Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan, region and optional modules
Public claim only
The Platform Agreement distinguishes Basic Service from optional modules covered by the Service Terms. Ask LexisNexis, web browsing/Knowledge Sources, Covered AI Services (formerly Extended AI) and Preview Features are optional, administrator-configurable, and not included in Basic Service. Separate US, EU and AU logins exist.
Ask: Which order-form modules, processing region and Preview Features will be enabled for our tenancy, and which remain off by default?
Deployment and hosting
Public claim only
Harvey hosts on Microsoft Azure and offers processing in the US, EU/Switzerland or Australia, stating that this applies to subprocessors as well. Login hosts exist at app.harvey.ai, eu.app.harvey.ai and au.app.harvey.ai. It remains a multi-tenant SaaS product; private cloud or on-prem is not offered as a standard deployment.
Ask: Record the contracted Azure region, tenancy identifier and any private-link or IP-allowlist requirements in the order form.
Product surfaces
Public claim only
Public product pages describe Assistant, Vault, Knowledge, Agents, Word and Outlook add-ins, mobile apps, Spaces, Contract Intelligence, Command Center and an API/MCP. Agent actions are described as requiring preview and approval before they run.
Ask: List the surfaces and agent types in our licence, which are generally available versus preview, and which administrators can disable.
Legal-content jurisdiction
Public claim only
Knowledge lists licensed databases including Ask LexisNexis, Wolters Kluwer, EUR-Lex and EDGAR, and claims a pipeline into 500+ sources. ISO 42001 materials mention US, UK, EU, APAC and MENA knowledge sources. No named AustLII, Jade or Westlaw Australia connector was found on the Knowledge page as at 2026-09-20.
Ask: Which Australian primary-law collections (federal and state) are available in our workspace, how current are they, and how is negative treatment shown?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Client-facing use and authority
Public claim only
The Platform Agreement states the Service is a research tool, Output is not legal advice, and Output may contain errors. Shared Spaces with External Collaboration require the customer to have the necessary rights and consents for any external data shared. No unsupervised client-facing advice product was described. Matter- or client-level exclusion to honour outside-counsel guidelines is not documented in the public pages reviewed.
Ask: Can administrators exclude named clients or matters from Harvey, and what client-ready description of data use will you provide for engagement letters?
Model providers and routing
Public claim only
The 2 August 2026 subprocessor list names Microsoft, OpenAI, Google Cloud, AWS, Anthropic, ElevenLabs, DeepL, Mistral, Baseten and Fireworks as AI providers, with locations including US, EU, Switzerland and Australia for several. Anthropic is listed as US (with Bedrock/Vertex routing notes). Harvey's March 2026 multi-model post names Claude Opus 4.6, GPT-5.2, Sonnet and Gemini 3 Flash as examples in production. A listed entity location does not prove the endpoint used for our tenancy.
Ask: Identify the providers, models and inference regions actually used for our enabled features, whether we can pin or disable providers, and the notice given on model change.
Subprocessor list and change notice
Public claim only
A dated list (2 August 2026) names AI, hosting, web-browsing (SuSea/you.com, Parallel) and Ask LexisNexis (RELX) subprocessors, with prior versions linked. The DPA gives 30 days' notice of additions if the customer subscribes to the notice list, a 15-day objection window, flow-down of materially equivalent protections, and Harvey remaining liable for subprocessors.
Ask: Confirm we are subscribed to subprocessor notices, that our no-training, residency and deletion terms flow down, and that we may terminate if an objection cannot be resolved.
Training and secondary use
Public claim only
Platform Agreement s 11.8: Harvey will not train any AI models using Customer Content or Customer Data; subprocessors will not either. Privacy Center (13 July 2026) repeats that Harvey does not use Customer Data or Content to train models or improve products, and that AI-provider subprocessors are contractually prohibited from training. The security page separately allows customer-requested bespoke training on that customer's data only. Harvey does use publicly available legal information to develop its platform.
Ask: Confirm the signed no-training clause covers prompts, outputs, uploads, embeddings, feedback and telemetry, that no Covered AI Service or bespoke model changes it for our tenancy, and that public-data training is out of scope of our content.
