Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Actionstep Intelligence is the vendor's name for the AI layer inside the Actionstep practice-management platform. The AI page sets out three parts: 'Observe' (AI time and revenue capture, delivered as Trace), 'Recommend' (AI business intelligence, delivered as Acumen) and 'Execute' (AI-orchestrated workflow automation, headed 'Coming soon'). The pricing page lists Trace and Acumen under 'Add-on module' alongside Builder and Capture, separately from the Practice Management platform, so the AI arrives as priced modules on top of the core product rather than as part of it.
Ask: Which Intelligence modules are on our Australian order form, and can the Actionstep platform be licensed and run with Trace and Acumen both off?
What each AI module does
Public claim only
Of Trace the AI page states it 'Passively tracks billable activity across Actionstep, Outlook, Word, and other tools, then codes time to matters and drafts bill narratives, so the work that gets done gets billed'; the pricing page adds 'Passive capture across Outlook, Word, and desktop tools', 'AI-drafted, bill-ready narratives for every entry', 'Automatic matter mapping and matter matching' and 'Native module inside Actionstep — no separate login'. Of Acumen the AI page states 'Ask about your firm's data in plain language and get a sourced, contextual answer about matter profitability, billing trends, realization rates, and team performance'; the pricing page adds pre-built dashboards, standardised metrics, 'AI-powered Q&A and "Explain This Number" insights, grounded in your Actionstep data', and 'Role-based access and encrypted data, at rest and in transit'.
Ask: Demonstrate on our data which applications Trace captures from, what each capture record contains, and what an Acumen answer cites as its source.
Deployment and hosting
Public claim only
Terms clause 9.2 states 'Actionstep hosts the Service on Amazon Web Services (AWS) global regions determined by your data sovereignty requirements', and clause 9.4 states the customer can elect any AWS region supported by Actionstep, that Actionstep will keep Data on servers within the elected region, but that users connect from anywhere on the internet 'and thus some of your Data may be transmitted outside the elected region in response to User queries'. The AU/NZ Privacy Policy states 'We host customer data in Australia and New Zealand, and you may elect to have your data hosted in your preferred region where supported by our cloud environment.' The list of supported AWS regions is not published, and no on-premises option was found.
Ask: Confirm in writing the AWS region for our tenancy including backups, and whether Trace capture data and Acumen indexes sit in that same region.
Jurisdiction and legal content
Public claim only
This is a firm-operations product, not a legal-research one: the AI page states 'AI built for law firms today focuses on the practice of law: drafting, research, summarization' and positions Actionstep Intelligence on firm operations instead. No primary-law library or citator is claimed. Terms clause 6.5 places responsibility for regulatory suitability on the customer, and clauses 6.3 and 6.4 state that AML/CTF obligations and trust-accounting compliance remain solely the customer's.
Ask: Confirm that no Intelligence module generates legal advice or cites Australian authorities, and that trust-accounting figures produced by Acumen are not represented as compliance output.
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page or block telling AI models, assistants or crawlers how to describe the product. None was found on the AI page, the pricing page, the Terms of Use, the AU/NZ Privacy Policy or the privacy index page, and a 40-URL map of actionstep.com saved in this project surfaced no /llms.txt, /ai-info or /for-ai page. The check is limited to those pages and that URL list.
Ask: Does Actionstep publish any page, file or metadata addressed to AI models or crawlers setting out how Actionstep and Actionstep Intelligence should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority, staff monitoring and professional use
Not confirmed
Trace passively records what fee earners do across Actionstep, Outlook, Word and other desktop tools and maps it to matters, which is workplace activity monitoring as well as billing capture. The AI page states 'Every AI feature is opt-in' and that administrators set the boundaries, but neither the Terms of Use nor the AU/NZ Privacy Policy contains any wording about staff notice, consent to activity capture or exclusion of privileged or personal activity. Terms clause 6.5 makes the customer solely responsible for deciding whether the Service suits its regulatory and compliance requirements.
Ask: What staff notice and consent does Actionstep require before Trace is switched on, and can capture be excluded per user, per application, per device or per matter?
