Product and intended use
Define the configuration, people, information and tasks being assessed.
Product line and what BillBlast covers
Public claim only
BillBlast sits in Aderant's 'Work to Cash' product line alongside Onyx, Virtual Pricing Director and iTimekeep, and separately from the Expert Sierra financial-management system; MADDI and Stridyn are listed under Platform and Aderant Agents under an Agent Center, read 2026-09-27. The BillBlast page publishes four feature groups — eBilling Management, Email Billing Management, Billing Matter Management and Billing & Payment Analytics — with no tier, edition or module list, and the page states BillBlast 'closes the loop within our work-to-cash solution'. No AI is named inside any of the four feature groups; the single AI attribution sits in a separate block.
Ask: Which of the four BillBlast feature groups are on our order form, is BillBlast licensed separately from Expert Sierra and Onyx, and is any part of it dependent on another Aderant product?
What the AI does and what the workflow does
Public claim only
The product page's only AI attribution reads verbatim: 'Powered by our AI, MADDI, it enforces billing rules, automates email and eBilling workflows, and resolves issues before submission, ensuring invoices go out right the first time', read 2026-09-27. The four feature groups themselves are described without AI: centralised spend-management platforms, automated eBill submission, eBilling compliance that can 'flag concerns within bills prior to submission, and identify post-submission issues', mass invoice email with a 'centralized repository of sent items, bounce backs, and replies', 'Automated Matter Reconciliation' that 'Seamlessly align law firm records with client vendor portal data', mass update of matter information, and analytics dashboards of bill status, payment status, client reductions and rejection reasons. The MADDI page adds that MADDI 'Accelerates the billing process by automating matter reconciliation and categorizing deductions'. So the published AI functions are rule enforcement, matter reconciliation and classification of deductions; nothing states which parts are deterministic rules and which are model output.
Ask: Within BillBlast, which steps are deterministic billing rules and which are MADDI model output, and can the model-driven parts be disabled while the rule checks continue to run?
Deployment and where the service runs
Not confirmed
The BillBlast page publishes no deployment word at all — no cloud, SaaS, hosted or on-premises label, no architecture statement, and no BillBlast login or portal in Aderant's own site navigation, which lists product logins only for Milana, iTimekeep Desktop and iTimekeep Portal, read 2026-09-27. The MADDI page describes MADDI as 'the trusted AI foundation embedded across Aderant cloud solutions', which is a statement about MADDI rather than about how BillBlast is delivered. No page read names a cloud provider, a region or a country, and the Privacy Notice states only that data entered on Aderant's website is transferred to a server in the United States, which concerns the website.
Ask: How is BillBlast delivered for an Australian firm — cloud, hosted or on-premises — which provider and region hold the bill data and the delivery repository, and is an Australian region available?
Jurisdictional coverage of billing rules and formats
Not confirmed
The product is about bill preparation, compliance and delivery rather than law, and nothing on the pages read states which jurisdictions' requirements or which client billing formats are supported, read 2026-09-27. The page refers to 'billing & OCG compliance', 'client-defined formats' and 'numerous client-specific billing rules' without naming a format standard or a jurisdiction, and every named outcome and quoted client on the page is a United States firm, with '55% of the Am Law 200' as the published market reference. Nothing addresses Australian legal costs requirements such as costs disclosure, itemised bills on request or state-based trust and billing rules.
Ask: Which e-billing formats and client rule libraries are supported for Australian firms, and does BillBlast accommodate Australian costs-disclosure and itemised-bill requirements?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page, file or block telling AI models, assistants or crawlers how to describe the product. None was found on the BillBlast page, the MADDI page, the Privacy Notice, the APIs Terms of Use or the 'Aderant Expert: Safe and Secure Technology' page, and a 40-URL map of aderant.com saved in this project surfaced no /llms.txt, /ai-info or /for-ai page. The check is limited to those pages and that URL list. No comparative or superlative question about the vendor's own product is posed and answered in any published question-and-answer block on the pages read; the market-position claims on the BillBlast page appear as headings rather than as machine-readable Q&A.
Ask: Does Aderant publish any page, file or metadata addressed to AI models or crawlers setting out how BillBlast or MADDI should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority over the bill and over client portal data
Not confirmed
Two published functions touch a firm's authority over its own bills and over client data. First, the page states BillBlast 'resolves issues before submission' and can 'flag concerns within bills prior to submission', read 2026-09-27, without stating whether resolving an issue can alter a bill — a narrative, a code, a rate or an amount — and if so who authorises the change. Second, 'Automated Matter Reconciliation' aligns 'law firm records with client vendor portal data', so client-held data is read into firm records and matter information is mass-updated 'during significant changes, like hiring lateral attorneys or mergers and acquisitions'. Nothing published states what notice or authority Aderant expects a firm to have for either, and the Privacy Notice does not address it: it covers Aderant as controller of website and account data and states that where Aderant acts as processor for a customer the customer's own policies apply.
