. Workers' comp surveillance is the workhorse. The carrier or defense attorney hires you to document whether a claimant is doing things inconsistent with their declared injury. Cases are short (1-3 days of fieldwork), evidence-heavy (hours of surveillance video, timestamped activity logs, narrative reports), and billed at differentiated rates: fieldwork hourly, drive time at a reduced rate, mileage, and equipment fees.

Domestic. Infidelity, custody, and pre-marital cases. Clients are individuals, often emotional, often paying out of pocket. Retainer discipline matters here more than anywhere — the case can extend in unpredictable ways and you do not want to chase a $4,000 invoice from someone whose case has just gone sideways. Evidence requires the same court-defensibility bar because much of it ends up in family court.

Corporate. Background checks, due diligence on prospective hires, partners, or acquisitions; asset searches; competitive intelligence; internal investigations into theft or fraud. Clients are companies, billing is per-engagement or hourly with a defined scope, and reports are formal written deliverables, often with executive summaries.

Legal support. Skip trace (finding people), witness location, service of process, courthouse research, criminal case investigation for defense attorneys. The client is almost always an attorney, the billing is hourly against a retainer, and the deliverables feed directly into litigation. Turnaround is fast and the cost of an error (serving the wrong person, transposing a digit on a court filing) is high.

Background checks. Pre-employment and tenant screening run under the Fair Credit Reporting Act (FCRA). FCRA constrains what you can report, how old the records can be, what consents you need, and what disclosures the subject is entitled to. Most firms either specialize in FCRA-compliant background checks or refer them out, because the compliance load is its own discipline.

The software has to handle all five. That means: a case structure that can hold a 2-day workers' comp surveillance and a 4-month corporate due-diligence engagement; a billing engine that can produce both a flat-fee invoice and an hourly statement with 47 time entries; and an evidence system that can store both surveillance video and a 30-page written report.

Generic CRMs are built around a contact and a deal. A contact is a person; a deal is a sales opportunity. That model fits selling software. It does not fit running an investigation firm.

In a PI workflow, the client is usually not the subject of the investigation. The client is the attorney or the insurer or the HR director who hired you. The case (often called a matter) is the actual investigation file. One client can have many matters open at the same time. A single regional insurance defense firm might be sending you four claimant surveillance jobs a month, each its own matter, each with its own subject, scope, retainer balance, and billing detail.

The data model that holds up:

- Client — the entity that signed the engagement letter and pays the invoices. Could be a company (most common) or an individual (domestic cases). - Matter — the case file. Has a matter number, an open and close date, an assigned investigator, a retainer balance, a scope, a status, and a billing rate sheet. - Subject — the person being investigated. Linked to the matter, not the client. Multiple subjects per matter is common in corporate work. - Contact — anyone you communicate with on a matter: the attorney, the adjuster, the HR lead, a witness, a co-investigator. Linked to matters and to clients.

This structure is what makes the rest of the system work. Time entries get logged against a matter. Documents get filed under a matter. Expenses get coded to a matter. Invoices get generated from a matter. When the client calls in October asking about the surveillance you ran in July, your system answers by matter number, not by guessing which contact record might have it.

In Deelo, the CRM uses this exact client-and-matter shape, so cases, time, documents, and invoicing all share the same underlying record. There is no Zap to maintain between the CRM and the time tracker because they are reading the same matter.

Most billing disputes do not come from rate disagreements. They come from time entries that the client cannot reconstruct. An attorney looking at a $7,400 invoice wants to see, line by line, what was done, when, for how long, and at what rate. Vague entries ("surveillance, 6 hours") get questioned. Specific entries ("03/14/26 0530-1145, mobile surveillance of subject at 2841 Henley Dr, observed subject leave residence 0712, followed to 1500 Crossland Pkwy where subject performed manual loading of vehicle for 22 minutes — see attached video clip 14a-c") get paid.

The time-tracking spine of a working PI firm:

Deelo's time module is structured around case codes — every time entry is logged against a matter and an activity code, with rates inheriting from the matter's rate sheet. Mileage is its own entry type. Expenses are filed to the matter with attached receipts. When invoicing pulls from the time data, the line items are already in the format the client expects.

Most PI firms work on retainer. The client pays a deposit at the start of the engagement (commonly $1,500-$5,000 for a typical insurance defense matter, $2,500-$10,000 for corporate, $1,000-$3,500 for domestic), the firm bills time and expenses against the retainer, and the retainer gets replenished when it falls below a threshold (commonly 25% of the original deposit).

This is not a true legal trust account in the IOLTA sense — that is reserved for attorney trust funds and has its own bar-association reconciliation rules. But the discipline is similar. The retainer is the client's money until the firm earns it. The firm needs to be able to produce, at any moment, the current retainer balance, the time and expenses billed against it, and the date and amount of every replenishment request.

The operational pattern that works:

Surveillance video, witness statements, database screenshots, written reports — every artifact your firm produces could end up as a deposition exhibit or a trial exhibit. The standard that makes evidence usable in court is not glamorous: it is chain of custody and integrity. Where did this come from, when, who handled it, and is it the same file today that it was when it was created.

