ACTE: billable time for law firms, built privacy-first and eval-first

Lawyers who bill by the hour lose time in the gap between doing the work and writing it down. Timesheets are filled in from memory at the end of the day or the month, entries get rounded or forgotten, and the case they belong to is reconstructed after the fact. ACTE's answer is to capture the work as it happens and leave the lawyer one job: checking.

The constraint that shapes everything is confidentiality. A law firm cannot send document contents or client emails to a third party to find out how long someone spent on a case, so the product had to be designed around what never leaves the lawyer's machine.

ACTE's founder had already designed the product as a detailed HTML prototype of the dashboard. PRIONATION turned it into a production system: a pnpm and Turborepo monorepo with a Next.js 15 web app on React 19, a NestJS API, Drizzle on PostgreSQL, Better Auth, and a shared package of Zod schemas that every payload between the web app and the API is validated against.

The web app is a faithful port of the prototype's nine views, so the founder's design decisions survived intact. The work went into making them real: firm accounts and invitations, cases with hour budgets and statuses, time entries, one-click and whole-day validation, CSV export, and invoice drafts generated from validated time.

Sensitive fields are encrypted in the application with AES-256-GCM, using a random 256-bit key per firm that is itself wrapped by a master key, so one firm's data cannot be read with another firm's key. The marketing site self-hosts its fonts so that visitors' IP addresses are not sent to a font CDN.

The planned capture layer follows the same rule: raw content stays on the device and only the metadata needed for billing is uploaded, through a local encrypted queue. The beta runs on Vercel with a Neon database in Frankfurt; hosting in France, on Scaleway in Paris, is planned and not yet in place.

ACTE's Brain gives the lawyer a summary of the day inside the journal: deterministic insights such as pending tasks and low-confidence entries, plus an optional chat backed by a language model — Mistral's small model, called through a provider-agnostic client so the provider can change by configuration. Before anything reaches the model, names, titles, emails and URLs are pseudonymised; the model only sees aggregates and opaque references. The pseudonymiser alone is covered by around 60 test cases.

Automatic case matching — the confidence score at the heart of the product — is deliberately not built yet. The plan starts with the eval suite, not the model: more than 200 labelled examples and a weighted rules baseline scored from 0 to 100, with explicit targets (at least 85% of matches correct, and the 90-plus confidence band right at least 90% of the time) before anything more sophisticated is tried. Until then, confidence scores in the beta are demo data, and the product says so.

A billing product has to be right about money before it is smart about anything else. Two rules were written into the data model after review: a task keeps the hourly rate it was validated at, so changing a rate never re-prices past work, and a piece of time can appear on only one invoice, so it cannot be billed twice.

Security got the same treatment. The first version of firm invitations was found unsafe in an adversarial review before it was ever pushed, and was rebuilt so that an invitation is bound to a token rather than to an email address. Email verification became mandatory after a review found that a sign-in link could wipe an unverified account's password. And deploys now run from CI with database migrations applied first, after a manual deploy once shipped code ahead of its schema.

The beta is covered at every layer: 124 API tests, 21 contract tests, 32 route tests and an end-to-end suite of 40 scenarios, all passing. The full loop works on the live beta with synthetic data — create a firm, open cases, enter time, validate it, export it to CSV and draft an invoice.

At the last status review, on 1 October 2026, 32 features were working, 14 were partial and 14 were not yet built. No firm has used ACTE with real case data yet; pilots with two or three firms are the next milestone.

The desktop capture app is the centrepiece of the product, and it is the part that was deliberately not rushed. How to capture work — a desktop agent using operating-system APIs, Office add-ins, or a browser extension — is still an open decision, because each option carries different privacy and installation trade-offs for a law firm. The web app already lists a firm's devices and issues activation keys, so the companion app can plug in when it exists.

Card payments (the subscription screen is a mock), invoice PDFs and sending, account deletion, and connectors to practice-management software such as Secib, Kleos or Jarvis are also outside the first build, along with Factur-X e-invoicing, voice and mobile.

When the data is confidential, decide what never leaves the device before deciding what the AI does with the rest. ACTE's order of work — encryption and pseudonymisation first, a correct billing ledger second, an evaluation set for matching third, the model last — is slower to demo but much faster to trust.

Build the manual path first, too. A lawyer can already run their day in ACTE without automatic capture; automation will make a working path faster instead of replacing a path that never worked.