---
title: "Harvey (Harvey AI Corporation)"
url: "https://ailawframework.com/software/harvey"
type: "software_profile"
site: "AI Law Framework"
id: "harvey"
vendor: "Harvey AI Corporation"
category: "Legal-specific"
segment: "Drafting assistants"
confidence: "high"
last_reviewed: "2026-09-20"
---

# Harvey (Harvey AI Corporation)

> Enterprise legal AI for drafting, research, Vault document analysis, playbook review and agent workflows, aimed at mid-to-large firms and in-house teams.

Canonical page: https://ailawframework.com/software/harvey  
Last reviewed: 2026-09-20

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Enterprise workspace on a chosen processing region (US, EU/Switzerland or Australia). Basic Service is distinct from Ask LexisNexis, web browsing, Covered AI Services, Shared Spaces and Preview Features.

## Capabilities

- Legal research
- Contract drafting
- Contract review and redlining
- Clause libraries and playbooks
- Due-diligence document review
- Chronology building
- Document summarisation
- Knowledge search
- Translation
- Agentic workflows

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United States, European Union / EEA, Another named location |
| Australian region | Yes |
| Model providers | Microsoft, OpenAI, Google, Amazon Web Services, Anthropic, Mistral, ElevenLabs, DeepL, Baseten, Fireworks.ai |
| Assurance | SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, AIUC-1 |
| Training on customer content | No |
| Retention | Workspace retention is customer-configurable; it does not apply to certain features. Model-provider zero data retention is the default, except for Covered AI Services and other optional features described in the Service Terms. |
| Integrations | Microsoft Word, Microsoft Outlook, iManage, NetDocuments, SharePoint, Google Drive |
| Legal content coverage | Optional Ask LexisNexis plus other licensed databases (including Wolters Kluwer, EUR-Lex and EDGAR) and firm Vault/DMS content. No named AustLII, Jade or Westlaw Australia integration found as at 2026-09-20. |
| Pricing | No public price list. Sales-led enterprise contracts; seat, module, usage and term sit on the order form, which was not published as at 2026-09-20. |
| Australian presence | Yes. Sydney office and au.app.harvey.ai tenancy. Clayton Utz (Lexology republication of the firm's media release) states it is among the first tenants in Harvey's Australian environment with storage and processing in Australia. Corrs appears as a customer logo; King & Wood Mallesons is quoted on the Command Center page. |
| Website | https://www.harvey.ai |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan, region and optional modules | Public claim only | The Platform Agreement distinguishes Basic Service from optional modules covered by the Service Terms. Ask LexisNexis, web browsing/Knowledge Sources, Covered AI Services (formerly Extended AI) and Preview Features are optional, administrator-configurable, and not included in Basic Service. Separate US, EU and AU logins exist. | Which order-form modules, processing region and Preview Features will be enabled for our tenancy, and which remain off by default? | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms); [Harvey — Security](https://www.harvey.ai/security) |
| Deployment and hosting | Public claim only | Harvey hosts on Microsoft Azure and offers processing in the US, EU/Switzerland or Australia, stating that this applies to subprocessors as well. Login hosts exist at app.harvey.ai, eu.app.harvey.ai and au.app.harvey.ai. It remains a multi-tenant SaaS product; private cloud or on-prem is not offered as a standard deployment. | Record the contracted Azure region, tenancy identifier and any private-link or IP-allowlist requirements in the order form. | [Harvey — Security](https://www.harvey.ai/security); [Harvey — Data Processing Addendum](https://www.harvey.ai/legal/data-processing-addendum) |
| Product surfaces | Public claim only | Public product pages describe Assistant, Vault, Knowledge, Agents, Word and Outlook add-ins, mobile apps, Spaces, Contract Intelligence, Command Center and an API/MCP. Agent actions are described as requiring preview and approval before they run. | List the surfaces and agent types in our licence, which are generally available versus preview, and which administrators can disable. | [Harvey — Home / Agents](https://www.harvey.ai/); [Harvey — Vault](https://www.harvey.ai/platform/vault); [Harvey — Knowledge](https://www.harvey.ai/platform/knowledge); [Harvey — Ecosystem](https://www.harvey.ai/platform/ecosystem) |
| Legal-content jurisdiction | Public claim only | Knowledge lists licensed databases including Ask LexisNexis, Wolters Kluwer, EUR-Lex and EDGAR, and claims a pipeline into 500+ sources. ISO 42001 materials mention US, UK, EU, APAC and MENA knowledge sources. No named AustLII, Jade or Westlaw Australia connector was found on the Knowledge page as at 2026-09-20. | Which Australian primary-law collections (federal and state) are available in our workspace, how current are they, and how is negative treatment shown? | [Harvey — Knowledge](https://www.harvey.ai/platform/knowledge); [AI Governance at Harvey: ISO 42001 Certification](https://www.harvey.ai/blog/governance-iso-42001) |
| Licence and pricing unit | Not confirmed | No public price list, seat minimum, usage cap or overage rate was published as at 2026-09-20. The Platform Agreement refers fees and term to the order form. Vendor marketing cites 25+ hours saved per typical user per month; that figure is not an independent measurement. | Provide an itemised year-one and year-two quote for our user count, listing seats, modules, usage/overage, support, implementation and any auto-renewal or uplift. | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Customers](https://www.harvey.ai/customers) |