The practical implications for your software:

Deelo's document module handles versioning and access logging at the platform level. Every open, download, and edit is logged with user, timestamp, and IP. Surveillance video and large media files go into the encrypted file storage. Retention can be set per matter and per document type.

Most attorneys and insurance adjusters want one thing at the end of an investigation: a written report they can attach to their file. The format matters more than the firm thinks. A report that is well-structured and consistent across cases is one the client can read in five minutes; a report that is rambling is one they spend an hour parsing and remember when it is time to refer the next case.

The template that holds up across case types:

- Header block. Client, matter number, investigator name and license number, date range of investigation, report date. - Scope. A one-paragraph restatement of what the client asked the firm to investigate. - Methodology. What was done: surveillance hours, database queries run, witnesses contacted, locations visited. - Findings. Chronological, factual, no editorializing. "On 03/14/26 at 0712, subject exited residence at 2841 Henley Dr." Not "the subject appeared to leave for the day." - Exhibits. Photos, video clips, database printouts, screenshots, referenced by exhibit number. - Summary. A short closing paragraph that the attorney or adjuster can paste directly into their own case memo. - Investigator certification. Signed and dated, with license number.

Delivery is the second half of the problem. Email is not the answer for a 1.2 GB surveillance video file and a 30-page report containing a subject's PII. The pattern that works is a secure client portal: the firm uploads the report and exhibits into the matter, the client gets a notification with a portal login, the client downloads the materials over an authenticated session, and the system logs the download for chain of custody. No file links emailed in the clear. No "hey did you get my Dropbox link" follow-ups.

Every engagement starts with paper. The retainer agreement (sometimes called an engagement letter) defines scope, rates, retainer terms, confidentiality, and termination. Domestic cases often include a release acknowledging the firm is not retained for any unlawful purpose and that surveillance is conducted in compliance with state and federal law. Background-check engagements require FCRA-compliant disclosures and authorizations from the subject before any consumer report is pulled.

This paperwork should not require printing, signing, scanning, and emailing. E-signature is table stakes in 2026 — the retainer goes out as a digital document, the client signs in-line, the signed copy lands in the matter file, and the case can start the same day. Built-in e-signature integrated with the matter record (rather than a separate DocuSign account with its own filing system) eliminates one of the most reliable sources of "where did that PDF go" pain.

The two largest client categories — attorneys and insurance carriers — have specific billing expectations. Both want detailed time entries, both want expenses broken out separately, and both will reject vague or aggregated billing.

For insurance carriers, many require LEDES billing codes (the standardized timekeeping codes used in legal billing) or their internal equivalent. Some require submission through a vendor management portal (Tymetrix 360, Bottomline, etc.) rather than direct invoice. The firms that win the most insurance defense work tend to be the ones that submit clean LEDES-format invoices in the carrier's portal with no manual reformatting.

For attorneys, the bill goes to the firm's accounts payable, often with a defined turnaround (30-day net is common, 60-day in some firms). A clean invoice has: matter number, period covered, opening retainer balance, time entries with date/investigator/duration/activity code/rate/amount, expense entries with receipts attached, total billed, retainer applied, closing balance, and any amount due in addition.

Deelo's invoicing module pulls time and expense data directly from the matter, applies the matter's rate sheet, and produces an itemized invoice in PDF or LEDES format. The retainer balance reconciliation happens automatically. The invoice goes to the client either through the portal or by email with a payment link.

The point of consolidating these on one platform is not feature parity with each category leader. The point is that a time entry an investigator logs in the field shows up on the matter, draws down the retainer, lands on the invoice, and shows up in the client portal — without anyone re-keying it and without an integration to maintain.

Deelo is not a PI-specific product. It is a unified business platform with CRM, time tracking, docs, invoicing, customer portal, e-signature, field service, and encrypted file storage on a shared data layer. The reason it works for PI firms is the data model: the CRM operates on a client/matter shape, time entries live against matters with per-activity rate codes, document storage versions everything and logs every access, the customer portal delivers reports under authenticated session, and invoicing pulls from the same matter data without re-keying.

For a 5-investigator agency, the typical stack we replace looks like: a CRM ($150-300/mo), a separate time and billing tool ($200-400/mo), a cloud storage subscription with light versioning ($50-100/mo), a separate e-signature account ($30-50/mo), a portal product or just unsecured email ($100/mo or worse), and a separate field-capture or notes tool. All-in: $600-1,000/mo, plus the integration tax of keeping them all in sync, plus the time leakage of the disconnections between them.

Deelo starts at $19 per seat per month for the entire platform. For a 5-investigator firm, that is $95/month for the same surface area, with one customer record and no integrations to maintain. The trade-off is that Deelo is not a PI-specialist product — a firm that needs deep PI-vertical features (advanced surveillance video analytics, integrated TLO/IRB lookups from inside the case file) may want a specialist tool alongside it or instead. For most 1-10 investigator firms, the integrated stack is the better operational answer.

The PI firms that scale past the first few investigators tend to be the ones that treat back-office discipline as part of the craft. Time captured in the field, not from memory. Retainers tracked in real time, not at month-end. Evidence handled like deposition exhibits from the moment it is captured. Reports delivered through authenticated channels, not email attachments. The case work itself is the interesting part. The system around it is what determines whether the firm is billable next month.