---
title: "Intapp Time (Integration Appliance, Inc. (Intapp))"
url: "https://ailawframework.com/software/intapp-time"
type: "software_profile"
site: "AI Law Framework"
id: "intapp-time"
vendor: "Integration Appliance, Inc. (Intapp)"
category: "Legal-specific"
segment: "Practice management"
confidence: "medium"
last_reviewed: "2026-09-27"
---

# Intapp Time (Integration Appliance, Inc. (Intapp))

> Timekeeping for professional firms: constructing time entries from captured activity, checking billing rules and narratives at the point of entry, and answering questions about engagement economics in natural language.

Canonical page: https://ailawframework.com/software/intapp-time  
Last reviewed: 2026-09-27

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Intapp Time as published, including the Celeste AI functions on its product page. Intapp Assist, Intapp Walls, Intapp Billstream and Celeste sold as a standalone product carry their own published sub-processors and need separate review.

## Capabilities

- Matter management
- Compliance monitoring
- Knowledge search
- Automatic time capture
- Billing narrative drafting

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | United States, European Union / EEA, Australia, Singapore, Canada, Another named location |
| Australian region | Unknown |
| Model providers | Microsoft Azure AI Services (published sub-processor for Intapp Time, for text generation), Microsoft Azure OpenAI Service (named at platform level, including 'Microsoft Azure OpenAI GPT-3.5'), Microsoft Azure AI Content Safety (moderation and content filtering), Amazon Web Services (Bedrock), published against Intapp Celeste as 'Generative AI services provider which hosts Anthropic models' |
| Assurance | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, CSA STAR, SOC 1, SOC 2, Global Privacy Recognition for Processors (PRP), Standard SIG 2024 Lite, GovRAMP member (published as pursuing verified offering status) |
| Training on customer content | Your account only |
| Retention | The Applied AI page states shared-model AI services 'are stateless and therefore designed to retain no data', that AI responses and the inputs used to generate them are transferred back to the initiating product and 'when appropriate, stored with client data', and that 'User interactions and AI results are also monitored and stored in client-specific databases.' No retention period is published for captured activity records, draft time entries, narrative corrections or AI interaction logs, and the customer data retention policy referred to on the cloud-security page was not read. |
| Integrations | Intapp Assist, Intapp Celeste |
| Pricing | No price, licence metric or term is published on the pages read, and no page states whether the Celeste AI functions are licensed separately from Intapp Time. The sub-processor list refers to 'where Celeste is provided as a standalone product', which shows Celeste is also sold on its own. The product page routes to 'Schedule a demo'. |
| Australian presence | Yes. The vendor publishes a group-members list headed 'Integration Appliance, Inc. Group Members' (read 2026-09-27) naming 'Intapp Pty Limited \| Australia \| Subsidiary', with the column heading 'Location of Processing'. No ACN or ABN is published there and the list does not identify which entity contracts with an Australian firm. Two Australian law firms appear on the Intapp Time product page: a chief information officer at Johnson Winter & Slattery is quoted on time capture, and a linked press release summary states 'Australian law firm Colin Biggers & Paisley has chosen Intapp Time to modernize its timekeeping practices'. In the published sub-processor register the Intapp Time section lists Microsoft Azure as cloud hosting provider with locations including Australia, 'Location dependent on the hosting location', a separate Amazon AWS row as cloud hosting provider with location United States and no regional note, and Microsoft Azure AI Services with location 'United States, EU*' and the footnote that customers located outside the US and EU 'will be processed in the EU'. |
| Website | https://www.intapp.com/time-tracking/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Product and plan covered | Public claim only | The product page publishes Intapp Time under three headings — capture, revenue governance and profitability — and states the product is 'powered by Celeste', which it names as the AI inside it. Celeste has its own product pages and is also listed in the sub-processor register as a product in its own right, including the phrase 'where Celeste is provided as a standalone product'. Nothing read states whether an Intapp Time subscription includes the Celeste functions or licences them separately. | On our Order and Sale Agreement, is Celeste included in Intapp Time or a separate line item, and which Celeste functions does our subscription switch on? | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors) |
| Functions published, and which are described as AI | Public claim only | Not described as AI on the product page: viewing and constructing time entries from recorded activity across work and browser applications, timekeeping across devices online or offline, and the layer that maintains narrative standards and billing rules the firm sets. Described as AI: Celeste as a named assistant 'Grounded in your data and billing requirements'; 'compliant, AI-generated time entries that resolve block billing issues'; recommended timekeeping and narrative corrections at the point of entry; autopopulated client, engagement and work codes as recommendations; conversion of voice or text notes into structured time entries; and querying engagement data in natural language to generate reports. The page's masthead phrase 'AI-native' is the vendor's framing of a product whose capture layer it does not describe as AI. | Which of these functions operate without the AI layer, and can we run Intapp Time with the Celeste functions switched off? | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) |
