Product and intended use
Define the configuration, people, information and tasks being assessed.
Product, tier and product line
Public claim only
iTimekeep sits in Aderant's 'Work to Cash' product line alongside Onyx, Virtual Pricing Director and BillBlast, and separately from the Expert Sierra financial-management system; Aderant's site navigation lists MADDI and Stridyn under Platform and Aderant Agents under an Agent Center. The AI features are gated to a tier: the feature block is headed 'AI Timekeeping (NEW with iTimekeep Premium)'. The base product's timers, matter-adaptive timecards, Outlook capture, dashboards, rule validation and reviewer workflow are not described as AI.
Ask: Which iTimekeep tier is on our order form, and exactly which AI features are excluded from tiers below Premium?
What the AI does and what the rules engine does
Public claim only
The product page states: 'Work is automatically captured across ALL applications, reducing the need for lawyers to reconstruct their day', 'AI generates appropriate codes and a compliant narrative to ensure the firm gets paid', 'Time entries come ready-to-review to shift lawyers from "creators" to "reviewers"' and 'User-level controls and offline support enable review, rejection, and editing from anywhere.' On compliance it states 'AI + rule-based validation ensures entries align with firm and client requirements' and 'AI trained for legal billing outcomes improves entry quality over time', so the point-of-entry check is described as part rules engine and part AI. The MADDI page states askMADDI is available in iTimekeep 'For work descriptions and narrative suggestions'.
Ask: Which parts of the point-of-entry check are deterministic rules and which are model output, and can the model-generated part be turned off while keeping rule validation?
Deployment and where the service runs
Not confirmed
The product page carries one-word labels including 'Cloud' and 'SaaS' and no deployment detail. The two product logins published in Aderant's navigation for this product are iTimekeep Desktop and iTimekeep Portal, both at services.bellefieldcloud.com. No page read states which cloud provider, which region or which country hosts the service, and the Privacy Notice states only that data entered on Aderant's website is transferred to a server in the United States, which is a statement about the website rather than the product.
Ask: Which cloud provider and which region host iTimekeep for an Australian firm, including backups, and is an Australian region available?
Jurisdiction and billing-rule coverage
Not confirmed
The product is about time recording and billing compliance rather than law, and nothing on the pages read states which jurisdictions' or which clients' billing rule sets are supported, or whether Australian state-based costs-disclosure or trust requirements are addressed. The named customer outcomes on the page are United States firms, and the compliance claim is expressed as alignment with 'firm and client requirements' via an integration with Aderant's compliance platform.
Ask: Which billing rule sets and outside counsel guideline libraries are maintained for Australian firms, and who maintains them?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page or block telling AI models, assistants or crawlers how to describe the product. None was found on the iTimekeep page, the MADDI page, the Privacy Notice, the APIs Terms of Use or the 'Aderant Expert: Safe and Secure Technology' page, and a 40-URL map of aderant.com saved in this project surfaced no /llms.txt, /ai-info or /for-ai page. The check is limited to those pages and that URL list.
Ask: Does Aderant publish any page, file or metadata addressed to AI models or crawlers setting out how iTimekeep or MADDI should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority, staff monitoring and professional use
Not confirmed
The published function is automatic capture of work 'across ALL applications', which is workplace activity monitoring as well as billing capture. The page offers user-level controls and review, rejection and editing, but no page read states what a capture record contains — application names, document or matter names, window titles, URLs or content — and none states what notice or consent Aderant expects a firm to give its staff or clients. The Privacy Notice does not address it: it covers Aderant as controller of website and account data and states that where Aderant acts as processor for a customer the customer's own policies apply.
Ask: Exactly which fields does automated activity capture record, and can capture be excluded per application, per device, per matter or per user?
Foundation-model providers
Not confirmed
No model, version or supplier is named. The product page attributes narrative and code generation to 'our AI, MADDI'. The MADDI page states MADDI is built 'By combining enterprise-grade model platforms with Aderant's legal-domain expertise and proprietary AI capabilities' without naming a platform, model or provider, and describes 'controlled orchestration, safeguards, and validation'. Neither the Privacy Notice nor the APIs Terms of Use names a model or inference provider.