Ask: Can BillBlast change any figure, code or narrative on a bill before submission, and if so which role must approve it and is the change recorded against the original bill?
Foundation-model providers
Not confirmed
No model, version or supplier is named. The BillBlast page attributes rule enforcement, workflow automation and issue resolution to 'our AI, MADDI', read 2026-09-27. The MADDI page states MADDI is built 'By combining enterprise-grade model platforms with Aderant's legal-domain expertise and proprietary AI capabilities' without naming a platform, model or provider, and describes 'controlled orchestration, safeguards, and validation'. Neither the Privacy Notice nor the APIs Terms of Use names a model or inference provider, and no inference region is published.
Ask: Name every model and model platform MADDI uses for BillBlast rule enforcement, matter reconciliation and deduction categorisation, the supplying legal entity, and the country in which inference runs.
Subprocessors
Not confirmed
No subprocessor register or trust centre was found for Aderant or BillBlast, read 2026-09-27. The Privacy Notice refers generally to 'Third party service providers or other entities that perform services on our behalf', states they 'have access to personal information needed to perform their functions, but may not use it for other purposes', and lists recipient categories including affiliates and subsidiaries, service providers, professional consultants and vendors. None is named, and the notice is controller-facing rather than a processing schedule for the product. This matters here because bill delivery necessarily involves third parties: email delivery infrastructure and the client spend-management platforms into which eBills are submitted.
Ask: Provide the current dated sub-processor list for BillBlast and MADDI, including any email delivery provider and any e-billing network intermediary, with entity, country, purpose and data types.
Training on customer content
Not confirmed
No document read states whether a firm's bills, time narratives, matter data, deduction and rejection records or client portal data are used to train, tune or evaluate MADDI, read 2026-09-27. The BillBlast page publishes an aggregate outcome figure across clients — '37% Decrease in Fee Deductions Across All BillBlast Clients Compared to Prior Year' — which shows cross-client measurement but says nothing about model training. The nearest published clause concerns a different surface: section 5(b) of the APIs Terms of Use grants Aderant 'a perpetual, irrevocable, worldwide, sublicensable, royalty-free, and non-exclusive license to Use content submitted, posted, or displayed to or from the APIs' for the purpose of providing, securing and improving the APIs, where 'Use' means 'use, host, store, modify, communicate, and/or publish'.
Ask: Under which signed clause are our bills, narratives, deduction records and client portal data excluded from training, tuning and evaluation of MADDI, and does the APIs content licence reach data moved through Aderant APIs?
Feedback, monitoring and product improvement
Public claim only
The APIs Terms of Use state at section 2(g): 'If you provide feedback or suggestions about our APIs, then Aderant (and those allowed by Aderant) may use such information without obligation to you', and at section 3(a), in capitals, 'YOU AGREE THAT ADERANT MAY MONITOR USE OF THE APIs TO ENSURE QUALITY, IMPROVE ADERANT PRODUCTS AND SERVICES, AND VERIFY YOUR COMPLIANCE WITH THE TERMS', including Aderant accessing and using the customer's API client, read 2026-09-27. Both clauses are API-scoped. Nothing published says whether an equivalent monitoring or feedback right applies inside BillBlast, or whether a billing team's overrides of a flagged issue are fed back into MADDI.
Ask: Does an equivalent monitoring or feedback-use right apply to BillBlast itself, and are billing staff overrides of flagged issues used to improve MADDI?
Retention of bills, submissions and delivery evidence
Public claim only
The Privacy Notice (8 March 2024) states personal data is retained as long as necessary to fulfil the purposes it sets out unless law requires otherwise, including to provide requested products and services, maintain the business relationship, improve the business over time and ensure legality and security, 'or otherwise in accordance with our internal retention procedures', and that Aderant may retain personal data after a relationship is terminated, read 2026-09-27. Those internal procedures are not published. No period is published for bills, eBill submission records, rejection and deduction data, analytics history, or the 'centralized repository of sent items, bounce backs, and replies to substantiate delivery in case of client disputes' — a record a firm may need to keep for the life of a costs dispute.
Ask: State the default and configurable retention for bills, submission and rejection records and the proof-of-delivery repository, and confirm it can be set to match our costs-dispute and limitation-period obligations.
Deletion and erasure
Public claim only
The Privacy Notice sets out individual rights including deletion and portability, exercisable by email to a published address, through a data subject access request form or by writing to Aderant Holdings, Inc. in Atlanta, with a response within 30 days of receipt, read 2026-09-27. Those are individual rights over personal data held by Aderant as controller. No deletion commitment, period or certification is published for a firm's bill data, submission history, proof-of-delivery repository or analytics on exit, and the Privacy Notice states Aderant may retain personal data after a relationship is terminated.