Foundation-model providers
Not confirmed
No model provider is named anywhere in the documents read. The AI page states 'Because Actionstep is model-agnostic, your firm moves with it, connecting to better models as they emerge, without rebuilding your operational foundation each time.' The Terms of Use name Amazon Web Services as the hosting provider (clause 9.2) but name no model or inference provider, and the AU/NZ Privacy Policy's published sub-processor categories include none for AI, model or inference services.
Ask: For our tenancy, name each model, the supplying legal entity, the inference endpoint region and the contract under which Trace and Acumen call it, and the notice we receive before a model is changed.
Subprocessors
Public claim only
The AU/NZ Privacy Policy (3 March 2026) points to a current sub-processor list at https://www.actionstep-trust.com/subprocessors, 'which is updated from time to time', and publishes the categories: cloud infrastructure and hosting, customer support and helpdesk, customer relationship management, analytics and product improvement, marketing automation and communications, transactional email and SMS, document conversion and processing, cookie consent management, and application performance monitoring. No category for AI, model or inference providers appears in that list. The Trust Center list itself was not opened in this pass, and the existing parent-product profile records that an unauthenticated attempt in an earlier pass did not load.
Ask: Provide the current dated sub-processor register for the Australian tenancy including Trace and Acumen, with entity, country, purpose and data types, and our notice and objection rights.
Training on customer content
Not confirmed
The AI page states 'Actionstep does not use your firm's data to train AI models' and that client information, matter history and billing records 'are not shared with third-party AI providers in a way that exposes them beyond your firm'. Terms clause 5.2 grants Actionstep a licence to 'use, copy, transmit, store, and backup Your information and Data for the purposes of enabling You to access and use the Service and for any other purpose related to provision of services to You' — wider than the marketing sentence, and silent on training. Neither the Terms of Use nor the AU/NZ Privacy Policy mentions AI model training at all, and clause 10.2 makes the Terms prevail over the privacy policy on matters other than personal information. The qualifier 'in a way that exposes them beyond your firm' is not a contractual term.
Ask: Which signed document prohibits training, tuning and evaluation on our matter data, Trace capture data, Acumen queries, embeddings and feedback, including by any model provider, and will you add that prohibition to the order form?
Feedback, suggestions and product improvement
Public claim only
Terms clause 5.5 states that where Actionstep provides new features or services based on customer requests or suggestions, those features belong exclusively to Actionstep and the customer will not be compensated. The AU/NZ Privacy Policy's purposes table includes studying how customers use products and services in order to develop them, and its sub-processor categories include 'Analytics and product improvement services'. No in-product rating control for Trace or Acumen output is described on the pages read.
Ask: Is Trace or Acumen usage telemetry, or any rating a user gives an AI output, used to improve models or features, and can that be switched off for our tenancy?
Retention of capture data, prompts and outputs
Public claim only
The AU/NZ Privacy Policy retains personal information only as long as reasonably necessary for the purposes collected, considering amount, nature, sensitivity, risk of harm and legal requirements, and states that financial and transaction records may be retained for a minimum of seven years for Australian users and five years for New Zealand users. Terms clause 8.5 entitles Actionstep to delete all copies of Data 30 days after termination. Nothing published sets a retention period for Trace activity records, drafted narratives, Acumen chat history or embeddings.
Ask: State the default and configurable retention for Trace activity records, drafted narratives, Acumen queries and any embeddings on our Australian tenancy.
Deletion and certified erasure
Public claim only
Terms clause 8.5 allows a backup of Data to be requested within 20 days of termination if all Access Fees are paid, and entitles Actionstep to delete all copies after 30 days. Clause 5.2 makes access to Data contingent on full payment. The AU/NZ Privacy Policy states there is no general statutory right to erasure in Australia or New Zealand and that Actionstep may at its discretion delete personal information on request where it no longer needs it, and may decline where retention is required. No certified-deletion commitment covering sub-processors is published.
Ask: On exit, exactly what is deleted (matters, documents, Trace records, Acumen history, embeddings, sub-processor copies), in what period, and will you certify deletion in writing?
Vendor access to firm content
Public claim only
The AU/NZ Privacy Policy states personal information is shared within the Actionstep Group for operational, support and administrative purposes, which may involve transferring it to overseas offices 'including in the USA, United Kingdom, Australia, New Zealand, and Canada', and that third-party service providers are not allowed to use it for their own purposes and handle it only on Actionstep's instructions. Terms clause 4.1 binds both parties to confidentiality absent consent or legal compulsion. No ticketed-approval process, named access roles or customer-visible access log is described. The SRA addendum at clause 11, which requires reasonable steps on staff reliability and an annual audit, applies only to firms regulated by the Solicitors Regulation Authority and not to Australian firms.
