Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
Contract Intelligence is one of eleven platform entries in Harvey's own navigation, beside Agents, Vault, Knowledge, Spaces, Command Center, Horizon Scanning, Harvey Mobile, Ecosystem, Memory and Partnerships, and is described there as 'Surface insights, strengthen negotiations, and accelerate reviews'. The announcement of 21 May 2026 describes it as 'a system for in-house teams to manage every contract flowing through their business'. A dedicated product page is published at www.harvey.ai/platform/contract-intelligence and a waitlist at www.harvey.ai/contract-intelligence; neither was read within this pass's credit cap. Whether Contract Intelligence is a separate SKU or is bundled with Assistant, Vault or Agents is not stated on the pages read.
Ask: Is Contract Intelligence a separately licensed module for us, or included with our existing Harvey entitlements, and which of its parts (intake, review, playbook updating, portfolio insights) are in scope?
Availability
Public claim only
Availability is conditional, not general. The announcement of 21 May 2026 states Contract Intelligence was 'Built in close collaboration with a cohort of design partners', that 'Our design partners are shaping every part of Contract Intelligence: how playbooks get created, what gets routed for legal review, and how insights surface across the contract portfolio', that Harvey will 'continue to bring more customers into this process as the product evolves', and directs readers to join a waitlist. Service Terms clause 1 governs Preview, beta and early access features, caps Harvey's liability for them at USD 100,000, offers them as-is, and states in clause 1.4 that Harvey 'may materially change Preview Features during the course of the preview and may opt to discontinue Preview Features'.
Ask: Is Contract Intelligence a Preview Feature under clause 1 of the Service Terms for us, and if so what liability cap, change rights and discontinuation rights apply to our use of it?
What the product does
Public claim only
On the vendor's own account in the announcement of 21 May 2026: it 'helps streamline intake, triage, and review so legal teams can focus on strategy rather than routine markups'; it 'surfaces fallback positions, current clause language, and negotiation patterns from executed agreements', and 'Every signed contract updates your playbooks automatically'; and with contract insights 'teams can see trends across agreements, including evolving negotiated positions, potential outlier provisions, and upcoming obligations'. It is described as adapting to each team's playbooks, risk appetite and negotiation patterns. No screenshot-level detail, supported contract types, file limits or language coverage is stated.
Ask: Which contract types, file formats and volumes does Contract Intelligence handle today, and what does the intake step actually do with a request that arrives by email or a form?
Jurisdiction and legal content
Public claim only
Contract Intelligence is described for in-house legal teams without a stated jurisdiction. The only named legal-content source on the pages read is Ask LexisNexis, which surfaces answers generated by Lexis+AI within Harvey (Service Terms clause 5.1), is provided through RELX Inc., d.b.a. LexisNexis located in the US (subprocessor list, 21 September 2026), and is separate from and not included within the Basic Service (clause 5.5). No Australian legislation, case-law or conveyancing source is named.
Ask: For an Australian in-house team, what jurisdiction-specific content or configuration backs Contract Intelligence, and is Ask LexisNexis licensed for Australian material?
Deployment, hosting and regions
Public claim only
Multi-tenant hosted software; the security page states 'Harvey hosts its cloud environment in Microsoft Azure' and that 'For customers with requirements or preferences for data localization we offer processing in the EU and Switzerland or Australia. This applies to Harvey subprocessors as well.' It also states customers can 'keep everything in-region-EU or Switzerland, US, or Australia'. Service Terms clause 2.1 states that electing to store customer data or content outside the default location for the selected data processing region may affect performance and availability. Regional endpoints app.harvey.ai, eu.app.harvey.ai and au.app.harvey.ai are published in the navigation. The Australian region claim sits on a marketing page, not on a binding document read in this pass.
Ask: Will our order form and data processing agreement fix the Australian processing region for Contract Intelligence, including its playbook and portfolio indexes and any backups?
Check for vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. None of the four pages read (the Contract Intelligence announcement, the security page, the subprocessor list and the Service Terms) carries a block addressed to AI models, assistants or LLMs, or a heading of the 'Instructions for AI Assistants' kind. Status checks the same day returned not found for /llms.txt, /llms-full.txt, /ai.txt and /ai-info. A robots.txt is published and reads 'User-Agent: * Allow: / Sitemap: https://www.harvey.ai/sitemap.xml': a crawler access directive only, which is access control and not a direction about how the product should be described. Harvey's site is large and only these four pages were read.
