An AI timekeeper can be safe for client data, but only if you know what it captures, where that information goes, how long it stays there and who can see it. The tool sees the same emails, documents and calls you do. Before anyone at your firm installs one, get clear, written answers to the nine questions below.
This is general information, not legal advice. Your jurisdiction's rules and your clients' requirements come first.
Why it matters
For lawyers, ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of, or access to, information about a client's representation. In July 2024 the ABA's ethics committee issued Formal Opinion 512, its first guidance on generative AI. It reminds lawyers that the duty of confidentiality applies when they use AI tools, along with the duties of competence and communication. Accounting and consulting firms have similar duties under their own professional codes and client contracts.
A timekeeping tool is easy to overlook because it feels like back-office software. It is also one of the few tools that sees nearly everything you work on.
The nine questions
1. What exactly does it capture?
Some tools take screenshots or record full-screen activity. Others keep only metadata, such as window titles and timestamps, or read the text on screen. Ask for a written list, and ask about call audio and screenshots by name.
For example, Billables AI says it avoids full-screen monitoring and relies mainly on metadata or limited app capture. Timekeepr reads on-screen text and call details (who, when and how long) and does not record call audio. Its Windows app reads screenshots in memory only and never saves or sends them.
2. Where is it processed?
Activity can be processed on your computer, in the vendor's cloud, by a third-party AI model, or a mix of these. Each step is a place client information can sit. Ask for a diagram that names every system and the region it runs in.
Timekeepr runs on each person's computer. Activity text goes over HTTPS only to Anthropic's Claude API, on US-based infrastructure, to sort time and draft descriptions. A&C Labs is not in that path.
3. Is client data used to train AI models?
Ask the vendor, and ask about any AI provider the vendor uses. Get the answer in writing.
Timekeepr uses Anthropic's API under Anthropic's Commercial Terms, and Anthropic does not train models on API data. Laurel says it does not use public LLMs and describes firm-specific models.
4. How long is it kept, and can you shorten it?
The raw activity is the most sensitive part. Ask how long screen text, metadata and drafts are kept, both at the vendor and at any AI provider, and whether your firm can shorten those periods.
Timekeepr's Windows app deletes screen text 7 days after a day is reviewed, or 14 days if it is never reviewed. It keeps time blocks (code, times and description) for a year. A&C Labs can shorten the screen-text period for a firm, down to deleting it as soon as the day is reviewed. Anthropic deletes API requests and responses within 30 days, or up to two years if its abuse checks flag them.
5. Who at the vendor can see it?
Ask which staff can access your data, in what situations, and whether that access is logged.
Billables AI says it limits access with user opt-ins, SSO, strict controls and audited access logs. Timekeepr sends nothing to A&C Labs, so there is no firm data for A&C Labs staff to access.
6. What does it never read?
A good tool lets you exclude apps and windows. Ask about password managers, private browsing windows and the clipboard.
Timekeepr skips password managers by default, plus any apps you add. In private browser windows it keeps only the program name and time. It never reads the clipboard and reads nothing while paused, locked or asleep.
7. Is anything billed without a person approving it?
Entries should stay drafts until someone at the firm approves them. Ask what happens if nobody reviews a day's entries.
All three tools in our Laurel, Billables AI and Timekeepr comparison draft entries for review rather than billing directly.
8. What certifications and audits back the claims?
A SOC 2 Type 2 report means an independent auditor tested a vendor's controls over a period of time. A Type 1 report looks at how controls are designed at a single point in time. ISO 42001 is a newer standard for managing AI systems. Ask for the report itself, under a nondisclosure agreement if needed, not only a badge on a website.
Laurel lists SOC 2 Type 2 and ISO 42001. Billables AI says it is SOC 2 Type 2 compliant. Timekeepr lists no certifications. Its design keeps firm data off A&C Labs' systems instead, and if your firm needs a vendor audit report, you can raise it in a demo.
9. What happens if something goes wrong?
Ask two separate questions: what an attacker would get from a breach at the vendor, and what they would get from a stolen or infected laptop.
Timekeepr's Security page answers both. A breach at A&C Labs exposes no client data, because A&C Labs holds none. On a compromised computer, anything running as that user could read up to 14 days of screen text, and a firm can shorten that period.
A quick checklist
| Question | A good answer includes |
|---|---|
| What is captured? | A written list, including whether audio or screenshots are kept |
| Where is it processed? | Every system and AI provider, with the region |
| Is it used to train AI? | A written no from the vendor and from any AI provider |
| How long is it kept? | Specific periods, and a way to shorten them |
| Who can see it? | Named roles and logged access |
| What is never read? | Default exclusions you can extend |
| Is anything billed automatically? | No; every entry needs approval |
| What backs the claims? | A report you can read, not only a badge |
| What if something goes wrong? | Clear answers for a vendor breach and a lost device |
How Timekeepr answers these
Timekeepr's Security page answers every question above in plain language, including a table of exactly what leaves your computer and when. If your firm has a security questionnaire, bring it to a demo and we will go through it with you.
Sources
Checked November 5, 2026.