Product and intended use
Define the configuration, people, information and tasks being assessed.
What this profile covers and how MADDI is licensed
Not confirmed
The vendor page states 'MADDI is the trusted AI foundation embedded across Aderant cloud solutions' and that 'askMADDI is currently available in:' four named products — Stridyn Analytics, Onyx, iTimekeep and Cloud General Ledger. Nothing read states whether MADDI or askMADDI is included in a host product's subscription, sold as a separate module, or gated to a tier, and no order form or price list is published. The separately marketed Aderant Agents and Aderant Agent Center are named on the same page and are outside this profile.
Ask: Is MADDI or askMADDI included in the subscription for each host product, or licensed and priced separately, and which tier of Stridyn Analytics, Onyx, iTimekeep and Cloud General Ledger includes it?
Published functions of MADDI and askMADDI
Public claim only
The vendor page attributes five functions to MADDI inside named products: in Onyx it 'Automates outside counsel guideline (OCG) compliance by extracting key terms from OCGs and enforcing them throughout the time and billing process'; in iTimekeep it 'Assists timekeepers in creating accurate, compliant time entries'; in BillBlast it 'Accelerates the billing process by automating matter reconciliation and categorizing deductions'; in Accounts Receivable Automation it works by 'automatically matching cash receipts to invoices and charges'; and in Cloud General Ledger it 'Delivers next-gen financial insights and automation using natural language queries'. For askMADDI the page states users 'can ask business questions in plain English and receive clear, structured answers', 'can also access in-product support and step-by-step troubleshooting guidance', and can 'get answers, find information, resolve issues, and complete tasks without leaving the systems they trust'.
Ask: For each of the five MADDI functions named on the page, what does the model actually receive, what does it output, and which of those outputs is written back to a record without a person confirming it?
How it is delivered and where it runs
Not confirmed
MADDI is published only as a layer inside Aderant cloud products; no standalone, on-premises or self-hosted form is described. No page read names the cloud provider, region or country for MADDI or for the host products, and no inference region is stated. The nearest published statement is on a 2023 Expert Sierra campaign page, which names 'AWS CloudWatch', 'nightly Tenable scans', 'CrowdStrike Falcon Complete' and 'Arctic Wolf's 24/7 CSOC center' as monitoring services and 'AWS benchmarking audits' as an audit, so Amazon Web Services is named for Expert Sierra without a region. The Privacy Notice states only that 'Data entered on our website are transferred to a server in the U.S. and stored there', which is about the website rather than the product.
Ask: In which AWS regions, or other regions, do the Aderant products that carry MADDI store data and run model inference for an Australian firm, and is an Australian region available?
Availability and release stage
Not confirmed
The page states 'askMADDI is currently available in:' and then names Stridyn Analytics, Onyx, iTimekeep and Cloud General Ledger. It does not say whether that availability is general, limited to some customers, or restricted by region, and it does not distinguish a preview from a released feature. The page links news items headed 'Aderant Launches Next-Gen Cloud Financial Management Applications at 2025 Momentum Global Event', which names askMADDI, and 'Aderant Introduces Agentic Law Firm Operations AI Agent Center', which the page attributes to Momentum Global 2026; neither release was read.
Ask: Is askMADDI generally available to every tenant of those four products today, including tenants contracted through the Australian Aderant affiliate, or is it limited by programme, tier or region?
Jurisdictional and Australian availability
Not confirmed
Nothing on the pages read states whether MADDI or askMADDI is available to Australian tenants, and no Australian or Asia-Pacific product page was found. Aderant's own About statement says the company 'has several other offices across North America, Europe, and Asia-Pacific' without naming a country. The APIs Terms of Use state that Aderant 'has subsidiaries and affiliated legal entities located in the United Kingdom, the Netherlands, New Zealand and Australia' and that separate agreements with those affiliates govern customers outside North America, so an Australian contracting path exists on the vendor's own terms, but the entity is not named.