Ask: Do you publish, anywhere on the site, guidance telling AI assistants or crawlers how to describe Harvey or Contract Intelligence?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to put client and counterparty material into the platform
Public claim only
Service Terms clause 7.3 states, in bold, 'You are responsible for (i) choosing appropriate collaborators and following Your internal policies, and (ii) having the necessary rights and consents for any external data shared with You or others'. Clause 6.2 states that the body of any email sent to Email Harvey is Input and included attachments are Customer Data. Clause 3.2 states content may contain portions of customer data or of exogenous data sources and that intellectual property ownership of those portions is unaffected by their use in the services. The Platform Agreement, which would carry the general customer warranties, was not read.
Ask: For a portfolio of executed agreements with counterparties, what does clause 7.3 require us to establish before upload, and does the Platform Agreement add a consent warranty?
Models and model providers
Public claim only
The subprocessor list of 21 September 2026 names ten AI providers with locations: Microsoft Corp (AI and cloud; US, EU, Switzerland, Australia), OpenAI LLC (US, EU, Switzerland, Australia), Google Cloud Platform (same four), Amazon Web Services (AI and cloud; same four), Anthropic PBC (US), ElevenLabs Inc. (US, EU), DeepL SE (machine translation; US, EU), Mistral AI SAS (EU), Baseten Labs Inc. (US, EU, Australia) and Fireworks.ai Inc. (US, EU, Australia). A footnote states that customers who have selected Harvey processing locations outside the listed locations for Anthropic and Mistral 'may still access models from such AI providers as available through Harvey's model hosting platforms (e.g., AWS Bedrock, Google Vertex)'. No model version is named, and which providers serve Contract Intelligence specifically is not stated.
Ask: Which providers and models serve Contract Intelligence for an Australian workspace, and can we require that no request reaches a provider located outside Australia?
Subprocessors
Public claim only
A subprocessor list is published and versioned, last updated 21 September 2026, with previous versions published for 10 April 2026, 26 December 2025 and 11 August 2025. It covers AI model providers and infrastructure, product features (SuSea Inc (you.com) for web browsing, US and EU; Parallel Web Systems Inc. for knowledge sources and web browsing, US and EU; RELX Inc., d.b.a. LexisNexis for Ask LexisNexis, US) and Harvey entities. Customers may write to privacy@harvey.ai and sign up through a published form to receive notifications about new subprocessors. The security page states Harvey passes its obligations and contractual security commitments to subprocessors and external model providers.
Ask: Which entries on the list apply to Contract Intelligence, and what notice period and objection right do we get before a new subprocessor is added?
Use of customer content for model training
Public claim only
The security page states 'Harvey contractually guarantees through our Platform Agreement that your data stays yours. We don't use inputs, outputs, or uploaded documents to train underlying models', that Harvey 'by default, never trains on customer data', that it 'contractually prohibits model providers from training on customer data and only uses your data for processing your requests, not for model improvement', and that it 'requires Zero Data Retention (ZDR) by model providers'. On customer-directed training it states: 'Can my firm use our client data for model training? Yes, but only if you explicitly request it. In that case, a bespoke model is created exclusively for you, and your data is never used to train models used by other customers.' The Platform Agreement said to contain the guarantee was not read in this pass, so these remain vendor claims rather than verified contract terms.
Ask: Which clause of the Platform Agreement carries the no-training guarantee and the model-provider zero-data-retention requirement, and do the Covered AI Services carve-outs sit outside it?
Use of feedback
Public claim only
Service Terms clause 1.1 states that for services or features offered on a preview, beta or early access basis, 'Any Feedback related to the Preview Feature may be used to improve the Service.' Because Contract Intelligence is described in the announcement as being built with design partners and offered through a waitlist, this clause is likely to be the operative one for it. Nothing on the pages read defines Feedback, distinguishes it from customer content, or states whether edits made to a generated markup or a playbook entry count as Feedback.
Ask: What counts as Feedback under clause 1.1 for Contract Intelligence, and are our reviewers' edits to a markup, a playbook entry or a flagged obligation captured under it?
Retention
Public claim only
Service Terms clause 2.2 states 'Notwithstanding anything set forth in the Terms, Your workspace retention setting will not apply to certain features, as outlined in our Documentation', and links to a Documentation article on understanding retention policies which was not read, so the excepted features are unidentified. Clause 8.2.1 states that when Covered AI Services are used, subprocessors may retain customer data and content to the extent necessary to provide their services, perform safety reviews or comply with applicable law. The security page states customers decide what to upload, set retention policies and can delete data at any time. No retention period is published.
Ask: Which features are excepted from the workspace retention setting under clause 2.2, and does Contract Intelligence's playbook and portfolio index fall inside or outside our retention policy?
