Security, consent and permissions

CaseClock is built around one rule: nothing is billed, sent or shared without the lawyer's approval. This page explains what the applications record, what they ask permission for, where data lives, who at your firm can see it, and the controls you have. The public security page at caseclock.ai/security carries the firm-level and IT review material.

Security basicsCopy Anchor Link

• Encrypted in transit and at rest, stored in your region.
• Recording starts only when you start it.
• Nothing reaches your billing system without your approval.

Your accountCopy Anchor Link

• You sign in with your work email and a six-digit code that is valid for 15 minutes. There is no password to steal or reuse. CaseClock limits how many codes an address can request in an hour.
• A signed-in device stays signed in for about a month without use. Sign Out ends the session on that device.
• Your account is served from the Canadian or the United States CaseClock service, chosen from your email address, and your data is stored in that region. AI processing may take place on Microsoft Azure servers outside your region; the apps say so where you turn on an AI feature.

RecordingCopy Anchor Link

• The microphone is used only while a recording you started is running. The desktop app's permission text reads: "CaseClock needs microphone access to record your billable time by voice." The phone explains the same before the system prompt and offers Continue or Not Now.
• Recordings are saved on the device first, then uploaded over an encrypted connection. The recording and its transcript are kept with the entry so you can replay or re-check it, and are deleted with the entry or the account.
• Recordings and transcripts are processed on Microsoft Azure. The microphone notice in the currently released phone app explains the recording data it sends for transcription and draft-entry generation, and links to the privacy policy for the full disclosure.
• Recording starts only when you start it, on every app. Nothing listens in between.

Computer activity, an optional featureCopy Anchor Link

CaseClock Desktop can, if you turn it on, notice the time you spend in programs you choose and suggest it in Reconcile. It is off for every account until you turn it on yourself and agree to a consent screen. When it is on:

• It records only the programs you list (Word, Excel, PowerPoint and Acrobat to start). Websites will be included only through the CaseClock browser extension once it is published, and only the sites you list; banking, health, personal webmail, social media and similar sites are never recorded.
• It records the program or site, the window or tab title (you can turn titles off per program) and your active minutes. Never keystrokes, your screen, screenshots or document contents.
• You pause it, exclude an item or turn it off from the desktop app; captured time not turned into an entry is deleted after 30 days; Delete my captured activity removes everything at once.
• Only you see what it recorded. Your firm can switch it off for everyone but can never turn it on or see your items.
• Nothing is billed from it. Reconcile suggests; you decide.

The privacy policy on caseclock.ai describes the same feature under Computer Activity (Optional). Full guide: Computer activity in CaseClock Desktop.

Reconcile and Microsoft 365Copy Anchor Link

• Reconcile asks Microsoft for read-only, delegated permissions: your profile, your calendar, your mail and your OneDrive files, for the sources you ticked. It reads the subject or file name, the times and the participants.
• The text of a message, event or file is read only if you turn on Read content, after a consent page that describes exactly what changes. Content is used to draft a description and is not stored.
• Reconcile items are kept for 30 days from when they were found. Disconnecting Microsoft 365 deletes them all.
• Your firm's Microsoft 365 administrator may need to approve CaseClock for your organisation; the setup screen gives you what to send them.

MemoryCopy Anchor Link

What CaseClock learns about your writing, spellings and billing habits is visible to you under Settings, Memory on the web (Account, Memory on the phone), where you can edit or remove any item and switch Learn from my work off. Memory is personal notes applied to your own drafts; it is not used to train AI models. Nobody at your firm can see your Memory, rules or glossary. See Using Memory.

What your firm's administrators can and cannot seeCopy Anchor Link

At firms using the Admin Center, an Owner, Admin or Billing Manager sees entries as figures and states (client, matter, duration, status, dates) for the matters they are allowed to see. That lets them follow time from draft to billing. They never see your recordings or dictations, the text of your entry descriptions, your Microsoft 365 items, your captured computer activity, or your Memory, rules and glossary. They cannot edit or approve your entries. Every change an administrator makes is written to the firm's audit log with the values before and after.

Having an email address at the firm's domain does not by itself place you in a firm or give anyone rights over your account; membership comes from an invitation or a request you make. When you join a firm the invitation page lists what administrators will and will not be able to see before you accept.

DelegatesCopy Anchor Link

A firm may name a Delegate who works on a lawyer's entries in the CaseClock web app, with May draft and, separately, May approve. Anything a Delegate approves is recorded in the entry's history as approved by the Delegate for the lawyer. A Delegate can never un-approve, archive or send an entry to the billing program. The lawyer sees their Delegates under Settings, Profile. See Acting for a lawyer as a Delegate.

Your billing systemCopy Anchor Link

CaseClock writes to Clio only the time entries you approve and send, under the Clio user you connected. For file-based programs it writes a file you import yourself. CaseClock Sync programs write to PCLaw and Unity Accounting only through those programs' own import mechanisms. Nothing is written back to a billing system on CaseClock's own initiative.

Deleting your dataCopy Anchor Link

• An entry: Delete permanently on the web or desktop removes the entry, its recording and its history. The phone offers Archive.
• Reconcile items: disconnect Microsoft 365, or dismiss individual items.
• Your account: Settings, Profile, Danger zone, Delete account (on the phone, Profile, Delete My Account). Type the confirmation and the account, its entries, recordings, transcripts, imported clients and matters and history are deleted. Clients and matters you shared with your firm stay with the firm.

Common questionsCopy Anchor Link

Does CaseClock watch what I do on my computer? Not unless you turn computer activity on in CaseClock Desktop and agree to its consent screen, and then only for the programs you list. Recording starts only when you start it.

Where is my data stored? In the CaseClock region your account belongs to, Canada or the United States, chosen from your email address. AI processing may take place on Microsoft Azure servers outside your region; the apps say so where you turn an AI feature on.

Can my firm read my entries? Administrators see figures and states for the matters they may see, never the text of your descriptions or your recordings.

For IT teamsCopy Anchor Link

The desktop installers are signed by CaseClock Inc. and the macOS build is notarized. The desktop app talks only to CaseClock's own services. Details for a security review, including infrastructure, encryption in transit and at rest and the responsible disclosure policy, are on caseclock.ai/security and caseclock.ai/it-teams.

Related guidesCopy Anchor Link

• Using Reconcile
• Using Memory
• Getting started with the Admin Center