| Deployment and where the product runs | Public claim only | Cloud software. The Intapp Time section of the published sub-processor register lists Microsoft Azure as 'Cloud Services Hosting Provider' with locations 'United States, Ireland, Netherlands, UAE, Singapore, Australia, Canada' and the note 'Location dependent on the hosting location', and separately lists Amazon AWS as 'Cloud Services Hosting Provider' with location 'United States' and no regional note. The product page states 'Azure-backed reliability with multi-region redundancy and tested disaster recovery'. The Applied AI page adds that private models 'live alongside a client's own tenant in their regional cluster' while shared models are deployed among global clusters. No on-premises option was found. | For an Australian tenant, which components sit in the Australian Azure region, and what is the Amazon AWS United States row in the Intapp Time section used for? | [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors); [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) |
| Jurisdictions and content | Public claim only | Intapp Time is published as a timekeeping and revenue-governance product for professional firms; no primary-law content, court rules or jurisdiction-specific legal library is described. The billing rules and narrative standards enforced are described as the firm's own and as client billing requirements, not as published law. Two Australian law firms are named on the product page as customers. | Are any Australian-specific rules supplied out of the box, for example GST or trust-accounting narrative requirements, or must we configure every rule? | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) |
| Licence and commercial documents | Not confirmed | No pricing, licence metric, term or renewal provision was found on the pages read. The terms page at https://www.intapp.com/terms was discovered in a site map but not read within the credit budget. The sub-processor register and the group-members page refer to an 'Order and Sale Agreement' and to 'the Agreement' without publishing either. | Provide the Order and Sale Agreement and master terms that would apply to us, with the licence metric for Intapp Time and for the Celeste functions. | [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors); [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) |
| Capture surface and integrations | Public claim only | The product page describes capture 'across work and browser applications' without naming the applications, and publishes 'Integrations made easy' alongside the Azure statement. Intapp Assist is published as available inside Intapp Time. In the sub-processor register the Intapp Time section names Eleks Inc. for support and professional services across the United States, United Kingdom, Ukraine, Croatia, Germany, Canada, Estonia and Switzerland, Vention for professional services in the United States, Poland and Lithuania, and Amazon AWS Simple Email Service with locations including Australia. | List every application and browser the capture agent reads, what it records from each, and whether the list can be restricted by us. | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors) |
| Published figures and published limits | Public claim only | The product page asserts figures with no published method or source: 'Powering over $150 billion in annual billings', '$12 billion in annual incremental billings' and '75% faster time entry release'. The customer statements on the page are attributed testimonials, not independent evaluations. At platform level the vendor publishes its own limits: 'Intapp cannot guarantee that our models will be free from bias'; on hallucinations, 'while [they] can be reduced, for now they will almost always exist'; and on confidence scores, 'these scores cannot be used as absolute quality metrics'. No error rate for matter mapping or for generated narratives was published. | How were the billing and time-release figures measured, over what population, and do you have measured error rates for AI-generated time entries and narrative corrections? | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) |
| Tasks the product is published for | Public claim only | The published task is recording, correcting and releasing time and surfacing engagement economics, not legal work product. The Applied AI page states 'Intapp AI products are designed to perform inference on business processes' and 'Intapp Applied AI does not act or make decisions — the user is ultimately responsible for the action taken or decision made.' The product page describes AI-generated entries and corrections as arriving at the point of entry, where the fee earner is working. | At which point does a fee earner have to accept an AI-generated time entry or narrative correction, and can entries be released without that acceptance? | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) |
| Vendor content directing how AI describes the product | Not confirmed | Checked deliberately on 2026-09-27. None of the six Intapp pages read for this profile contains a block addressed to AI models, assistants or crawlers, and two earlier site-map operations over intapp.com, one searched for 'llms.txt', 'information for AI assistants' and 'ai-info', returned no such page. Recorded as not found rather than absent, because a search-filtered site map cannot prove a page does not exist. | Do you publish any page or file, including an llms.txt, that instructs AI models or crawlers how to describe Intapp Time? | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors); [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security) |
| Activity capture, staff notice and client authority | Not confirmed | The published function is that the product views and constructs time entries from recorded activity 'across work and browser applications'. Capture of that kind is workplace monitoring as well as billing capture, and none of the pages read contains staff-notice wording, a client-consent statement, or a description of what can be excluded from capture. The cloud-security page states only that 'Clients are responsible for all customer data they upload and process in the products.' No contractual clause on professional obligations or client disclosure was read. | What staff notice does an Australian firm need before the capture agent is switched on, can privileged or personal activity be excluded, and can capture be blocked on nominated matters? | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security) |
