SOC 2 in progress is not the same as SOC 2 certified

SOC 2 in progress is not the same as SOC 2 certified

A line that says "SOC 2 required" often gets treated as certified or nothing. That is a weak rule for AI timekeeping. It rewards a logo and punishes a vendor who states status in plain language.

LegalTime AI's public line is specific. A SOC 2 Type II examination is in progress. LegalTime AI is not SOC 2 certified today. Current controls and documentation are available under NDA. The companion overview is SOC 2 AI timekeeping for law firms. Primary pages: security and the FAQ.

Why "certified or we will not look" fails

What goes wrong Why it hurts the firm
Logo over report "Certified" without type, period, and scope is not diligence
Honest status gets filtered A vendor who says "in progress" drops out. A blurrier claim survives
Architecture never gets scored Where capture lives, who sees drafts, pause, and training policy are skipped

If the risk committee needs a completed Type II before production, say that plainly. That is a timeline choice. It is not the same as refusing to shortlist, read architecture, or run a limited pilot under NDA documentation.

Name the honest status, then evaluate controls and capture design.

What the phrases mean

Phrase What it means What it does not mean
SOC 2 Type II examination in progress An independent Type II examination is underway The firm is already certified
SOC 2 Type II certified A completed Type II report supports that public claim Every product behavior matches your risk tolerance without reading the report
SOC 2 Type I Controls were suitably designed at a point in time Operating effectiveness over a period
Docs under NDA You can review current controls before the report lands A substitute for a completed Type II when your policy requires one

Ask every vendor the same five questions.

  1. Type I or Type II?
  2. Report date, and the period covered?
  3. Which Trust Services Criteria are in scope?
  4. Can we review the report, or the current controls packet, under NDA?
  5. How do capture, draft storage, pause, purge, and release map to the controls described?

Write the answers down. Compare them on one grid.

Language that matches LegalTime AI today

Phrase Status
"SOC 2 Type II examination in progress" The public claim to use
"LegalTime AI is not SOC 2 certified" Accurate alongside it
"Happy to share security documentation under NDA" Safe to add
"SOC 2 Type II certified" or "LegalTime is certified" Not accurate until a completed report says so

Buying committees notice when Type I, Type II, and "in progress" get blurred. LegalTime AI uses the in-progress line on purpose.

From security and the FAQ, these controls can be evaluated now:

  • Raw activity is read and drafted locally on the attorney machine, and purged on a rolling basis. When Create is used, relevant activity is sent for AI processing.
  • Zero Data Retention agreements are in writing. Client content is not used to train a shared model.
  • A DPA is signed with every firm.
  • The released payload is the finished entry only: TLS 1.2+ in transit, AES-256 at rest.
  • Drafts are visible only to you until release. LegalTime AI is not a monitoring tool and will not build firm surveillance.
  • Pause is immediate. Nothing is recorded while paused.
  • LegalTime AI is a Clio Trusted Platform Developer.

Architecture companions: local-first AI timekeeping for lawyers and privacy-first AI timekeeping for law firms.

How other vendors talk about SOC 2

Certifications change. Treat this as a map, then confirm on each vendor's security page and under NDA. The public postures below are as of September 9, 2026, from primary pages and materials.

Vendor Public posture What to ask next
LegalTime AI SOC 2 Type II examination in progress; not certified; docs under NDA Current controls packet and timeline. The public status stays in progress
Ajax Live security page states SOC 2 Type II certified The current report under NDA. Prefer the live security page over older posts that still say Type I with Type II underway
PointOne SOC 2 Type 2, plus ISO 27001, GDPR, and HIPAA on homepage materials Report date and scope
Laurel SOC 2 Type 2, plus BYOK and ISO 42001 claims Report date, and tenancy claims for your matters
Billables AI Trust center posture; confirm it live Report type and date, not homepage adjectives
Clio Manage AI Inside Clio's security and compliance model How the Manage AI add-on is covered in Clio's reports. Confirm Clio's pricing and terms with Clio

Ajax's line comes from Ajax's live security page. The other lines come from those vendors. None of them is an endorsement. Product architecture, including Ajax, is in LegalTime AI vs Ajax. The wider map is best AI timekeeping tools for lawyers (2026).

