Built for confidential legal work

Sixminute observes activity across the applications used for legal work. Depending on the application and operating system, captured material can include text, interaction signals and other on-screen context needed to understand the task. Because that material may contain confidential information, Sixminute treats it as sensitive from the moment it is captured.

Captured activity is organised and reformatted on the device before model processing. This reduces raw activity to work context that can be used to identify the task, matter, duration and narrative.

No. Sixminute does not use firm or client information to train its own models. Model-processing arrangements are selected under business terms that prohibit training on submitted data.

Yes. Sixminute supports a managed configuration and can discuss firm-controlled or privately hosted processing arrangements for firms with additional requirements. The supported configuration is agreed during onboarding.

Depending on the deployment, a firm may use its own model-provider account or choose a privately hosted processing arrangement. The supported configuration is agreed during onboarding.

An unreviewed entry is private to the individual timekeeper. It becomes available to the firm's billing workflow only after the lawyer reviews and releases it.

Yes. Lawyers can stop capture, and firms can exclude applications that should not be observed.

Information is encrypted in transit. The local Sixminute index is encrypted using SQLCipher. Sensitive cloud fields use AES-256-GCM encryption with firm-specific data keys.

Retention depends on the category of information and the processing arrangement agreed with the firm. Captured activity, model inputs and released entries serve different purposes and should not be treated as one undifferentiated data set. The applicable retention terms are documented during onboarding.

Sixminute is designed for firms subject to GDPR and uses technical and organisational measures intended to support that use. GDPR compliance also depends on the firm's purpose, configuration and use of the service. Processing roles, subprocessors, retention and any international transfers should therefore be documented and assessed during onboarding.

Yes. Prospective firms can review the relevant security, privacy, retention and processing information before onboarding and discuss requirements that are specific to their practice.