Ask: Which Aderant legal entity would contract with an Australian firm for the products that carry MADDI, what is its ACN or ABN, and is askMADDI in scope of that entity's agreement?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27 for a page, file or block telling AI models, assistants or crawlers how to describe the product. A 60-URL map of aderant.com searched on terms including 'llms' returned no /llms.txt, /ai-info, /ai or /for-ai URL, and none of the MADDI page, the Privacy Notice, the APIs Terms of Use, the Expert Sierra security campaign page, the Product Vulnerability Disclosure Policy, the Business Continuity Plan or the page served at /itimekeep/security contains a block addressed to AI models or crawlers. No FAQ or machine-readable question-and-answer block appears on the MADDI page, so there is no vendor-answered comparative question about the product either. The check is limited to that URL map and those pages. Separately, the MADDI page carries self-descriptive headings including 'Leading the Way in Legal Tech AI'; that is ordinary marketing prose on a page addressed to readers, and it is recorded here only to note what was checked and set aside.
Ask: Does Aderant publish any page, file or metadata addressed to AI models, answer engines or crawlers setting out how MADDI or askMADDI should be described?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client authority and confidential client terms
Not confirmed
MADDI is stated to operate on a firm's own financial and billing data, including client contractual terms: in Onyx it works by 'extracting key terms from OCGs and enforcing them throughout the time and billing process'. Outside counsel guidelines are client documents and often confidential, and askMADDI is stated to answer questions across ledger, receivables and time data. No page read states whether that content is sent to a model outside the firm's tenancy, whether any client consent or notice is expected, or what a firm should tell clients whose guidelines and invoices are processed.
Ask: Are client outside counsel guidelines, invoices and matter financial data sent to any model or service outside our tenancy, and what notice or consent do you expect us to obtain from those clients?
Foundation-model providers
Not confirmed
No model, model family, version, platform or supplier is named anywhere read. The vendor's only statement is that MADDI is built 'By combining enterprise-grade model platforms with Aderant's legal-domain expertise and proprietary AI capabilities', and that 'Aderant applies controlled orchestration, safeguards, and validation'. Neither the Privacy Notice nor the APIs Terms of Use names a model or inference provider, and no page read distinguishes which MADDI functions use a general-purpose model from those using rules.
Ask: Name every model and model platform behind MADDI and askMADDI, the supplying legal entity, the region of each inference endpoint, and whether any of it is a third-party API call outside Aderant's own tenancy.
Subprocessors
Not confirmed
No subprocessor register, processing schedule or trust centre was found for Aderant. The Privacy Notice refers generally to 'Third party service providers or other entities that perform services on our behalf' and to recipient categories including affiliates, service providers, professional consultants and vendors, naming none, and it is controller-facing rather than a product processing schedule. The only named third parties found anywhere are on a 2023 Expert Sierra campaign page, which lists 'AWS CloudWatch, CrowdStrike Falcon Complete, nightly Tenable scans, and Arctic Wolf's 24/7 CSOC center' as monitoring services for that product; that is not published as a subprocessor list and is not stated to cover MADDI.
Ask: Provide a dated subprocessor register for MADDI and askMADDI, naming every entity including any model or inference provider, its country of processing, and our notice and objection rights.
Training on customer content
Not confirmed
No document read states whether a firm's ledger, receivables, time entries, OCG documents, askMADDI prompts or askMADDI answers are used to train, tune or evaluate any model. The MADDI page says only that MADDI 'helps keep customer data protected, private, and governed' and that it 'works within each firm's existing controls'. The iTimekeep page, where one askMADDI function sits, states 'AI trained for legal billing outcomes improves entry quality over time' without saying whose data is used. The nearest published clause is API-scoped: section 5(b) of the APIs Terms of Use grants Aderant a perpetual, irrevocable, worldwide, sublicensable, royalty-free and non-exclusive licence to use content submitted through the APIs.
Ask: Does any signed document prohibit training, fine-tuning, evaluation or product improvement on our financial data, OCG documents, askMADDI prompts and askMADDI outputs, by Aderant and by every model provider behind MADDI?
