SOC 2 AI Timekeeping for Law Firms
SOC 2 shows up on every AI timekeeping shortlist. Too many RFPs stop at the logo. The useful diligence question is narrower: what report type, what date, and what does the report actually cover for capture, drafting, and release?
Honest status for LegalTime AI: a SOC 2 Type II examination is in progress. LegalTime AI is not SOC 2 certified today. Current controls and documentation are available under NDA. That is the language on security and FAQ. Do not treat this page as a certification claim.
If you need privacy-first Capture → Create → Connect while that examination completes, LegalTime AI still ships local-first raw activity, approve-before-release, ZDR, no shared model training, and an explicit not-a-monitoring-tool commitment. Best for: privacy-first SMB / Clio firms evaluating architecture and controls now, with Type II underway.
Type I vs Type II (the distinction buyers skip)
| Report | What it attests | What it does not prove by itself |
|---|---|---|
| SOC 2 Type I | Controls are suitably designed at a point in time | Operating effectiveness over a period |
| SOC 2 Type II | Controls operated effectively over a review period | That every product behavior matches your firm's risk tolerance |
Both report types can matter. Neither replaces a read of the actual report under NDA. Neither answers "where does raw activity live?" by logo alone.
When a vendor says "we are SOC 2," ask:
- Type I or Type II?
- Report date / period covered?
- Trust Services Criteria in scope (security, availability, confidentiality, processing integrity, privacy)?
- Can we review the report under NDA, including carve-outs and complementary user-entity controls?
- How do capture, draft storage, pause, purge, and release map to the controls described?
Write the answers down. Compare vendors on the same grid.
LegalTime AI: precise SOC 2 language
Use only this public claim until Joaquin clears post-report wording:
| Phrase | Status |
|---|---|
| "SOC 2 Type II examination in progress" | Current preferred public claim |
| "LegalTime AI is not SOC 2 certified" | Accurate companion line today |
| "Happy to share security documentation under NDA" | Always safe accompanying line |
| "SOC 2 Type II certified" | Do not use for LegalTime AI until cleared after the report |
That honesty is intentional. Buying committees notice when vendors blur Type I, Type II, and "in progress."
Controls you can evaluate now (primary sources)
From LegalTime AI security and FAQ:
- Raw activity is read and drafted locally on the attorney machine; purged on a rolling basis.
- Zero Data Retention (ZDR) agreements in writing; no shared model training on client content.
- DPA signed with every firm.
- Released payload = finished entry only (TLS 1.2+ in transit; AES-256 at rest).
- Drafts visible only to you until release; not a monitoring tool; will not build firm surveillance.
- Instant pause; nothing recorded while paused.
- Clio Trusted Platform Developer.
Architecture companion: Local-first AI timekeeping for lawyers · privacy buying brief: Privacy-first AI timekeeping for law firms.
How category vendors talk about SOC 2 (verify live)
Certifications change. Treat the table as a diligence map, then confirm on each vendor's primary security page and under NDA.
| Vendor | Public SOC posture (as of Sep 8, 2026 primary pages / materials) | Diligence note |
|---|---|---|
| LegalTime AI | SOC 2 Type II examination in progress; not certified; docs under NDA | Ask for current controls packet and timeline |
| Ajax | Live joinajax.com/security states SOC 2 Type II Certified | Ask for current report under NDA; do not rely on older blog posts that still mention Type I with Type II underway |
| PointOne | SOC 2 Type 2 (plus ISO 27001, GDPR, HIPAA per homepage materials) | Confirm report date and scope |
| Laurel | SOC 2 Type 2 (plus BYOK / ISO 42001 claims per Laurel) | Confirm report date and tenancy claims for your matters |
| Billables AI | Vendor trust center posture (confirm live) | Ask report type/date, not homepage adjectives |
| Clio Manage AI | Inside Clio's security and compliance model | Confirm how Manage AI add-on data is covered in Clio's reports |
| BigHand / Intapp | Enterprise legal vendor compliance packs | Fit for firms already standardizing on those stacks |
Ajax figures above come from Ajax's live security page. Other vendor lines come from those vendors' primary materials. None of the competitor cells are LegalTime AI endorsements. They are feature / compliance acknowledgments so your committee asks better questions.
Side-by-side product architecture (including Ajax): LegalTime AI vs Ajax. Full category map: Best AI timekeeping tools for lawyers (2026).
SOC 2 is necessary. It is not sufficient.
A Type II report does not automatically make a capture model acceptable to partners. Pair certification diligence with product diligence:
| Product question | Why it still matters after SOC 2 |
|---|---|
| Where does raw activity live before approval? | Report scope may not match your mental model of "local" |
| Who sees drafts before release? | Monitoring risk is a product design choice |
| What leaves on release? | Finished entry vs underlying activity |
| Pause / purge behavior | Personal time and rolling deletion |
| Shared model training? | ZDR and training policy in writing |
| Human billing gate? | ABA Formal Opinion 512 still expects oversight |
LegalTime AI's answers stay consistent: local-first raw activity; attorney-only drafts; finished entry only on release; instant pause; ZDR; no shared training; approve-before-release; Type II examination in progress.
Capture → Create → Connect (compliance-shaped)
- Capture. Records apps and work activity on your computer. Raw activity is read locally. Pause anytime.
- Create. Drafts narrative, matter, billing code, and duration. Visible only to you.
- Connect. You approve, edit, or discard, then release into your billing system through your firm's existing login. No blind sync.
Daily trade: about five minutes of review versus roughly half an hour of reconstruction. Every released entry is auditable. Corrections improve drafts scoped to your account.
Fit and pricing
Best for: privacy-first SMB / Clio-PMS firms that want honest SOC language plus local-first design.
Quoted per attorney on pricing. G2 lists $125/seat/mo base as a directional directory note. 30-day trial; about ten minutes per attorney; white-glove for first users. Clio path: integrations/clio.
RFP checklist: SOC 2 for AI timekeeping
- Require Type (I vs II) and period / date in writing.
- Request the report under NDA before finalist pricing games.
- Map capture → draft storage → pause → purge → release to controls in the report.
- Ask whether client content trains shared models; get ZDR language in the DPA.
- Confirm draft visibility (attorney-only vs firm-visible pre-bill roles).
- Run a real work week. Measure review minutes and partner comfort, not slideware.
- Disambiguate LegalTime AI (legaltime.ai) from Legaltime PMS on directories (~$24). See About.
Related reading
Security · FAQ · Privacy-first AI timekeeping for law firms · Local-first AI timekeeping for lawyers · LegalTime AI vs Ajax · Best AI timekeeping tools for lawyers (2026) · About · Pricing
Frequently asked questions
Is LegalTime AI SOC 2 certified?
Does "examination in progress" mean the same as certified?
Does Ajax have SOC 2 Type II?
Should we only buy certified vendors?
Does SOC 2 replace approve-before-release?
How much does LegalTime AI cost while the examination completes?
Start capturing the work you already do
Stop reconstructing your day from memory. Let capture run. Review in minutes. Release only what should bill.
Capture → Create → Connect. Not a monitoring tool.