| Foundation-model providers and model choice | Public claim only | The Intapp Time section of the sub-processor register names Microsoft Azure AI Services for 'Processing services for artificial intelligence features (e.g. text generation), such as Intapp Assist', location 'United States, EU*'. The Intapp Celeste section names Amazon AWS (Bedrock) as 'Generative AI services provider which hosts Anthropic models', locations 'Australia, Canada, Germany, Ireland, Singapore, United States', with the note 'Location dependent on hosting location. Customer can select Anthropic or Azure OpenAI models.' Footnote 2 states that where a customer uses Celeste functionality along with another product, that product's sub-processors also include the Celeste sub-processors. Whether an Intapp Time tenant therefore gets the Anthropic or Azure OpenAI selection, and whether it can be exercised in the Australian Bedrock region, is not stated; facts.customerModelChoice is left null rather than inferred. | Does the published option to select Anthropic or Azure OpenAI models apply to our Intapp Time tenant, and if we choose Anthropic on Bedrock can that run in the Australian region? | [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) |
| Sub-processor register and change notification | Public claim only | Intapp publishes a per-product sub-processor register, effective 11 August 2026, with sub-processor, processing activities, locations and additional details, and prior versions back to February 2024 with effective date ranges. The Intapp Time section lists Amazon AWS (twice, for email and for cloud hosting), Eleks Inc., Intapp Affiliates, Microsoft Azure, Microsoft Azure AI Services and Vention. The page states updates will be posted there 'in accordance with the terms of the Agreement' and offers a subscription for notifications. Footnote 1 defines Intapp Affiliates as group companies providing support, maintenance, professional services and DevOps. | What notice and objection rights does our agreement give us when a sub-processor is added to the Intapp Time list, and will notice be given in writing? | [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors) |
| Training on customer content | Public claim only | The Applied AI page states client data 'is data uploaded by a client into Intapp cloud services. With client permission, this data is used to deliver private, client-specific AI models', distinguishes shared models from private models 'further fine-tuned using client-specific data', and states 'Intapp uses models directly trained with client data only to process or make inferences on the client's own data.' Asked whether a client can obtain a copy of a model trained on its data, the answer is 'No, fine-tuned models can only be used with Intapp products.' These are FAQ answers on a vendor page, not contractual terms, and the form of the client permission is not published. | Would our captured activity records, time narratives and billing data be used to fine-tune a private model, how is that permission given and withdrawn, and can we decline it and still use the AI functions? | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) |
| Feedback and telemetry | Public claim only | The Applied AI page states: 'Intapp does this only for private models, in which we use individual tenant feedback and data to incrementally train the new private version of the model for the same tenant. Common models are upgraded with data produced by Intapp, including from vendors and data providers.' It describes application data as all metadata-associated data and activity plus derived features and metrics, collected and stored in Intapp infrastructure to monitor system performance and user satisfaction, and states such data 'can be used by automated benchmarking and analytic processes to track algorithm performance and reliability'. The product page also publishes a function that tracks adoption of AI tools by engagement. | Does a fee earner's acceptance or rejection of an AI-generated time entry feed model training or benchmarking, and can we opt out while keeping the product? | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) |
| Retention of captured activity, prompts and outputs | Public claim only | The Applied AI page states shared-model services 'are stateless and therefore designed to retain no data' and that responses with their inputs are transferred back to the initiating product and 'when appropriate, stored with client data', with user interactions and AI results 'monitored and stored in client-specific databases'. The cloud-security page directs the reader to 'our customer data retention policy for more details'; that policy was not read. No period is published for captured activity records, rejected draft entries, narrative corrections or AI logs. | Provide the customer data retention policy and state how long captured activity, unreleased draft entries and AI interaction logs are kept, and whether we can shorten it. | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security) |
| Deletion and certified erasure | Public claim only | The only published deletion statement is on the Applied AI page: 'When a client's entire dataset is deleted, Intapp will delete the fine-tuned model (which can include client data).' No deletion period, no per-record deletion process and no certificate of deletion is published. The contractual return-or-delete provision would sit in the data processing addendum, whose body did not render on the page read. | On exit, what is deleted and when, including captured activity records and any fine-tuned model, and will you certify the deletion in writing? | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Data Processing Addendum (version index; current version effective 1 November 2025)](https://www.intapp.com/dpa) |