Ask: On termination, what is deleted from BillBlast and from MADDI components, within what period, and will Aderant certify deletion in writing including by sub-processors and email delivery providers?
Vendor and provider access to content
Not confirmed
Nothing published states which Aderant staff can read a firm's bills, narratives, deduction records or client portal data, from which countries, or under what approval, read 2026-09-27. The Privacy Notice states third-party service providers have access to personal information needed to perform their functions, and that Aderant may process personal data for internal business purposes including monitoring service usage, auditing, and IT security and administration. No access log visible to the customer is described, and no page read distinguishes support access from production access.
Ask: Which Aderant roles in which countries can read our bills and client portal data, under what ticketed approval, and can we obtain that access log?
Access control, authentication and audit
Not confirmed
Nothing published describes authentication, roles, segregation of duties or audit logging for BillBlast, read 2026-09-27. The product page describes mass actions — mass invoice email 'with a click of a button' and mass update of matter information — without naming a role required to perform them, and no BillBlast login appears in Aderant's own published navigation. No page read states whether single sign-on, SCIM provisioning or enforced multi-factor authentication is available, or whether an exportable audit log records who submitted or re-sent which bill and what BillBlast changed before submission.
Ask: Confirm single sign-on, SCIM and enforced multi-factor authentication for BillBlast, which role is required to run a mass invoice send or mass matter update, and whether an exportable audit log records every automated change to a bill.
Encryption in transit and at rest
Not confirmed
No statement about encryption in transit or at rest for BillBlast appears on any page read, read 2026-09-27, which matters because the product's normal operation emails invoices — documents containing client names, matter descriptions and time narratives — out of the firm. The Privacy Notice states 'Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information.' The page titled 'Aderant Expert: Safe and Secure Technology' contains no security detail at all.
Ask: Specify encryption in transit and at rest for stored bills and the delivery repository, whether outbound invoice email is encrypted or authenticated (for example by TLS enforcement, DMARC or a secure link instead of an attachment), and whether customer-managed keys are available.
Independent security assurance
Not confirmed
No SOC 2, ISO/IEC 27001, ISO/IEC 42001 or other certification, audit report or penetration test is claimed for BillBlast or for Aderant on any page read, read 2026-09-27, including the page titled 'Aderant Expert: Safe and Secure Technology', which carries no certification, audit or penetration-test statement. No trust centre was found on aderant.com in the saved URL list.
Ask: Provide the current SOC 2 Type II or ISO/IEC 27001 report covering BillBlast and MADDI, with scope, period and exceptions, and state whether any AI management-system certification is held.
Contract, liability and forum
Public claim only
The only Aderant terms found published are the Aderant APIs Terms of Use, version 11 September 2020, read 2026-09-27. In them 'Aderant' means Aderant North America, Inc. of Tallahassee, Florida; section 10(b) applies Florida law with claims litigated exclusively in the federal or state courts of Leon County, Florida, except that for an entity outside North America the law of the applicable Aderant affiliate applies under separate agreements with affiliates in the United Kingdom, the Netherlands, New Zealand and Australia. Liability is limited to 'THE AMOUNT YOU PAID ADERANT TO USE THE APPLICABLE APIS DURING THE ONE (1) YEAR PRIOR TO THE EVENT GIVING RISE TO THE LIABILITY', with lost profits, revenues, data and consequential damages excluded and the APIs provided 'AS IS'. No customer master agreement, DPA or AI schedule for BillBlast is published, and the trademark footnote names Aderant Holdings, Inc. and records MADDI as a registered trademark of Aderant.
Ask: Which Aderant entity will contract with us for BillBlast, under which governing law and forum, and will you provide a DPA and an AI addendum with the master agreement?
Cross-border transfers and APP 8
Public claim only
The Privacy Notice states 'Data entered on our website are transferred to a server in the U.S. and stored there. Your data may be used and disclosed by the Company and its divisions, holding companies, subsidiaries and affiliates, or other entities outside of your country, including in countries that have a different standard of data protection than in your own country', and that for data subject to the GDPR Aderant uses the European Commission's Standard Contractual Clauses and adequacy mechanisms, read 2026-09-27. There is no equivalent statement for Australian Privacy Principle 8, no country named for product data or for MADDI inference, and no Australian data-residency option published. The product itself moves data across borders by design where an Australian firm bills an overseas client through that client's spend-management platform.
Ask: For an Australian firm, in which countries are bills, narratives and client portal data stored and backed up, in which country does MADDI inference run, and what APP 8 steps apply when a bill is submitted into an offshore client portal?