Use of feedback, corrections and telemetry
Public claim only
The APIs Terms of Use state at section 2(g): 'If you provide feedback or suggestions about our APIs, then Aderant (and those allowed by Aderant) may use such information without obligation to you', and at section 3(a) in capitals that the customer agrees Aderant 'MAY MONITOR USE OF THE APIs TO ENSURE QUALITY, IMPROVE ADERANT PRODUCTS AND SERVICES, AND VERIFY YOUR COMPLIANCE WITH THE TERMS'. Both clauses are scoped to the APIs. Nothing published says whether an equivalent monitoring or feedback right applies inside MADDI or askMADDI, or whether a user's correction of an askMADDI answer is retained and reused.
Ask: When a user corrects or rejects an askMADDI answer, where does that correction go, who can see it, and is it used to change model behaviour for other firms?
Retention of prompts, answers and derived data
Public claim only
The Privacy Notice (last updated 8 March 2024) states personal data is retained as long as necessary to fulfil the purposes it sets out unless law requires otherwise, 'or otherwise in accordance with our internal retention procedures', and that Aderant may continue to retain personal data after a relationship ends. Those internal procedures are not published. No retention period is published for askMADDI prompts, answers, extracted OCG terms, or the logs of MADDI actions inside the host products. The notice also states that where Aderant processes on behalf of a customer as a processor the customer's own policies apply.
Ask: How long are askMADDI prompts, answers and MADDI processing logs retained, where, and can retention be set to zero or to a period we choose?
Deletion on request and on exit
Public claim only
The Privacy Notice sets out individual rights including deletion and portability, exercisable by email to a published address, via a data subject access request form or by writing to Aderant Holdings, Inc. in Atlanta, with a response within 30 days of receipt. Those are individual rights over personal data Aderant holds as controller. No deletion commitment, period or certificate is published for a firm's askMADDI prompt history, AI-derived records or MADDI logs, and section 8(b) of the APIs Terms of Use — which addresses developers, not firms — is the only deletion-on-termination obligation found anywhere.
Ask: On termination, what is deleted, on what timetable, and will you certify deletion of askMADDI prompt and answer history and of any model artefacts derived from our data?
Aderant staff and contractor access
Not confirmed
Nothing published states which Aderant staff can read a firm's financial data, OCG terms or askMADDI prompts and answers, from which countries, or under what approval. The Privacy Notice states third-party service providers have access to personal information needed to perform their functions and that Aderant may process personal data for internal business purposes including monitoring service usage, auditing, and IT security and administration. The Expert Sierra campaign page refers to a 'globally disbursed cloud ops team and dedicated security team', and the Business Continuity Plan states Aderant manages 'a distributed services model, where our services and support teams, as well as critical systems, are spread across many locations', so support access is described as global without a country list. No customer-visible access log is described.
Ask: List every country from which Aderant staff or contractors can access our tenancy and our askMADDI history, and can we require named approval and see an access log?
Authentication and permissions
Not confirmed
The MADDI page states MADDI works 'within each firm's existing controls' and aligns 'with their existing permissions, configurations, and governance', and that askMADDI answers are returned 'within the Aderant workflows they already use'. That describes inheritance of host-product permissions, but no page read states whether single sign-on, enforced multi-factor authentication or SCIM provisioning is available for the host products, whether askMADDI can return data a user could not otherwise open, or whether an audit log of askMADDI queries can be exported.
Ask: Can askMADDI return any figure or document a user could not already open in the host product, and is a per-user query log available to firm administrators?
Encryption in transit and at rest
Not confirmed
No statement about encryption in transit or at rest for MADDI or its host products appears on any page read. The MADDI page states only that 'MADDI is designed with the security, privacy, and governance standards law firms require'. The Expert Sierra campaign page lists monitoring and audit services but names no encryption, protocol version or key management. The URL /itimekeep/security serves the iTimekeep product page and contains no security content, and the page titled 'Aderant Expert: Safe and Secure Technology' contains none either. The Privacy Notice states 'Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information.'
Ask: Specify the encryption in transit and at rest, and the key management, applied to data processed by MADDI and to askMADDI prompts and answers, and whether customer-managed keys are available.