Pair the report with the capture design

A Type II report does not automatically make a capture model acceptable. An examination still in progress does not automatically make a capture model unacceptable. Score both columns.

Column Questions that still matter
Certification Type I or II? Period and date? Scope? Report under NDA? Carve-outs?
Architecture Where does raw activity live before approval? Who sees drafts? Pause and purge? What leaves on release? Shared model training? A human billing gate?
Product question LegalTime AI
Where does raw activity live? On the attorney machine, local-first by default
Who sees drafts before release? Only you
What leaves on release? The finished entry only
Pause and purge? Immediate pause. Rolling purge of raw activity
Shared model training? No. Zero Data Retention is in writing
Human billing gate? Approve before release, on every entry
SOC 2 status Type II examination in progress. Not certified

When Create runs, relevant activity is sent for AI processing. ABA Formal Opinion 512 still expects lawyer oversight. Certification does not replace that gate.

RFP language that holds up

  1. Require type (I or II) and period or date in writing for any certification claim.
  2. Allow finalists that are Type II certified, or that can share a current controls packet under NDA with a stated examination timeline.
  3. Score capture architecture (local-first, screen and content, or API and metadata) on the same sheet as certification.
  4. Where client content is involved, require Zero Data Retention and a no-shared-training line in the DPA.
  5. Confirm draft visibility and pause with partners before production.
  6. Run a real work week. Measure review minutes and partner comfort.

A firm that must wait for a completed Type II can still shortlist, review controls under NDA, and plan go-live after the report. A firm that accepts in-progress status for a limited pilot should write down why the architecture and the NDA packet meet its bar.

Whether to wait

Choice When it fits
Wait for a completed Type II Written policy requires a current Type II report before any AI capture tool touches production matters
Evaluate now, go live after the report Architecture and the NDA packet clear partners. Production waits on the report
A controlled pilot now, under NDA docs The risk committee accepts in-progress status for a limited group while Type II completes

None of those choices requires anyone to describe LegalTime AI as certified. None of them requires dropping it from a privacy-first, Clio-firm shortlist only because the examination is still underway.

Pricing is quoted per attorney on pricing. G2 lists $125 per seat per month as a directory note. The trial is 30 days. Setup is about ten minutes per attorney. The Clio path is integrations/clio.

Names that are not this product

LegalTime AI at legaltime.ai is timekeeping that releases into your existing practice system. "Legaltime" on some directories is a separate practice-management product, often listed near $24 per user per month. Use the full name. More on about.

Sources

Related

Ask for report type and date. Read the packet under NDA. Score capture design beside certification.

Start a 30-day free trial · Book a 15-minute demo

Frequently asked questions

Is LegalTime AI SOC 2 certified?
No. A SOC 2 Type II examination is in progress. Current controls and documentation are available under NDA. See security.
Does examination in progress mean the same thing as certified?
No. In progress means the Type II examination is underway. Certified means a completed report supports that claim. LegalTime AI uses the in-progress language on purpose.
Should an RFP drop every vendor that is still in progress?
That is a weak default. Require type, date, and scope. Score where activity lives, who sees drafts, and pause. Allow an NDA review of current controls. If written policy requires a completed Type II before production, say so, and still read architecture on the shortlist.
Does Ajax have SOC 2 Type II?
Ajax's live security page states SOC 2 Type II certified. Ask Ajax for the current report under NDA. Prefer the live security page over older posts.
Does SOC 2 replace approve-before-release?
No. ABA Formal Opinion 512 still expects lawyer oversight. LegalTime AI keeps a human gate on every release.
Should we wait to trial until certification lands?
Some firms wait for a completed Type II. Others run the 30-day trial and review controls under NDA while the examination finishes, then time production to the report. Match the choice to the risk committee. Architecture, pause, and draft visibility still matter either way.

Start capturing the work you already do

Stop reconstructing your day from memory. Let capture run. Review in minutes. Release only what should bill.

Start a free trial

Capture → Create → Connect. Not a monitoring tool.

Start a free trial