Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Actionstep Intelligence (released 11 August 2026) is an AI layer inside the PMS. First capabilities are Trace (AI time capture, add-on) and Acumen (AI business intelligence). Workflow agents and an MCP server are described as coming later in 2026. LawMaster and FilePro have separate privacy policies. Third-party AI apps (Josef, Lexidesk, Quillio and others) are listed as integrations, not native Intelligence.
Ask: Confirm our Australian order form: which Intelligence modules (Trace, Acumen, agents, MCP) are in our tier, and which third-party AI apps are enabled.
Deployment model
Public claim only
Actionstep is cloud SaaS. AU/NZ privacy says customer data is hosted in Australia and New Zealand and the firm may elect a preferred region where the cloud environment supports it. Group support and some providers operate in the USA, UK, Australia, New Zealand and Canada. No public on-premises option was found.
Ask: Is our tenant exclusively in an Australian region, including backups, Trace telemetry and Acumen indexes?
AI features in scope
Public claim only
Trace passively captures activity across Outlook, Word, Excel, PowerPoint, PDFs, Teams and the browser (including which site is open), maps it to a matter and drafts bill narratives for review; entries are not posted automatically. Acumen answers plain-language questions on firm financial and operational data with sourced answers. Workflow agents that execute tasks inside administrator-defined boundaries are 'coming soon'. Every AI feature is described as opt-in and auditable.
Ask: Which of Trace (and which captured applications), Acumen, workflow agents and MCP will be on for which roles, and can we run Actionstep with all Intelligence modules off?
Jurisdictions and legal content
Public claim only
Actionstep is a midsize-firm operations platform (matters, billing, trust, compliance workflows), not a legal-research product. Trust-accounting and AML features are marketed for Australia, New Zealand and the UK. No cited primary-law library is claimed for Intelligence.
Ask: Confirm Actionstep Intelligence will not generate legal advice or cite Australian authorities unless we enable a named research integration.
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and professional use
Not confirmed
Trace passively records activity across email, documents and websites, including which site is open, and maps it to matters. That is workplace monitoring as well as billing capture. Marketing says Trace can be turned off and is 'privacy-first', but client-consent wording for activity capture was not found. Terms put compliance with professional rules on the firm.
Ask: What staff and client notice is required for Trace, can we exclude privileged or personal browsing, and can we block capture on nominated matters?
Foundation-model providers
Not confirmed
Actionstep says it is model-agnostic and will connect to better models over time. No named providers (OpenAI, Anthropic, Azure, Bedrock or other) appear on the Intelligence, Trace or Acumen pages read. The Trust Center subprocessor list did not load without authentication.
Ask: For our tenant, name each model, legal entity, endpoint region and contract used by Trace, Acumen and any forthcoming agents, and the notice period before a model is swapped.
Subprocessors
Not confirmed
AU/NZ privacy points to a current sub-processor list at https://www.actionstep-trust.com/subprocessors, updated from time to time. An unauthenticated scrape of that URL failed (likely login-gated). Categories mentioned include hosting, payments, communications, analytics, CRM and support. No dated public table of AI processors was retrieved.
Ask: Provide the current dated subprocessor register for Australian Actionstep plus Trace and Acumen, with entity, country, purpose, data types, and our notice and objection rights.
Training on customer content
Not confirmed
The Intelligence page says Actionstep does not use firm data to train AI models and that client information is not shared with third-party AI providers 'in a way that exposes them beyond your firm'. Terms clause 5.2 grant Actionstep a licence to use, copy, transmit, store and back up Data to provide the Service 'and for any other purpose related to provision of services to You'. That licence is broader than the marketing sentence and does not mention training. Clause 5.5 assigns new features based on customer suggestions to Actionstep.
Ask: Which signed document prevails, and does it prohibit training and product improvement on Trace telemetry, Acumen queries, matter data, embeddings and feedback, including by any model provider?
Feedback and quality monitoring
Public claim only
Terms say the Service will evolve based on user feedback and that new features built from requests belong to Actionstep. No in-product thumbs-up control for Intelligence was described. Privacy allows de-identified information to be used indefinitely for research or statistical purposes.
Ask: Is Trace/Acumen telemetry or ratings used to improve models, and can we disable that for our tenant?
Retention of prompts, outputs and matter indexes
Public claim only
Privacy retains personal information while reasonably necessary, with financial records potentially kept seven years (AU AML/CTF). NZ tax addendum keeps data at least seven years while subscribed. No published window for Trace activity logs, screenshots, URLs or Acumen chat history.
Ask: State default and configurable retention for Trace activity logs, URLs, draft narratives, Acumen chats and embeddings on the Australian tenant.
Deletion and certified erasure
Public claim only
After termination, a backup may be requested within 20 days (if fees are paid). Actionstep may delete all copies after 30 days. Privacy allows individuals to request deletion and says unused information will be destroyed or de-identified. No certified-deletion SLA for AI providers was found.
Ask: On exit, what is deleted (matters, Trace logs, Acumen indexes, subprocessors), in what period, and will you certify deletion in writing?
Vendor and verifier access to content
Public claim only
Privacy limits staff, agent and contractor access to those with a business need, on instructions and under confidentiality. Group companies in the USA, UK, Australia, New Zealand and Canada may receive personal information for operational support. SRA addendum (UK only) addresses staff reliability; no equivalent AU staff-access log was published.