Feedback and usage data
Public claim only
Feedback is defined as suggestions and corrections and excludes Customer Data and Content; Harvey may freely use Feedback but not in a way that identifies the customer or its content. Usage Data (access, volume, feature use — not Customer Data or Content) may be used to develop, improve, support and operate the Service, and may be shared only if aggregated and anonymised or under confidentiality. Preview Feature feedback may be used to improve the Service.
Ask: Confirm thumbs-up/down, edits and prompt logs are treated as Customer Content (not Feedback), are not used to train, and can be excluded from any service-improvement analytics.
Retention and zero data retention
Public claim only
Security FAQ: Harvey requires zero data retention by model providers. Privacy Center: when a subprocessor must retain content for a feature, that feature is disabled by default and administrator-enabled; scope is in the Service Terms. Service Terms: workspace retention settings do not apply to certain features (help article is login-gated); Covered AI Services allow subprocessors to retain content for their services, safety review or law. Detailed per-store periods were not in the public pages.
Ask: List retention for prompts, uploads, embeddings, outputs, logs, backups and each optional feature in our tenancy, including Covered AI Services, and confirm ZDR is on the order form for every enabled model endpoint.
Deletion on instruction and exit
Public claim only
DPA s 14: within 30 days of termination or a reasonable request, Harvey shall, and shall direct each subprocessor to, return or delete Customer Personal Data unless required by law to retain it. Security page: customers can delete data anytime and set retention. Matter-level self-service deletion, backup rotation period and a deletion certificate are not specified in the public DPA text reviewed.
Ask: Confirm matter-level deletion, backup purge lag, flow-down to every subprocessor including model-provider stores, export formats, and whether a deletion certificate is issued without request.
Vendor and provider human access
Public claim only
Platform Agreement: subprocessors other than cloud storage providers will not retain or log Customer Content or Data for human review. Privacy Center: Harvey accesses Customer Data or Content only to provide or support the Service or to comply with law. Security-by-design post: support personnel do not have default access; access requires specific individual authorisation. Covered AI Services expressly allow subprocessor safety review of content when those features are enabled.
Ask: For our enabled features, who at Harvey or a subprocessor can read content, is that access logged and visible to us, and are Covered AI Services off?
SSO, MFA, SCIM and ethical walls
Public claim only
Security page lists SAML SSO, audit logs, IP allow-listing and ethical-wall synchronisation from the firm's walls provider (Harvey does not create or delete walls). A November 2025 blog said SCIM would enter early access later that year; a help.harvey.ai/articles/scim-integration URL exists but is login-gated, so general availability was not confirmed from public text. Command Center describes syncing employee profile attributes.
Ask: Confirm SAML SSO can be enforced with local passwords disabled, whether SCIM is generally available on our tier, and demonstrate wall changes taking effect at query time on our DMS.
Encryption in transit and at rest
Public claim only
Security Addendum s 3: AES-256 (or better) at rest for Customer Data and Content; TLS 1.2 (or better) in transit over public or untrusted networks; keys rotated at least annually and held in hardware security modules, logically separated from content. Customer-managed keys were not described.
Ask: Does at-rest encryption cover embeddings, indexes, logs and backups, is BYOK available, and is the model-provider hop included in the TLS commitment?
Independent security and AI-management assurance
Public claim only
Security page displays SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001 and AIUC-1 badges and names Schellman, NCC Group and Bishop Fox. ISO 42001 was announced 5 June 2026. The Security Addendum promises annual third-party audits and that SOC 2 Type II reports, ISO certificates, statements of applicability and penetration-test summaries are available on request. The reports themselves were not inspected in this review.
Ask: Provide the current SOC 2 Type II report, ISO 27001 and 42001 certificates with scope, any exceptions, a bridge letter, and the latest penetration-test executive summary covering AI features.
Contract, DPA, liability and forum
Public claim only
Public Platform Agreement (customer owns Content; no-training; confidentiality covers Content and Customer Data), DPA, Security Addendum and Service Terms are incorporated. Liability cap is the greater of 12 months' fees or USD 250,000; data-breach/confidentiality claims the greater of 2× fees or USD 500,000. IP indemnity covers the Service, not Output. Governing law is California (or England and Wales for EEA/UK/Switzerland customers) with arbitration. Australian law/forum is not offered in the public terms.
Ask: Will you execute the public DPA and Security Addendum without dilution, raise the data-breach cap, and offer Australian law or an Australian forum for our order?