| Vendor and contractor access to content | Public claim only | The cloud-security page states 'Intapp employees do not access customer data unless they are directed to do so by the client', and the Applied AI page states client data is stored in each client's production environment 'where access is restricted to staff responsible for maintaining our services'. Against that, the Intapp Time section of the sub-processor register names Eleks Inc. for support and professional services across eight countries including Ukraine, Vention across three, and Intapp Affiliates across seven including Ukraine. A Tenant Access Policy is published at intapp.com/cloud/policies/tenant-access-policy/ and was not read. | Provide the Tenant Access Policy, and confirm whether Eleks, Vention or affiliate staff in Ukraine can access an Australian tenant's captured activity and time data. | [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors) |
| Authentication, single sign-on and audit | Not confirmed | Nothing on single sign-on, multi-factor authentication, role-based restriction or audit-log export was found on the six pages read. The Applied AI page states only that 'Our models are only accessible through internal product APIs. The service behind the API will ignore any unauthorized requests.' Intapp publishes a separate ethical-walls product and a Tenant Access Policy, neither of which was read. | Confirm single sign-on and enforced multi-factor authentication for Intapp Time, whether ethical walls limit what the AI can read, and whether we can export an audit log of AI-generated and AI-corrected entries. | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security) |
| Encryption and key management | Public claim only | The cloud-security page states: 'All cloud products use disk encryption (AES-256) at rest. All data in transit for external communications is HTTPS traffic-encrypted using TLS 1.2 or better. Traffic inside our VPC is encrypted based on the service-specific protocols. Keys are stored in FIPS-140-2 compliance key stores with Azure. Intapp maintains internal cryptographic use polices.' The Applied AI page adds that 'Client data is encrypted in transit throughout these steps' of AI processing. No customer-managed key option is published. | Are customer-managed keys available for an Australian tenant, and does the same key arrangement cover the captured activity store and the AI call path? | [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) |
| Independent security assurance | Public claim only | The cloud-compliance page publishes, with certificate links, ISO 27001, ISO 27017, ISO 27018 and ISO 27701 certification via Schellman, CSA STAR certification with a registry entry for Integration Appliance, Inc., SOC 1 and SOC 2, a Global Privacy Recognition for Processors certification, a Standard SIG 2024 Lite questionnaire, and GovRAMP membership described as 'actively pursuing a verified offering status'. The page does not state the SOC report type or period. The cloud-security page states penetration testing is completed 'at least annually by a CREST-approved third party', with executive summaries released on signed non-disclosure agreement and monthly network scanning. | Provide the current SOC 2 report with its type, period and exceptions, and confirm the certification scope covers Intapp Time and its capture agent. | [Intapp — Cloud compliance (published certifications)](https://www.intapp.com/cloud/compliance/); [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security) |
| Contracting entity, liability and forum | Not confirmed | No contracting entity, liability cap, indemnity or governing law for an Australian customer was established. The pages read refer to an 'Order and Sale Agreement' and to 'the Agreement' without publishing either; the terms page was discovered but not read; and the data processing addendum page rendered only its effective date, 1 November 2025, and a list of prior versions. The published group-members list names 'Intapp Pty Limited \| Australia \| Subsidiary' under the heading 'Location of Processing', which records processing location rather than the counterparty. No ACN or ABN is published. | Which entity contracts with an Australian firm, what is its ACN, what law and forum govern, and what liability cap applies to an AI-related claim? | [Integration Appliance, Inc. — Group Members](https://www.intapp.com/integration-appliance-inc/); [Intapp — Data Processing Addendum (version index; current version effective 1 November 2025)](https://www.intapp.com/dpa); [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors) |
| Cross-border transfers and where inference runs | Public claim only | The Intapp Time section of the sub-processor register gives Microsoft Azure AI Services, the AI processing entry, location 'United States, EU*' with the note: 'Location is dependent on the hosting location of the Customer, However, Customers that are located outside the US and EU will be processed in the EU'. The Applied AI page states the same in prose: 'For non-U.S. regions that do not yet support Intapp Applied AI's needed infrastructure, calls are routed to the EU infrastructure.' The same section lists Australia among the Microsoft Azure hosting locations and an Amazon AWS cloud hosting row with location United States. On the vendor's published list, therefore, application hosting can be in Australia while generative-AI processing for an Australian customer is stated to take place in the European Union, and one hosting row is United States only. | Name, for our tenant, the country of application hosting, backups, AI inference, support access and logs, and state whether Australian AI processing is available or planned with a date. | [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) |