Ask: Name every model and model platform behind MADDI and askMADDI in iTimekeep, the supplying legal entity, the inference region, and whether any of it is a third-party API.
Subprocessors
Not confirmed
No subprocessor register or trust centre was found for Aderant or iTimekeep. The Privacy Notice refers generally to 'Third party service providers or other entities that perform services on our behalf', states they have access to personal information needed to perform their functions and may not use it for other purposes, and lists recipient categories including affiliates and subsidiaries, service providers, professional consultants and vendors. None is named, and the notice is controller-facing rather than a processing schedule for the product.
Ask: Provide the current dated sub-processor list for iTimekeep and MADDI, with entity, country, purpose and data types, and our notice and objection rights.
Training on customer content
Not confirmed
The product page states 'AI trained for legal billing outcomes improves entry quality over time to align time entries with real-world billing expectations' and describes 'domain-trained AI' without saying whose data is used. No document read states whether a firm's time entries, narratives or captured activity are used to train, tune or evaluate MADDI. The nearest published clause concerns a different surface: section 5(b) of the APIs Terms of Use grants Aderant 'a perpetual, irrevocable, worldwide, sublicensable, royalty-free, and non-exclusive license to Use content submitted, posted, or displayed to or from the APIs' for the purpose of providing, securing and improving the APIs, where 'Use' means 'use, host, store, modify, communicate, and/or publish'.
Ask: Under which signed clause is our time-entry, narrative and captured-activity data excluded from training, tuning and evaluation of MADDI, and does the APIs content licence reach data moved through Aderant APIs?
Feedback, monitoring and product improvement
Public claim only
The APIs Terms of Use state at section 2(g): 'If you provide feedback or suggestions about our APIs, then Aderant (and those allowed by Aderant) may use such information without obligation to you', and at section 3(a), in capitals, 'YOU AGREE THAT ADERANT MAY MONITOR USE OF THE APIs TO ENSURE QUALITY, IMPROVE ADERANT PRODUCTS AND SERVICES, AND VERIFY YOUR COMPLIANCE WITH THE TERMS', including Aderant accessing and using the customer's API client. Both clauses are API-scoped. Nothing published says whether an equivalent monitoring or feedback right applies inside iTimekeep, or whether corrections a lawyer makes to a generated narrative are fed back into the model.
Ask: Does an equivalent monitoring or feedback-use right apply to iTimekeep itself, and are lawyer edits to generated narratives used to improve the model?
Retention of capture data, prompts and outputs
Public claim only
The Privacy Notice (8 March 2024) states personal data is retained as long as necessary to fulfil the purposes it sets out unless law requires otherwise, including to provide requested products and services, maintain the business relationship, improve the business over time and ensure legality and security, 'or otherwise in accordance with our internal retention procedures', and that Aderant may retain personal data after a relationship is terminated. Those internal procedures are not published, and no period is published for captured activity records, generated narratives or askMADDI prompts and responses.
Ask: State the default and configurable retention for captured activity records, generated narratives, rejected suggestions and askMADDI prompts, and whether any of it can be set to zero.
Deletion and erasure
Public claim only
The Privacy Notice sets out individual rights including deletion and portability, exercisable by email to a published address, through a data subject access request form or by writing to Aderant Holdings, Inc. in Atlanta, with a response within 30 days of receipt. Those are individual rights over personal data held by Aderant as controller. No deletion commitment, period or certification is published for a firm's time-entry data, capture history or AI artefacts on exit.
Ask: On termination, what is deleted from iTimekeep and from MADDI components, within what period, and will Aderant certify deletion in writing including by sub-processors?
Vendor and provider access to content
Not confirmed
Nothing published states which Aderant staff can read a firm's time entries, narratives or captured activity, from which countries, or under what approval. The Privacy Notice states third-party service providers have access to personal information needed to perform their functions, and that Aderant may process personal data for internal business purposes including monitoring service usage, auditing, and IT security and administration. No access log visible to the customer is described.
Ask: Which Aderant roles in which countries can read our captured activity and time entries, under what ticketed approval, and can we obtain that access log?
