Smokeball

United States · www.smokeball.com · 29 vendors

Smokeball, Inc. is a technology company that provides cloud-based legal practice management software. Its platform helps small and medium-sized law firms streamline daily operations through features like automatic time tracking, document automation, billing, and client communication. The software aims to enhance productivity and profitability for legal professionals.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 29 sub-vendors.

Insights

Last updated 2026-08-11 · revision 2

29 direct vendors, 277 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Smokeball exhibits high migration readiness primarily due to its modern, cloud-native tech stack built on AWS, utilizing SaaS, and incorporating advanced AI/ML capabilities. This architecture suggests a flexible, scalable, and potentially microservices-oriented environment, which significantly eases migration efforts. The "Multi-AZ architecture" further indicates a well-designed cloud presence. The fact that "Data Residency Requirements" are "Not specified" is also a positive, as it implies fewer immediate geographical constraints for data movement, assuming no strict requirements emerge. The most significant unknown impacting migration readiness is "Vendor Lock-in Risk: Unknown". While "Total Vendors: 0" is stated, the existence of "Total Services: 25" and details about vendor countries imply external dependencies. Without knowing the actual number of distinct vendors and the nature of these relationships, assessing the degree of vendor lock-in and its potential complexity for migration is challenging. Furthermore, the absence of data on financial stability (Revenue Concentration, Growth History) means the company's ability to fund a significant migration effort cannot be assessed. The "Regulatory Environment" is also unspecified, which could introduce unforeseen compliance hurdles during migration.

Compliance

10 in-scope frameworks identified; showing 3.

Australian Privacy Act 1988 — Assessment Required

Risk is HIGH because: (1) Smokeball's global headquarters is in Sydney, Australia, and Smokeball Australia Pty Ltd is a registered Australian entity; (2) the Australian Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) apply to organizations with annual turnover exceeding AUD $3 million — Smokeball, serving 15,000+ clients globally, almost certainly exceeds this threshold; (3) Smokeball processes highly sensitive personal data including health information, criminal history, and financial data of Australian law firm clients and their clients; (4) the Privacy Act is currently undergoing significant reform (Privacy and Other Legislation Amendment Act 2024), introducing new requirements including a statutory tort for serious invasions of privacy, enhanced enforcement powers, and new children's privacy protections; (5) the Office of the Australian Information Commissioner (OAIC) has increased enforcement activity; (6) non-compliance penalties were significantly increased — up to AUD $50 million for serious or repeated breaches. No public OAIC registration or APP compliance audit was found.

Evidence: https://www.smokeball.com/privacy, https://www.smokeball.com/about, https://www.smokeball.com.au/

ISAE 3000 (source) — Assessment Required

ISAE 3000 risk is LOW because: (1) Smokeball is a legal practice management software company, not an assurance services provider or auditing firm — ISAE 3000 is primarily relevant for companies providing assurance reports to third parties (e.g., SOC 2 equivalent reports under ISAE 3402 for service organizations); (2) no evidence of ISAE 3000 engagements or reports was found; (3) Smokeball's primary security assurance framework is ISO 27001, not ISAE 3000-based reporting; (4) ISAE 3000 may become relevant if Smokeball's Australian or UK operations require assurance reporting to clients or regulators, but no such requirement has been identified. The risk is LOW rather than 'Not Applicable' because Smokeball operates in Australia where ISAE 3000-based assurance reporting (via ASAE 3402 for service organizations) may be requested by Australian law firm clients or regulators.

Evidence: https://www.smokeball.com/privacy, https://www.smokeball.com/about

CPRA — Assessment Required

Risk is MEDIUM because: (1) Smokeball Inc. is headquartered in Chicago, IL (US) and serves US law firm clients including those in California; (2) the Privacy Policy explicitly includes a dedicated 'California Residents' section addressing CCPA rights — confirming applicability; (3) CCPA/CPRA applies to for-profit businesses that collect California consumers' personal information and meet one of three thresholds: annual gross revenue >$25M, buy/sell/share personal information of 100,000+ consumers/households annually, or derive 50%+ of annual revenue from selling personal information; (4) with 15,000+ clients worldwide and a US office, Smokeball likely meets the revenue or data volume threshold; (5) CPRA (effective January 1, 2023) added new requirements including a right to correct, right to limit use of sensitive personal information, and established the California Privacy Protection Agency (CPPA); (6) penalties up to $7,500 per intentional violation. Risk is MEDIUM (not HIGH) because Smokeball has explicitly acknowledged CCPA in its Privacy Policy, indicating awareness and partial compliance.

Evidence: https://www.smokeball.com/privacy

Financials

Three-year financials

Financial Resilience Score: 7/10

Smokeball exhibits characteristics typical of a resilient recurring-revenue SaaS business. Its subscription-based model provides predictable, high-margin cash flows, and vertical-specific legal software creates high switching costs due to embedded data, workflows, document templates, and integrations. Geographic diversification across three English-speaking markets (US, UK, Australia) reduces single-country regulatory risk, and backing from private-equity growth investor PSG (Providence Strategic Growth) provides capital runway for continued expansion. However, the company operates in a highly competitive legal-tech segment against larger, well-funded rivals such as Clio, MyCase (AffiniPay), LEAP, PracticePanther, CosmoLex, and Filevine. Serving small-to-mid law firms exposes it to price competition and legal-industry economic sensitivity. As a private company, there is limited visibility into leverage, cash burn, and profitability, and the ongoing AI feature race requires substantial R&D spending where larger rivals have greater balance-sheet capacity. Currency exposure across AUD/USD/GBP adds further complexity for an AU-headquartered group with a large US business.

Key strengths: Subscription-based SaaS model with recurring, high-margin revenue, High customer switching costs in vertical legal software, Geographic diversification across US, UK, and Australia, PE backing from Providence Strategic Growth (PSG), Growing customer base (15,000+ clients / 20,000+ lawyers), Expanding AI product suite (Smokeball AI, Archie)

Risk factors: Intense competition from larger rivals (Clio, MyCase, LEAP, etc.), SMB law firm segment sensitive to legal-industry economics and price competition, Limited financial transparency as a private company, AI feature race requires ongoing R&D spend vs. better-capitalized competitors, Currency exposure across AUD/USD/GBP, Single product family concentration (legal practice management SaaS)

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report