| Incident notification | Not confirmed | No incident-notification period, breach-reporting commitment or incident history was found on the six pages read. The cloud-security and cloud-compliance pages cover certification, encryption and penetration testing but not notification. The body of the data processing addendum, where such a clause would normally sit, did not render on the page read. A cloud status site is published at status.my.intapp.com and was not read. | State the contractual notification period from discovery of a breach, whether it covers incidents at Microsoft Azure AI Services or at your support contractors, and any material incident in the last 24 months. | [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security); [Intapp — Data Processing Addendum (version index; current version effective 1 November 2025)](https://www.intapp.com/dpa) |
| Change notice for models, processors and features | Public claim only | The sub-processor page states updates will be posted there 'in accordance with the terms of the Agreement' and offers notification by subscription; prior versions from February 2024 are published with effective date ranges, as are prior addendum versions from November 2020. On model change the Applied AI page states comparative analysis of new technologies 'can lead to a partial or complete replacement or upgrade of some solutions when deemed necessary by Intapp', and that models are upgraded only when they outperform existing models. Intapp publishes a Cloud Maintenance Policy and a Deprecated Features Policy, neither of which was read. No notice period for a model change is published. | What written notice do we get before the model behind AI-generated time entries changes, and can a change be deferred while we retest against our billing rules? | [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Data Processing Addendum (version index; current version effective 1 November 2025)](https://www.intapp.com/dpa) |
| Export and exit | Not confirmed | No export format, exit assistance or post-termination data-availability period was found on the pages read. The only adjacent published statement is that a fine-tuned model cannot be taken away: 'No, fine-tuned models can only be used with Intapp products.' The contractual return-or-delete provision would sit in the addendum or master agreement, neither of which was read. | On exit, what can we export and in what formats — released time entries, unreleased entries, captured activity records, narrative history and audit logs — and over what period? | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Data Processing Addendum (version index; current version effective 1 November 2025)](https://www.intapp.com/dpa) |
| Connectors and outbound flows | Public claim only | The product page publishes that the product connects work activity with financial data and states 'Integrations made easy', without naming the practice-management or finance systems on the page read. Intapp Assist is published as available inside Intapp Time. The Applied AI page states 'No outputs of Intapp Applied AI pass directly to systems outside of Intapp infrastructure.' The sub-processor register names Amazon AWS Simple Email Service for the product, with locations including Australia. | Which finance or practice-management systems will Intapp Time connect to for us, in which direction does data flow, and what does each receive? | [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/); [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors) |
| Open-web search and grounding | Public claim only | The Intapp Time section of the sub-processor register names no web-search or web-grounding provider. Exa Labs Inc. appears under 'Intapp Celeste' with the activity 'Web grounding services' and location United States, and footnote 2 states that where a customer uses Celeste functionality along with another product, that product's sub-processors also include the Celeste sub-processors. Since the product page states Intapp Time is 'powered by Celeste', whether the Exa Labs path applies to an Intapp Time tenant is a question the published documents raise and do not answer. The Celeste AI is otherwise published as 'Grounded in your data and billing requirements'. | Does any Intapp Time function send text to Exa Labs or any other web-grounding service, and can web grounding be disabled for our tenant? | [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors); [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) |
| Autonomous action | Public claim only | The Applied AI page states 'Intapp Applied AI does not act or make decisions — the user is ultimately responsible for the action taken or decision made', and 'No outputs of Intapp Applied AI pass directly to systems outside of Intapp infrastructure.' The product page describes AI-generated time entries, autopopulated codes offered as recommendations, corrections recommended at the point of entry, and a function that surfaces unreleased, missing and non-compliant entries; it uses the phrase 'agentic revenue governance' without listing any action that executes without a person. Nothing read states whether a generated entry can be released without a fee earner accepting it. | List every action Intapp Time can take without a person confirming it, including releasing an entry or amending a narrative, and show the setting that prevents each. | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) |
| Human review before use | Public claim only | The Applied AI page states 'The output of our AI models is designed to be presented with context reminding users their review is necessary before acting on AI-generated information', and that most models return confidence scores that rank outputs but 'cannot be used as absolute quality metrics'. The product page positions corrections and recommendations at the point of entry, where the fee earner is working, and the Johnson Winter & Slattery statement on the page addresses capture rather than review. No contractual human-oversight obligation was read, and no product control that forces a named reviewer is described. | Which control forces a fee earner or a billing reviewer to accept an AI-generated entry or narrative before it reaches a prebill, and can that control be made mandatory by role? | [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted); [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) |