Access control, authentication and audit
Not confirmed
The product describes user-level controls, offline support for review, rejection and editing, and a reviewer role that can approve, edit and manage time as well as the creator. Two product entry points are published, iTimekeep Desktop and iTimekeep Portal, both at services.bellefieldcloud.com. No page read states whether single sign-on, SCIM provisioning or enforced multi-factor authentication is available, or whether an audit log of AI-generated, edited and rejected entries can be exported.
Ask: Confirm SSO, SCIM and enforced multi-factor authentication for both iTimekeep clients, and whether an exportable audit log distinguishes AI-generated from human-entered time.
Encryption in transit and at rest
Not confirmed
No statement about encryption in transit or at rest for iTimekeep appears on any page read. The product page carries a one-word 'Security' label with no detail. The Privacy Notice states 'Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information.' The page titled 'Aderant Expert: Safe and Secure Technology' contains no security detail at all — it describes implementation and partnership for the Expert platform.
Ask: Specify the encryption in transit and at rest, and the key management, applied to captured activity, time entries and any data sent to a model, and whether customer-managed keys are available.
Independent security assurance
Public claim only
No SOC 2, ISO/IEC 27001, ISO/IEC 42001 or other certification or audit report is claimed on any page read, including the page titled 'Aderant Expert: Safe and Secure Technology', which carries no certification, audit or penetration-test statement. No trust centre was found on aderant.com in the saved URL list. GDPR: the vendor's own page states "dn.safebase.io/public/620d076d10c3f0257424ada17a07a1bede701e64/images/certifications/gdpr.svg)\\ \\ GDPR](https://trust.aderant.com/?itemUid=45220873-6e51-4dbb-b1b1-37d66ee9ef95&source" (https://trust.aderant.com/, checked 2026-10-10). SOC 2: the vendor's own page states "4b96-8513-17a798de922b-1791456634133)Aderant’s iTimekeep AI-Powered Solution Successfully Completes SOC 2 Type 2 Audit with Zero Exceptions Noted - Aderant - [Home](https://www.aderant" (https://www.aderant.com/news-pr/aderant-itimekeep-ai-powered-solution-completed-soc-2-type-2-audit/, checked 2026-10-10).
Ask: Provide the current SOC 2 Type II or ISO/IEC 27001 report covering iTimekeep and MADDI, with scope, period and exceptions, and state whether any AI management-system certification is held.
Contract, liability and forum
Public claim only
The only Aderant terms found published are the Aderant APIs Terms of Use, version 11 September 2020. In them 'Aderant' means Aderant North America, Inc. of Tallahassee, Florida; section 10(b) applies Florida law with claims litigated exclusively in the federal or state courts of Leon County, Florida, except that for an entity outside North America the law of the applicable Aderant affiliate applies under separate agreements with affiliates in the United Kingdom, the Netherlands, New Zealand and Australia. Liability is capped at the amount paid to Aderant for the applicable APIs in the one year before the event, with consequential and similar damages excluded, and the APIs are provided 'AS IS'. No customer master agreement, DPA or AI schedule for iTimekeep is published, and the trademark footnote names Aderant Holdings, Inc.
Ask: Which Aderant entity will contract with us for iTimekeep, under which governing law and forum, and will you provide a DPA and an AI addendum with the master agreement?
Cross-border transfers and APP 8
Public claim only
The Privacy Notice states 'Data entered on our website are transferred to a server in the U.S. and stored there. Your data may be used and disclosed by the Company and its divisions, holding companies, subsidiaries and affiliates, or other entities outside of your country, including in countries that have a different standard of data protection than in your own country', and that for GDPR-subject data Aderant uses the European Commission's Standard Contractual Clauses and adequacy mechanisms. There is no equivalent statement for Australian Privacy Principle 8, no country named for product data or for AI inference, and no Australian data-residency option published.
Ask: For an Australian firm, in which countries are time entries and captured activity stored and backed up, in which country does inference for narrative and code generation run, and what APP 8 steps apply?