Cross-border processing and Australian residency
Public claim only
Security page: keep everything in-region — EU/Switzerland, US or Australia — including subprocessors. Clayton Utz's media release states storage and processing for its tenancy take place in Australia. Service Terms: web browsing, Knowledge Sources and Ask LexisNexis subprocessors may process outside the selected region; Covered AI Services may store and process in a different location. Privacy Policy has an Australia section addressing the Privacy Act 1988 (Cth).
Ask: For our AU region, list every exception (web, Ask LexisNexis, Covered AI, support, backups, telemetry) with country and APP 8 basis, and confirm inference as well as storage stays in Australia for Basic Service.
Breach notification
Public claim only
Security Addendum s 8: if Harvey becomes aware of a Security Incident affecting Customer Data or Content, it will notify without undue delay and in any case within 48 hours after becoming aware, at the security notice email on the order form; it will contain, investigate and mitigate, preserve relevant logs for at least one year, and share nature, consequences, investigation status and a contact point. No public incident register or status-page history was reviewed.
Ask: Name the notice email on our order form, confirm 48 hours runs from discovery (not confirmation), that subprocessor incidents flow through on the same clock, and provide any incident history for the last 24 months.
Unilateral changes and model updates
Public claim only
Platform Agreement: Harvey may update Terms but not so as to detract from confidentiality, Customer Data/Content or security obligations without written authorisation. If an update negatively impacts the customer, a 15-day discussion window applies, then the customer may terminate with a pro-rata refund of unused prepaid fees. Service Terms: Preview Features may change or be discontinued. No contractual advance-notice period for production model swaps was found.
Ask: What notice and testing window apply to production model or prompt changes, and can we pin a model version for a defined period?
Exit, export and termination
Public claim only
Either party may terminate for material breach uncured in 30 days, with pro-rata refund of unused prepaid fees. DPA requires return or deletion of Customer Personal Data within 30 days, including subprocessors. A self-service bulk export of conversations, playbooks, Vault objects and audit logs in open formats was not demonstrated in public documentation. API/MCP is documented at developers.harvey.ai.
Ask: Show a trial export of documents, chats, playbooks, workflows and audit logs in open formats, the post-termination export window, and certified deletion including embeddings and backups.
Connectors and DMS permissions
Public claim only
iManage integration is described as OAuth, bidirectional, with one-click disconnect at user or workspace level and the same segregation/retention as other customer data. On-prem iManage is supported via a customer-controlled network path. Administrators can enable or disable integrations from feature settings. Whether retrieval honours live DMS ACLs versus a copied index is not fully specified in public text.
Ask: For each connector we will enable, what data leaves the source system, are permissions checked at query time, and can we disconnect without residual copies in Vault?
Web browsing and Knowledge Sources
Public claim only
Service Terms treat Web Browsing and Knowledge Sources as optional, administrator-configurable Targeted Source Features. SuSea (you.com) and Parallel process Customer Data and Content in the locations on the subprocessor list and may not process in the selected region; you.com is stated as not HIPAA compliant. Queries can hit public websites. These features are not part of proving a closed, in-region Vault workflow.
Ask: Confirm web browsing and Knowledge Sources are off for our workspace, or if on, which URLs and query text leave Australia and under which subprocessor.
Agent actions and human authorisation
Public claim only
Product pages state agents preview the plan, the user approves work before Harvey begins, and high-impact work is nudged back to a person. ISO 42001 post: agentic actions require explicit human authorisation before proceeding. Service Terms allow External Collaboration in Shared Spaces, which can let outside users view, edit, download and query Resources. Autonomous send/share/delete without confirmation is not described as a default, but the full action catalogue is not public.
Ask: List every action an agent can take on email, DMS or the web in our configuration, which require per-action approval, and how we stop a running agent.
Human review of outputs
Public claim only
Platform Agreement: Output is AI-generated and may contain errors or be incomplete; it is not legal advice. Product copy: every claim is backed by a citation and every step is logged. ISO 42001 post: outputs cite sources so users can verify results; audit logs are enabled by default. Verification time on the firm's own Australian documents is not published.
Ask: Show sample outputs for our tasks with per-statement source pinpoints, 'not found' behaviour, and an exportable log of who approved each agent run.