Independent security assurance
Public claim only
No certification, audit report or trust centre is published for MADDI. A 2023 Expert Sierra campaign page states under 'Extensive Auditing': 'Annual Roper cybersecurity audits, SOC 2, pen tests, and AWS benchmarking audits'. It names no certified entity, no SOC 2 type, no audit period, no auditor and no scope statement, it concerns Expert Sierra rather than MADDI, and no report or certificate is published. No ISO/IEC 27001 or ISO/IEC 42001 claim was found anywhere, and the page titled 'Aderant Expert: Safe and Secure Technology' carries no certification statement. ISO 27001: the vendor's own page states "IGN uniquely delivers a single-provider approach as a licensed SOC 1 and SOC 2 Assessor, accredited ISO 27001, ISO 27701 and ISO 22301 Certification Body, HITRUST CSF Assessor firm, accredi" (https://www.aderant.com/news-pr/aderant-successfully-completes-soc-2-type-2-audit/, checked 2026-10-10). SOC 2: the vendor's own page states "F&e=page_viewed&u=e9753440-7d77-42da-b3de-ee871c2922cf-1791456108127)Aderant Successfully Completes SOC 2 Type II Audit - Aderant - [Home](https://www.aderant.com/ "Go to Home Page") -" (https://www.aderant.com/news-pr/aderant-successfully-completes-soc-2-type-2-audit/, checked 2026-10-10).
Ask: Provide the current SOC 2 report for the entity that operates the Aderant cloud products, with its scope statement and audit period, and state whether MADDI and askMADDI are in scope.
Contract, DPA, liability and forum
Public claim only
No subscription agreement or data processing agreement is published for any Aderant product. The only Aderant terms found published are the APIs Terms of Use, version 11 September 2020, in which 'Aderant' means Aderant North America, Inc. of Tallahassee, Florida; section 10(b) applies Florida law with claims litigated exclusively in Leon County, Florida, except that for an entity outside North America the law of the applicable Aderant affiliate applies under separate agreements with affiliates in the United Kingdom, the Netherlands, New Zealand and Australia. Those terms govern developer use of the Expert APIs, not MADDI. The Privacy Notice contains no data processing clauses for product data and states that where Aderant acts as a processor the customer's own policies apply.
Ask: Provide the subscription agreement and data processing agreement that would govern MADDI and askMADDI for an Australian firm, naming the contracting entity, its ACN or ABN, the governing law, the forum and the liability cap.
Cross-border transfers and APP 8
Public claim only
The Privacy Notice states 'Data entered on our website are transferred to a server in the U.S. and stored there. Your data may be used and disclosed by the Company and its divisions, holding companies, subsidiaries and affiliates, or other entities outside of your country, including in countries that have a different standard of data protection than in your own country', and for GDPR-subject data relies on the European Commission's Standard Contractual Clauses and adequacy mechanisms. There is no equivalent statement for Australian Privacy Principle 8, no country is named for product data or for model inference, and the Business Continuity Plan's description of teams and critical systems 'spread across many locations' names no country.
Ask: For an Australian firm, list every country in which data processed by MADDI is stored, sent for inference, supported, logged and backed up, and state which APP 8 mechanism you rely on.
Incident notification and history
Public claim only
Two published documents bear on this and neither commits to a notification period. The Privacy Notice states 'While we work hard to protect data incidents, we have dedicated controls and procedures in place for when such situations, along with the procedures that are required to make notifications to you and to the relevant Supervisory Authority as appropriate.' The Product Vulnerability Disclosure Policy (page author timestamp 6 September 2023) gives productsecurity@aderant.com for reports, asks reporters to treat submissions as confidential and not to disclose until 'public disclosure is mutually agreed upon with Aderant', states Aderant 'will respond and coordinate with you through resolution', and states 'We do not currently offer financial compensation for vulnerability reports'. Neither document gives a notification period from discovery, mentions the Australian Notifiable Data Breaches scheme, or covers a model provider's incident. No incident history was found.
Ask: What is your contractual notification period from discovery of an incident affecting MADDI or a model provider behind it, who is notified, and have there been any material incidents in the last 24 months?