Incident notification and history
Public claim only
The Privacy Notice states 'While we work hard to protect data incidents, we have dedicated controls and procedures in place for when such situations, along with the procedures that are required to make notifications to you and to the relevant Supervisory Authority as appropriate.' No notification period from discovery is given, no reference is made to the Australian notifiable data breach scheme, and no commitment covers sub-processor or model-provider incidents. No incident history was found on the pages read.
Ask: State the contractual notification period from discovery, and confirm cooperation with our obligations under Part IIIC of the Privacy Act 1988 (Cth) including for sub-processor incidents.
Change notice for terms, models and capture scope
Public claim only
The APIs Terms of Use state at section 10(a) that Aderant may modify the terms, that notice of modifications will be posted in the documentation of each applicable API, the access portal or the developers console, that changes will not apply retroactively and become effective no sooner than 30 days after posting, but that changes addressing new API functions or made for legal reasons are effective immediately. The Privacy Notice carries a Last Updated date and no change-notice commitment. Nothing published commits Aderant to notice before changing the model behind MADDI, the capture scope or the AI features in a tier.
Ask: What written notice will we receive before the model behind MADDI, the capture scope or the AI features included in our tier change, and can we object?
Export and exit
Not confirmed
Nothing published describes exporting a firm's time entries, narratives or capture history out of iTimekeep, in what format, or what happens at the end of a subscription. The nearest published statement concerns developers rather than firms: section 5(d) of the APIs Terms of Use states 'Aderant supports data portability' and obliges a developer to let its own users export equivalent data as easily as from Aderant products, and section 8(b) requires a developer to delete cached content on termination.
Ask: What export formats and assistance apply to our time entries, narratives and capture history on exit, at what cost, and how long is data available after termination?
Connectors, APIs and data flow to other products
Public claim only
Published integration points are the Outlook integration, the integration with Aderant's compliance platform for point-of-entry validation, and askMADDI, which the MADDI page places in Onyx, Stridyn Analytics, Cloud General Ledger and iTimekeep. The APIs Terms of Use govern developer use of the Aderant Expert APIs: section 4(a) forbids sublicensing an API to a third party, section 2(d) allows Aderant to set usage limits, and section 5(c) states that non-public user content obtained through the APIs may not be exposed to other users or third parties without explicit opt-in consent from that user.
Ask: Which connectors will be enabled for us, what data does each move between iTimekeep and other Aderant products or third parties, and can each be disabled?
Open-web retrieval
Public claim only
The MADDI page describes askMADDI as working inside Aderant workflows: users 'can get answers, find information, resolve issues, and complete tasks without leaving the systems they trust', and it is said to work 'within the firm's existing controls' and to align 'with their existing permissions, configurations, and governance'. No page read states that any component queries the open web, and none states positively that it cannot.
Ask: Does any MADDI or askMADDI component in iTimekeep send data to, or retrieve data from, the open web or any source outside our tenancy?
Autonomy and action control
Not confirmed
For iTimekeep the published design puts a person after the AI: entries 'come ready-to-review' and user-level controls enable review, rejection and editing. Two things are not settled by the pages read: whether an entry can post or bill without a human step in any configuration, and how far the separately marketed Aderant Agents reach into iTimekeep data — Aderant lists 'Aderant Agents' under an Agent Center, states that 'Powered by MADDI, Aderant Agents help firms move from insight to action by automating repeatable work', and says askMADDI lets users 'complete tasks'.
Ask: Can automated capture post or bill a time entry without a named human approval in any configuration, and which Aderant Agents can read or act on iTimekeep data?
Human review before use
Public claim only
The product page states time entries 'come ready-to-review to shift lawyers from "creators" to "reviewers"', that user-level controls enable review, rejection and editing, and it links a feature note on reviewers approving, editing and managing time. No document read makes review mandatory, describes an administrator setting that enforces it, or records who approved a generated narrative. The MADDI page states Aderant applies 'controlled orchestration, safeguards, and validation', which is a description of the vendor's approach rather than a customer-configurable control.
Ask: Is a reviewer step enforceable in configuration for every AI-generated entry, and is the reviewer, the original suggestion and the edit recorded per entry?