Ask: Which Actionstep roles in which countries can read our matter content, Trace records and Acumen queries, under what approval, and can we obtain that access log?
Access control, SSO and audit
Public claim only
The pricing page renders the Practice Management feature list twice for different regions, selected by a US, UK, AU, NZ and CAD region control: one rendering includes 'Single Sign On (SSO)' and 'Federated Single Sign On (SSO)' among included features and the other does not, so the cached page does not establish whether SSO is included for Australia. Acumen's listed features include 'Role-based access and encrypted data, at rest and in transit'. Terms clause 3.3 puts responsibility for keeping usernames and passwords secure on the customer and requires immediate notification of unauthorised use. Multi-factor authentication, SCIM provisioning and an exportable AI audit log are not described on the pages read.
Ask: Confirm whether SSO, federated SSO, SCIM and enforced multi-factor authentication are included for an Australian tenancy, and whether a complete Trace and Acumen audit log can be exported.
Encryption in transit and at rest
Public claim only
The pricing page states for Acumen 'Role-based access and encrypted data, at rest and in transit'. The AU/NZ Privacy Policy states appropriate technical and organisational security measures are in place under Australian Privacy Principle 11 and New Zealand Information Privacy Principle 9, without naming algorithms, protocol versions or key management. The Terms of Use contain no encryption clause, and no customer-managed key option is published.
Ask: Specify the encryption and key management applied to Trace records, Acumen stores, backups and any path to a model provider, and whether customer-managed keys are available.
Independent security assurance
Public claim only
The pages read carry a badge image captioned 'Actionstep Completes SOC 2® Type 2 Examination — Reinforcing commitment to law firm security', dated in the image path to February 2026. The report itself, its scope, its period and any exceptions were not obtained in this pass, and nothing read states whether Trace and Acumen are inside that scope. No ISO/IEC 27001 or ISO/IEC 42001 certification is claimed in the documents read.
Ask: Provide the current SOC 2 Type II report and bridge letter, state whether Trace and Acumen are in scope, and confirm whether any ISO/IEC 27001 or ISO/IEC 42001 certification is held.
Contract, DPA, liability and forum
Public claim only
The Terms of Use (last updated 14 April 2026) apply on registration. For a customer that is an Australian tax resident, clause 10.6 applies Australian law and the exclusive jurisdiction of Australian courts. Clause 7 excludes liability broadly and caps any negligence or breach claim at the Access Fees paid in the previous 12 months per incident or series of connected incidents; clause 6.6 disclaims all warranties in capitals; clause 6.7 limits liability for non-excludable consumer guarantees to re-supply or the cost of re-supply. Clause 10.2 makes a signed Separate Agreement prevail over these Terms. There is no AI schedule. Clause 12 refers EU clients to a 'Data Processing Agreement' in the Privacy Policy, but the privacy index page read on 2026-09-27 lists only the US and Canada, United Kingdom and Australia and New Zealand policies and no separate DPA, and no Australian DPA was found.
Ask: Provide the Australian master agreement and a DPA, confirm the contracting entity and its ACN, and state any negotiated override of the clause 7 cap and the clause 5.2 data licence.
Cross-border transfers and APP 8
Public claim only
The AU/NZ Privacy Policy states customer data is hosted in Australia and New Zealand with a regional election where supported, that personal information is shared within the Actionstep Group including offices in the USA, United Kingdom, Australia, New Zealand and Canada, and that 'Many of our service providers are located in the United States and other countries outside Australia and New Zealand'. It describes taking reasonable steps under Australian Privacy Principle 8.2(a) through contractual arrangements requiring comparable standards. Terms clause 9.4 notes some Data may be transmitted outside the elected region in response to user queries. No country is published for AI inference.
Ask: For Trace and Acumen, list every country used for storage, inference, backups, support and logging, and confirm whether Australia-only inference is available.