## Notes

facts.australianRegion is recorded as unknown rather than yes or no because the vendor's own published register points three ways at once for this product: Microsoft Azure appears as cloud hosting provider with Australia among its locations and the note 'Location dependent on the hosting location'; a second Amazon AWS row appears as cloud hosting provider with location United States and no regional note; and Microsoft Azure AI Services, the AI processing entry, is 'United States, EU*' with the footnote that customers outside the US and EU are processed in the EU. Nothing read states which component holds an Australian firm's data, so the value is left unknown and the three published rows are recorded in full in the deployment and transfers considerations. facts.customerModelChoice is left null for the same reason: the published statement 'Customer can select Anthropic or Azure OpenAI models' sits in the Intapp Celeste row, and although the product page says Intapp Time is 'powered by Celeste' and footnote 2 extends Celeste sub-processors to a product used with it, no document states that an Intapp Time tenant gets that selection. Could not be reached within the credit budget: the master terms at https://www.intapp.com/terms (discovered in a site map, not read); the body of the current data processing addendum, because https://www.intapp.com/dpa rendered only the effective date and version links; the technical and organisational measures annex at /dpa/scc-annex/; the privacy policy at /privacy/; the customer data retention policy referred to on the cloud-security page; the Tenant Access Policy at /cloud/policies/tenant-access-policy/; the Celeste product pages at /celeste/ and /celeste/governed-ai; and the Colin Biggers & Paisley press release at /news/colin-biggers-paisley-intapp-time/, which is recorded only from the summary printed on the product page itself. Four critical controls are therefore not verified — accessControl, contract, incidents and exit. Ownership, headquarters country and founded year are left null because no page read establishes them, and no ACN or ABN was found for the published Australian subsidiary Intapp Pty Limited. Carried forward from the capability research: transcription was deliberately not recorded as a capability, because the vendor publishes that voice notes are converted into structured time entries but does not offer a transcript as an output. Two capability values the controlled list cannot express are reported separately to the Maestro; matter-management and compliance-monitoring are recorded as the closest defensible values and understate the product's primary function, which is automatic time capture. Capability list updated 2026-09-27 when the controlled vocabulary was extended from 19 to 38 values: added automatic-time-capture, billing-narrative-drafting. Values already present were kept, because they remain true descriptions of what the product does. Recorded as tenant_only on 2026-09-27 when that value was added to the controlled TRAINING list. Previously 'yes', which overstated the published position: client data is used, with client permission, to build private client-specific models used only for inference on that client's own data, and tenant feedback retrains that tenant's private model only. Note the published condition of client permission, and that this remains a vendor_claim rather than a contractual term.

## Sources

- [Intapp Time — AI time tracking software (product page)](https://www.intapp.com/time-tracking/) (checked 2026-09-27)
- [Intapp — Applied AI: Trusted AI (architecture, models, data handling and governance FAQ)](https://www.intapp.com/data/applied-ai/trusted) (checked 2026-09-27)
- [Intapp — Sub-processors, effective 11 August 2026 (Intapp Time and Intapp Celeste sections)](https://www.intapp.com/sub-processors) (checked 2026-09-27)
- [Intapp — Data Processing Addendum (version index; current version effective 1 November 2025)](https://www.intapp.com/dpa) (checked 2026-09-27)
- [Intapp — Cloud security (encryption, penetration testing and data-access FAQ)](https://www.intapp.com/cloud/security) (checked 2026-09-27)
- [Intapp — Cloud compliance (published certifications)](https://www.intapp.com/cloud/compliance/) (checked 2026-09-27)
- [Integration Appliance, Inc. — Group Members](https://www.intapp.com/integration-appliance-inc/) (checked 2026-09-27)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.