Incident notification and history
Public claim only
The Privacy Notice states 'While we work hard to protect data incidents, we have dedicated controls and procedures in place for when such situations, along with the procedures that are required to make notifications to you and to the relevant Supervisory Authority as appropriate', read 2026-09-27. No notification period from discovery is given, no reference is made to the Australian notifiable data breach scheme, and no commitment covers sub-processor or model-provider incidents. No incident history was found on the pages read. A misdirected mass invoice send is a foreseeable incident class for this product and is not addressed anywhere read.
Ask: State the contractual notification period from discovery, confirm cooperation with our obligations under Part IIIC of the Privacy Act 1988 (Cth) including for sub-processor incidents, and state how a misdirected bulk invoice delivery is handled and evidenced.
Change notice for terms, models and billing rules
Public claim only
The APIs Terms of Use state at section 10(a) that Aderant may modify the terms, that notice of modifications will be posted in the documentation of each applicable API, the access portal or the developers console, that changes will not apply retroactively and become effective no sooner than 30 days after posting, but that changes addressing new API functions or made for legal reasons are effective immediately, read 2026-09-27. The Privacy Notice carries a Last Updated date and no change-notice commitment. Nothing published commits Aderant to notice before changing the model behind MADDI, the billing rules BillBlast enforces, or the set of client portals supported.
Ask: What written notice will we receive before a change to the MADDI model, to the billing rules BillBlast enforces, or to the supported client portals and formats, and can we object?
Export and exit
Not confirmed
Nothing published describes exporting a firm's bills, submission and rejection history, deduction analytics or the proof-of-delivery repository out of BillBlast, in what format, or what happens at the end of a subscription, read 2026-09-27. The nearest published statement concerns developers rather than firms: section 5(d) of the APIs Terms of Use states 'Aderant supports data portability' and obliges a developer to let its own users export equivalent data as easily as from Aderant products, and section 8(b) requires a developer to delete cached content on termination.
Ask: What export formats and assistance apply to our bill history, submission records, deduction analytics and proof-of-delivery repository on exit, at what cost, and for how long is the data available after termination?
Connectors and data flow to clients and other products
Public claim only
The published connectors all move firm data outward: submission into client eBilling and spend-management platforms, mass invoice delivery by email, and reads of 'client vendor portal data' for matter reconciliation, read 2026-09-27. None of the platforms or portals is named. The APIs Terms of Use govern developer use of the Aderant Expert APIs: section 4(a) forbids sublicensing an API to a third party, section 2(d) allows Aderant to set usage limits, and section 5(c) states that non-public user content obtained through the APIs may not be exposed to other users or third parties without explicit opt-in consent from that user.
Ask: Which connectors will be enabled for us, what exactly does each send to or read from a client's portal, are credentials to client portals stored by Aderant, and can each connector be disabled per client?
Open-web retrieval
Not confirmed
No page read states that any BillBlast or MADDI component queries the open web, and none states positively that it cannot, read 2026-09-27. The MADDI page describes MADDI as embedded within Aderant workflows, working 'within the firm's existing controls' and aligning 'with their existing permissions, configurations, and governance', which is a description of scope inside the product rather than a statement about external retrieval. The nearest external data flow described for BillBlast is reads of client vendor portal data, which is a named third-party system rather than the open web.
Ask: Does any BillBlast or MADDI component send data to, or retrieve data from, any source outside our tenancy other than the client portals we nominate?
Autonomy and action control over outbound bills
Not confirmed
This product's published functions act outside the firm: 'Automated eBill Submission' into client platforms, 'Quickly produce and mass email invoices to clients with a click of a button', and MADDI that 'automates email and eBilling workflows, and resolves issues before submission', read 2026-09-27. No page read states whether a bill can be submitted or emailed to a client without a named human approval, what the approval step is, or whether a resolution applied before submission is queued for review. Aderant separately markets 'Aderant Agents' under an Agent Center, stating that 'Powered by MADDI, Aderant Agents help firms move from insight to action by automating repeatable work', and the reach of those agents into BillBlast data is not published.
Ask: Can BillBlast submit or email a bill to a client without a named human approval in any configuration, what is the rollback if it does, and which Aderant Agents can read or act on BillBlast data?
Human review before a bill leaves the firm
Not confirmed
No human review or approval step is described anywhere on the pages read, read 2026-09-27. The page describes flagging concerns before submission and resolving issues before submission, and the aggregate outcome it publishes is fewer rejections, but nothing states who sees a flag, who may clear it, or whether a reviewer is recorded against a bill. The comparable Aderant product page for iTimekeep does describe a reviewer workflow for time entries; the BillBlast page carries no equivalent, so no inference is drawn from it. The MADDI page states Aderant applies 'controlled orchestration, safeguards, and validation', which describes the vendor's approach rather than a customer-configurable control.
Ask: Is a human approval step enforceable in configuration before any bill is submitted or emailed, and is the approver, the original bill and every automated change recorded per bill?