Incident notification and history
Public claim only
The AU/NZ Privacy Policy states procedures are in place to deal with a suspected data breach and that for an eligible data breach likely to result in serious harm Actionstep will notify the affected individual and the Office of the Australian Information Commissioner under Part IIIC of the Privacy Act 1988 (Cth), or the New Zealand Privacy Commissioner as applicable. No contractual notification period from discovery is published, no commitment covers sub-processor incidents, and no incident history was found. Terms clause 3.3 requires the customer to notify Actionstep of unauthorised password use or any other breach of security.
Ask: State the contractual notification period from discovery for our tenancy, how sub-processor and model-provider incidents are covered, and any material incident affecting Intelligence in the last 24 months.
Change notice for terms, models and processors
Public claim only
The Terms of Use state Actionstep may change them at any time, effective on posting, with the change communicated by email or website notification, and that it is the customer's obligation to read the most recent version; the page publishes a dated revision list (10 October 2021, 4 March 2026 and 14 April 2026). The AU/NZ Privacy Policy is kept under regular review and says sub-processors are updated from time to time at the Trust Center. The vendor's model-agnostic statement means the underlying model may change. No objection right for a new AI processor or model is published.
Ask: What written notice will we receive before a new model, model provider or sub-processor is introduced into Trace or Acumen, and can we object or hold a version?
Export and exit
Public claim only
Terms clause 8.2 states a customer-initiated termination must be made in the subscription settings area of the Service and that Actionstep will not accept termination notices by any other means. Clause 5.3 allows a backup of Data to be requested at any time if all Access Fees are paid, 'in a common export format determined by Actionstep', with additional costs possible depending on frequency, size and delivery. Clause 8.5 sets the 20-day post-termination request window and the 30-day deletion entitlement. The stronger download rights in the SRA addendum (machine-readable format and 28 days' notice) apply only to firms regulated by the Solicitors Regulation Authority.
Ask: Which export formats cover matters, documents, time entries, Trace records and Acumen history, who bears the cost, and will you confirm deletion in writing afterwards?
Connectors and third-party AI tools
Not confirmed
Terms clause 5.4 states that if the customer enables third-party applications, Actionstep may allow those providers to access the customer's Data as required for interoperation, and that 'Actionstep shall not be responsible for any disclosure, modification or deletion of Your Data resulting from any such access by third-party application providers'. The AI page lists eight third-party AI products as integrations. Clause 3.4 notes API call limits. Each of those products carries its own terms and is outside this profile.
Ask: List every connector and AI integration that will be enabled on our tenancy, the data each receives, and confirm in writing that none is enabled without our approval.
Open-web retrieval and browser capture
Not confirmed
Acumen is described as answering questions 'grounded in your Actionstep data' and no open-web retrieval is claimed for it. For Trace, the pages read in this pass describe capture 'across Actionstep, Outlook, Word, and other tools' and 'across Outlook, Word, and desktop tools' without saying whether browser activity or URLs are captured; the existing parent-product profile records that the Trace product page states which website is open is captured, and that page was not re-read in this pass, so the point is unresolved here rather than settled either way.
Ask: Does any Intelligence module query the open web, and does Trace capture browser activity or URLs — if so, can that be disabled firm-wide?
Agent actions and confirmation
Public claim only
Trace produces 'bill-ready' entries described as arriving for review rather than posting themselves, and Acumen answers questions and recommends. The third pillar, in which 'Agents execute tasks within the boundaries your administrators define, and every action is logged', is headed 'Coming soon' on the AI page and is therefore not a control that can be tested today. The Terms of Use contain no clause about automated action, approval thresholds or logging.
Ask: Today, can any Intelligence module post a time entry, issue a bill or send a communication without a human step, and when agents ship, which actions will require a second confirmation?
Human review before use
Public claim only
The AI page states 'Your administrators set the boundaries. Your lawyers review before anything is acted on. The firm decides what AI does, and can see exactly what it did', and that 'Every AI feature is opt-in'. Those are statements on a marketing page: the Terms of Use contain no AI human-oversight obligation, and clauses 6.5 and 6.6 place suitability and as-is risk on the customer. Nothing read describes a configurable setting that forces a named reviewer before a drafted narrative reaches a draft bill.
Ask: Which product settings can force a named reviewer before a Trace entry reaches a draft bill or an Acumen figure is circulated, and can those settings be locked by an administrator?
