Security

Protection built for privileged work.

Your clients trust you with their most sensitive matters. LegalTime is designed so that trust never has to extend past your own machine.

Local-first by design

Raw activity is read and stored on the attorney's machine. It never leaves.

Zero Data Retention

ZDR agreements in writing. Raw activity data is purged automatically on a rolling basis.

No model training

Your client content never trains shared models. That commitment is part of every agreement we sign.

Encrypted in transit

The entries you release travel to your billing system over TLS 1.2+, through your firm’s own login.

Instant pause

One click stops capture entirely, and nothing is recorded until you resume. Personal time stays personal.

You approve every release

Nothing reaches your billing system without your explicit click. Drafts are visible to you alone.

Report a security issue

Help us keep LegalTime safe.

If you believe you have found a security or privacy issue, email team@legaltime.ai. Please include the affected product or URL, a concise description, and safe reproduction steps when available. Do not include client work product, health information, credentials, or access tokens.

The machine-readable disclosure contact is available at /.well-known/security.txt. Current service availability is published on the LegalTime status page.

What to include

Tell us which product or URL is affected, the potential impact, and enough detail to reproduce the issue. Please redact personal, client, health, and other confidential information from your report.

Safe research

Test only accounts and data you own or are authorized to use. Do not access, copy, alter, or retain another person’s data; do not run denial-of-service tests; and stop testing as soon as you have enough evidence to explain the issue.

What we do

We review reports received at team@legaltime.ai, route them to the people responsible for security response, and work with the reporter on reasonable follow-up. Good-faith research that follows these boundaries will be treated as authorized and will not be pursued as a security violation by LegalTime.

Security questions, answered.

Where does my data live?

On your machine. LegalTime reads your activity locally, drafts entries locally, and purges raw data on a rolling schedule. The only thing that ever leaves is an entry you chose to release.

Do you train AI models on our data?

No. We sign Zero Data Retention agreements and never train shared models on client content. Improvements to your drafts come from your own corrections, scoped to your account.

Can my firm or other partners see my drafts?

No. Drafted entries are visible only to you until you release them. LegalTime is not a monitoring tool, and we will not build one.

What exactly leaves my computer when I release an entry?

The finished entry: narrative, matter, billing code, and duration. It is sent to your billing system through your firm’s existing connection, encrypted in transit. The underlying screen activity stays on the machine.

Can I pause capture?

Yes, with one click, and capture stays off until you turn it back on. Nothing is recorded while paused.

What happens to our data if we stop using LegalTime?

Uninstalling removes capture, locally stored raw data is purged, and the entries already in your billing system remain yours, where they always were.