Deletion
Public claim only
The security page states that customers 'Decide which data to upload, set retention policies, delete data anytime', and that customers determine what data to upload, how long it is retained and whether it can be shared within the company. No deletion timeframe, backup-purge period, post-termination deletion obligation or certificate of destruction appears on the pages read; the Platform Agreement and the data processing addendum, which are published at www.harvey.ai/legal, were not read in this pass.
Ask: On deletion and on termination, within what period are documents, derived indexes, playbook entries and backups destroyed, and will you certify it?
Human review of customer data
Public claim only
Service Terms clause 8.1 defines Covered AI Services as features leveraging AI capabilities whose data processing requirements, including retention, human review and storage, differ from the commitments Harvey makes in the Terms and Documentation, and clause 8.2.2 states that when they are used 'Customer Data and Content may be reviewed by the Subprocessors to perform safety reviews, to enforce their acceptable use policies, or to comply with applicable law'. Clause 6.4 states the Email Subprocessor 'does not store, retain or allow human review of Customer Data or Content' except as required by law or to enforce acceptable use policies. The security page states Harvey implements strict access controls following the principle of least privilege.
Ask: If we enable any Covered AI Service for Contract Intelligence, which subprocessor may read our contracts, for what purpose, and can we disable those features outright?
Authentication, permissions and ethical walls
Public claim only
Service Terms clause 7.1 and 7.2 provide for Shared Spaces in which permissions govern what users and external collaborators can access, modify, query, view, edit and download, with the space creator setting member permissions and workspace storage, processing and retention settings continuing to apply. The security page states enterprise controls including SAML single sign-on, audit logs, IP allow-listing and data lifecycle management, role-based access controls with logical workspace separation, logical separation of each customer's data, and that Harvey 'syncs and enforces your firm's existing ethical wall policies, blocking restricted users from accessing or sharing walled content across Harvey' while never creating, modifying or deleting walls so that the firm's walls provider remains the system of record.
Ask: Do ethical walls and role-based permissions apply to the Contract Intelligence portfolio index and playbooks as well as to documents, and are administrator changes captured in audit logs we can export?
Encryption
Public claim only
The security page states 'Harvey encrypts all data at rest and in transit, uses strong access controls, and, by default, never trains on customer data.' No algorithm, key management arrangement or customer-managed key option appears on the pages read. A Security Addendum is referenced on the security page as containing binding terms on data protection and data access but was not read in this pass.
Ask: What encryption and key management apply in the Australian region, and is any customer-managed or customer-held key option available?
Independent assurance
Public claim only
The security page displays compliance badges for SOC2 II, ISO 27001, ISO 27701, ISO 42001 and AIUC-1, alongside CCPA and GDPR badges which denote laws rather than certifications, and states that Harvey 'undergoes annual SOC 2 Type II and ISO 27001 audits to validate these controls', conducts automated vulnerability scans, annual third-party penetration tests and continuous monitoring, and engages security firms including Schellman, NCC Group and Bishop Fox for audits. Certificates and reports sit behind a security portal at trust.harvey.ai, which was not opened, so no certificate scope, audit period or report date was read. No IRAP assessment is mentioned.
Ask: What are the scope statements and audit periods of the current SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001 certificates, do they cover the Australian region and Contract Intelligence, and is there an IRAP assessment?
Contractual documents
Public claim only
The Service Terms, last updated 16 September 2026, state that they 'are part of Your Terms with Harvey' and that where they conflict with the Terms, the Service Terms control for the features they govern; previous versions are published back to 2 April 2025. They cap Harvey's liability for Preview Features at USD 100,000 and disclaim warranties for them (clauses 1.2 and 1.3). Harvey also publishes a Platform Agreement, a data processing addendum, a data transfers addendum, a security addendum, a privacy policy and a privacy centre at www.harvey.ai/legal; none of those was read within this pass's credit cap, so the master terms, processor obligations and transfer mechanism were not verified here.
Ask: Which Harvey entity will contract with us, under which governing law, and will the data processing addendum and security addendum be signed with the Australian processing region fixed?
Cross-border processing
Public claim only
The Service Terms state that some features process outside the customer's selected region. Clause 4.4: 'The Web Browsing Subprocessor and Knowledge Source Subprocessor process Customer Data and Content in the location(s) specified on www.harvey.ai/legal/subprocessors and may not process in Your selected data processing region.' Clause 5.3 says the same for the LexisNexis Subprocessor, and clause 8.2.3 states that with Covered AI Services 'Customer Data and Content may be stored and processed in a location different to the storage and processing locations stipulated in Your Terms.' The subprocessor list gives US and EU only for SuSea (you.com) and Parallel Web Systems, and US only for RELX (LexisNexis) and Anthropic PBC. The security page separately states regional processing is offered in the EU and Switzerland or Australia and that this applies to subprocessors as well.