Ask: Who can read our matter and Trace content, from which countries, under what ticketed approval, and can we see those access logs?
Access control, SSO and audit
Public claim only
The Subscriber controls User roles and can revoke access. Intelligence is marketed as opt-in, administrator-bounded and auditable. Trace can be turned off. SSO/SCIM and MFA requirements were not described on the pages read.
Ask: Confirm SSO/SCIM and mandatory MFA on our plan, default-off Trace per user, and whether we can export a complete Trace and Acumen audit log.
Encryption in transit and at rest
Public claim only
The compliance page refers to 'bank-grade security measures, including encryption and regular audits' without naming AES or TLS versions. Privacy describes technical and organisational measures in APP 11 terms. Customer-managed keys were not offered.
Ask: Confirm encryption of Trace telemetry, Acumen stores, backups and any model-provider path, including algorithms and key management for the Australian tenant.
Independent security assurance
Public claim only
Actionstep announced completion of a SOC 2 Type II examination on 18 February 2026, attested by Prescient Assurance. The report is restricted-use via the Trust Center under NDA. Scope covering Trace and Acumen was not published. ISO 27001 was not claimed on the pages read.
Ask: Provide the current SOC 2 Type II report covering Actionstep Intelligence (Trace and Acumen), with scope, exceptions, bridge letter and penetration-test summary.
Contract, DPA, liability and forum
Public claim only
AU terms (online ToS) are governed by Australian law and Australian courts for Australian tax residents. Liability for negligence or breach is capped at Access Fees in the previous 12 months; consumer guarantees are limited to re-supply. There is no AI-specific schedule. Privacy is incorporated. Terms name the AU company as 'Actionstep Operations Australia Limited' while privacy uses 'Pty Ltd' (ACN 636 757 125). A standalone AU DPA URL was not found (EU DPA is referenced for EU clients).
Ask: Provide the signed AU MSA/DPA, confirm the contracting entity and ACN, and any negotiated override of the 12-month cap and the clause 5.2 data licence.
Cross-border transfers and APP 8
Public claim only
Privacy states hosting in Australia and New Zealand with a regional election, and that personal information may be shared with Group offices and providers in the USA, UK, Australia, New Zealand and Canada. APP 8 contractual steps are described. Firms that object to overseas disclosure are told to contact privacy@actionstep.com, noting that services may be affected. Model-provider countries are unpublished.
Ask: For Trace and Acumen, list every country for storage, inference, backups, support and logs, and whether Australia-only inference is available.
Incident notification and history
Public claim only
AU/NZ privacy says Actionstep will notify affected individuals and the OAIC (or NZ OPC) of eligible data breaches likely to cause serious harm, and that a contractual DPA's notification terms apply where one exists. No public 72-hour clock or incident history was found. Terms require the customer to notify Actionstep of unauthorised password use.
Ask: State the contractual notification period from discovery for our AU tenant, NDB cooperation, subprocessor incidents, and any material incidents in the last 24 months affecting Intelligence.
Change notice for models, terms and processors
Public claim only
Actionstep may change the Terms at any time, effective on posting, and will email or notify in-product. Sub-processors are updated 'from time to time' on the Trust Center. Intelligence is described as model-agnostic so models may change. No objection right for new AI processors was found in the public ToS.
Ask: What written notice will we get before a new model or subprocessor is introduced, and can we object or freeze Trace capture scopes?
Export and exit
Public claim only
Customer-initiated termination is via subscription settings only. A backup in a common export format may be requested within 20 days of termination if fees are paid; extra costs may apply. Data may be deleted after 30 days. Access to Data is contingent on paid fees. UK SRA addendum has stronger download rights; that addendum does not apply to Australian firms.
Ask: What export formats cover matters, documents, Trace logs and Acumen history, and will you certify deletion within 30 days including AI subprocessors?
Connectors and third-party AI tools
Not confirmed
Enabling third-party applications authorises those providers to access Data for interoperation; Actionstep disclaims responsibility for their disclosure or deletion. The Intelligence page lists Josef, Lexidesk, Quillio, Smith.ai and others as AI integrations. Those products have their own terms.
Ask: List every connector and AI integration that will be on for our tenant, the data each receives, and confirm they are out of scope unless we enable them in writing.
Open-web search
Not confirmed
Acumen is described as querying the firm's own Actionstep data, not the open web. Trace records which website a fee earner is on as part of time capture, which is URL logging rather than LLM web search. No Bing/Google retrieval toggle for Intelligence was found.
Ask: Does Acumen or any forthcoming agent browse the open web, and can we disable Trace URL capture firm-wide?
Agent actions and confirmation
Public claim only
Trace does not auto-post time; review and post stay with the fee earner. Acumen recommends actions. Workflow agents that 'execute tasks within the boundaries your administrators define' with a full log are coming soon and are not yet a live control to assess.
Ask: When agents ship, which actions can execute without a second confirmation, and can we keep them off while using Trace and Acumen?
Human review before use
Public claim only
Marketing says administrators set boundaries and lawyers review before anything is acted on. Trace requires review before posting. Terms do not contain an AI-specific human-oversight clause equivalent to Clio section 14.2. Workflow agents are not yet generally available.
Ask: What product controls force a named reviewer before a Trace entry hits a draft bill or an Acumen insight is emailed firm-wide, and can those controls be mandated?