Change notice for the model and the AI layer
Public claim only
The APIs Terms of Use state at section 10(a) that Aderant may modify the terms, that notice of modifications will be posted in the documentation of each applicable API, the access portal or the developers console, that changes will not apply retroactively and take effect 'no sooner than 30 days after they are posted', but that changes addressing new API functions or made for legal reasons are effective immediately. That clause is API-scoped. Nothing published commits Aderant to notify a firm before changing the model behind MADDI, the products askMADDI appears in, or what MADDI writes back to a record, and the MADDI page's list of host products carries no version or effective date.
Ask: Will you give us advance written notice before changing the model, the model provider or the scope of what MADDI writes back to our records, and how much?
Export and exit
Public claim only
No export or exit provision is published for MADDI, askMADDI or the host products, and no format, assistance or post-termination availability period is stated. The nearest published statements concern developers and continuity rather than a firm's own exit: section 5(d) of the APIs Terms of Use states 'Aderant supports data portability' and obliges a developer to let its own users export equivalent data as easily as from Aderant products, and section 8(b) requires a developer to delete cached content on termination. The Business Continuity Plan (Last Updated 26 January 2022) describes departmental continuity plans and a distributed services model but states no recovery time objective, recovery point objective or data-return commitment.
Ask: In what format can we export askMADDI prompt and answer history, extracted OCG terms and MADDI-generated records on exit, at what cost, and for how long after termination is the data available?
Connectors and data reach
Public claim only
The published reach of the AI layer is inside Aderant's own products: Stridyn Analytics, Onyx, iTimekeep, Cloud General Ledger, BillBlast and Accounts Receivable Automation. No connector to a document management system, email, an e-billing network, a general ledger outside Aderant, or a third-party AI tool is described for MADDI on the pages read. The APIs Terms of Use govern developer use of the Aderant Expert APIs: section 4(a) forbids sublicensing an API to a third party, section 2(d) allows Aderant to set usage limits, and section 5(c) states that non-public user content obtained through the APIs may not be exposed to other users or third parties without explicit opt-in consent.
Ask: Which systems outside Aderant can MADDI or askMADDI read from or write to, and can a firm block the AI layer from a named data set such as trust or payroll?
Retrieval beyond the firm's own data
Public claim only
The page describes askMADDI as operating inside Aderant workflows: users 'can get answers, find information, resolve issues, and complete tasks without leaving the systems they trust', with answers returned 'within the Aderant workflows they already use' and work done 'all within the firm's existing controls'. It also states askMADDI provides 'in-product support and step-by-step troubleshooting guidance', which implies a second source of content, vendor documentation, alongside firm data; the page does not say where that documentation sits. No page read states that any component queries the open web, and none states positively that it cannot.
Ask: Does askMADDI retrieve anything from outside our tenancy — the open web, Aderant's documentation corpus or another firm's data — and can external retrieval be disabled?
Autonomy and action control
Not confirmed
The page describes both advice and action and does not draw the line between them. askMADDI is described as answering questions and assisting, and in the same paragraph as letting users 'complete tasks'. MADDI in Onyx is described as 'enforcing' extracted OCG terms 'throughout the time and billing process'; in BillBlast as 'automating matter reconciliation and categorizing deductions'; and in Accounts Receivable Automation as 'automatically matching cash receipts to invoices and charges'. The page also states 'Powered by MADDI, Aderant Agents help firms move from insight to action by automating repeatable work' and names an Aderant Agent Center, and a video summary on the page refers to 'autonomous work-to-cash'. No page read states which of these actions execute without a person confirming, or whether that is configurable.
Ask: Which MADDI actions write to a ledger, invoice, receipt allocation or time record without a named human approval, and can each be set to propose-only?
Human review of AI output
Public claim only
The MADDI page states Aderant applies 'controlled orchestration, safeguards, and validation' and describes a pillar 'Responsible by Principle' as 'Designed to be governed, transparent, and human-centered'. Those are descriptions of the vendor's approach, not a customer-configurable control, and no document read makes review mandatory, describes an administrator setting that enforces it, or records who approved an AI-generated figure, narrative or reconciliation. For the iTimekeep surface the host product page does state entries 'come ready-to-review', which is a control in that product rather than in MADDI.
Ask: For each MADDI function, is human review enforced by the system or only available, which administrator setting controls it, and is the approver recorded in an exportable audit log?