Ask: With an Australian processing region selected, which of these features would send our contract content to the United States or the EU, and can each be blocked at workspace level?
Incident notification
Public claim only
The security page states that Harvey's Security Addendum 'includes binding terms on data protection, data access, incident response SLAs, and other controls aligned with SOC 2, ISO, GDPR and other standards' and that its commitments are auditable and enforceable. The Security Addendum itself was not read in this pass, so no notification period, contact route or post-incident reporting obligation was verified. Nothing on the pages read states a notification timeframe.
Ask: What incident notification period does the Security Addendum specify, to whom, and does it commit to a written post-incident report where Australian client data is involved?
Changes to features, terms and subprocessors
Public claim only
Service Terms clause 1.4 states Harvey 'may materially change Preview Features during the course of the preview and may opt to discontinue Preview Features'. The Service Terms are versioned and dated, with previous versions published for 22 June 2026, 9 June 2026, 10 April 2026, 3 February 2026, 26 December 2025 and 2 April 2025. The subprocessor list is versioned and dated with previous versions published, and offers a sign-up to receive notifications about new subprocessors. No notice period for a change to the Service Terms or the subprocessor list is stated on the pages read.
Ask: What advance notice do we get of a change to the Service Terms, the subprocessor list and the models behind Contract Intelligence, and can we object before it takes effect?
Exit and export
Not confirmed
Nothing on the pages read addresses export of customer data or derived material, return or deletion at the end of the agreement, or transition assistance. The security page states data can be deleted at any time but not what happens on termination. The Platform Agreement and data processing addendum, which would ordinarily carry those obligations, were published at www.harvey.ai/legal but were not read within this pass's credit cap. This is a gap in this profile rather than a finding that the obligations do not exist.
Ask: On exit, can we export the Contract Intelligence playbooks, clause library, extracted obligations and portfolio data in a usable format, and what is deleted and when?
Connectors and where content flows
Public claim only
Service Terms clause 4 provides Web Browsing and Knowledge Source features that 'directly query public websites' and return links with the output, each delivered through a subprocessor and configurable by the customer's administrators. Clause 5 provides Ask LexisNexis through the LexisNexis subprocessor. Clause 6 provides Email Harvey, where emails and attachments sent to ask@harvey.ai become customer data and content and are handled by an Email Subprocessor. Clause 7 provides Shared Spaces with optional External Collaboration outside the workspace. The security page adds ethical-wall synchronisation with the firm's existing walls provider. No document-management connector is named on the pages read.
Ask: Which document-management and contract-repository connectors will Contract Intelligence use for us, and does content leave our tenancy when a connector syncs?
Web browsing
Public claim only
Service Terms clause 4 states that Web Browsing and Knowledge Sources 'may be leveraged in various parts of the Service' by directly querying public websites, that links to relevant URLs are returned with the output, that a Web Browsing Subprocessor provides the web searching and a Knowledge Source Subprocessor retrieves information from URLs not searchable through Harvey's AI providers, that both are optional features administrators may configure, and that they may not process in the customer's selected data processing region. It also states 'SuSea, Inc. (you.com) is not HIPAA compliant.' The subprocessor list locates SuSea Inc (you.com) and Parallel Web Systems Inc. in the US and EU. Clause 4.5 makes both Targeted Source Features.
Ask: Will web browsing and knowledge sources be enabled for Contract Intelligence, and when they are, what part of a contract is sent to a US or EU subprocessor?
Automated routing and its boundaries
Not confirmed
The announcement of 21 May 2026 states that Contract Intelligence 'helps streamline intake, triage, and review', that design partners 'are shaping what gets automated, what is escalated, and how the system improves over time', and that they are shaping 'what gets routed for legal review'. Nothing on the pages read states what boundary applies to an automated triage or routing decision, whether a request can be approved or closed without a lawyer, what is logged, or who can change the rules. The Service Terms do not address automated action, and the dedicated product page was not read.
Ask: What can Contract Intelligence do without a lawyer in the loop, for example approve a low-risk request or issue a markup, and where are those boundaries configured and logged?
Human review before playbooks and outputs change
Not confirmed
The announcement of 21 May 2026 states that Contract Intelligence 'surfaces fallback positions, current clause language, and negotiation patterns from executed agreements' and that 'Every signed contract updates your playbooks automatically, so institutional knowledge compounds instead of getting lost.' Nothing on the pages read describes a human approval step before a playbook or fallback position changes, a version history of playbook changes, or a way to reject an inferred position. Automatic playbook updating from executed agreements is therefore a design the firm must configure or accept.
Ask: Can an update to a playbook or fallback position be held for human approval before it becomes the position our team is given, and is each change versioned and attributable?