| Word, Outlook and DMS integrations | Public claim only | Ecosystem pages describe native Word and Outlook add-ins, mobile apps, and DMS connectors for iManage, NetDocuments, SharePoint and Google Drive. An October 2025 engineering post describes bidirectional iManage Cloud and on-prem integration via OAuth, including a Clayton Utz on-prem deployment. Permission inheritance after transfer still needs a firm-side test. | Demonstrate, in our tenancy, Word/Outlook round-trip, iManage or NetDocuments permission inheritance in real time, and where prompts and outputs are written back to the matter. | [Harvey — Ecosystem](https://www.harvey.ai/platform/ecosystem); [Building Harvey's iManage Integration](https://www.harvey.ai/blog/building-harveys-imanage-integration) |
| Support and service levels | Public claim only | The Platform Agreement incorporates Support and Service Level Terms. The Security Addendum commits to 24/7 monitoring and incident response. The public Support and SLA document was not scraped in this pass; response times, Australian-hours coverage and credits were not verified from a signed copy. | Provide the Support and Service Level Terms that will apply to our order, including severity matrix, Australian-hours coverage, security contact and service credits. | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Security Addendum](https://www.harvey.ai/legal/security-addendum) |
| Independent quality evidence | Public claim only | The February 2025 Vals Legal AI Report evaluated Harvey Assistant on six of seven tasks: it led participating tools on several, including Document Q&A (94.8%), and scored 59.4% on redlining against a 79.7% lawyer baseline; Harvey withdrew from EDGAR Research. Harvey also publishes BigLaw Bench and Harvey LAB as its own evaluation frameworks. Neither is an Australian-corpus, firm-document trial. | Run our de-identified Australian benchmark set in our tenancy and disclose method, error types and any change in scores after the current model mix. | [Vals Legal AI Report (VLAIR), February 2025](https://www.vals.ai/industry-reports/vlair-2-27-25); [AI Governance at Harvey: ISO 42001 Certification](https://www.harvey.ai/blog/governance-iso-42001) |
| Task fit | Public claim only | The product is built for bounded legal work (research over supplied or licensed sources, Vault review, playbook redlining, drafting in Word, agent-run checklists). Open-ended advice, court documents citing authority, and affidavit content remain high-risk regardless of the vendor. Web and Ask LexisNexis answers are a different grounding path from Vault-only work. | Which of our named tasks will run only over Vault/DMS documents, which will use licensed databases, and which (if any) will be allowed to call web search? | [Harvey — Home / Agents](https://www.harvey.ai/); [Harvey — Vault](https://www.harvey.ai/platform/vault); [Harvey — Knowledge](https://www.harvey.ai/platform/knowledge); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms) |
| Client-facing use and authority | Public claim only | The Platform Agreement states the Service is a research tool, Output is not legal advice, and Output may contain errors. Shared Spaces with External Collaboration require the customer to have the necessary rights and consents for any external data shared. No unsupervised client-facing advice product was described. Matter- or client-level exclusion to honour outside-counsel guidelines is not documented in the public pages reviewed. | Can administrators exclude named clients or matters from Harvey, and what client-ready description of data use will you provide for engagement letters? | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms) |
| Model providers and routing | Public claim only | The 2 August 2026 subprocessor list names Microsoft, OpenAI, Google Cloud, AWS, Anthropic, ElevenLabs, DeepL, Mistral, Baseten and Fireworks as AI providers, with locations including US, EU, Switzerland and Australia for several. Anthropic is listed as US (with Bedrock/Vertex routing notes). Harvey's March 2026 multi-model post names Claude Opus 4.6, GPT-5.2, Sonnet and Gemini 3 Flash as examples in production. A listed entity location does not prove the endpoint used for our tenancy. | Identify the providers, models and inference regions actually used for our enabled features, whether we can pin or disable providers, and the notice given on model change. | [Harvey — Subprocessor List (updated 2 August 2026)](https://www.harvey.ai/legal/subprocessors); [Why Harvey is Multi-Model by Design](https://www.harvey.ai/blog/why-harvey-is-multi-model-by-design) |
| Subprocessor list and change notice | Public claim only | A dated list (2 August 2026) names AI, hosting, web-browsing (SuSea/you.com, Parallel) and Ask LexisNexis (RELX) subprocessors, with prior versions linked. The DPA gives 30 days' notice of additions if the customer subscribes to the notice list, a 15-day objection window, flow-down of materially equivalent protections, and Harvey remaining liable for subprocessors. | Confirm we are subscribed to subprocessor notices, that our no-training, residency and deletion terms flow down, and that we may terminate if an objection cannot be resolved. | [Harvey — Subprocessor List (updated 2 August 2026)](https://www.harvey.ai/legal/subprocessors); [Harvey — Data Processing Addendum](https://www.harvey.ai/legal/data-processing-addendum) |
| Training and secondary use | Public claim only | Platform Agreement s 11.8: Harvey will not train any AI models using Customer Content or Customer Data; subprocessors will not either. Privacy Center (13 July 2026) repeats that Harvey does not use Customer Data or Content to train models or improve products, and that AI-provider subprocessors are contractually prohibited from training. The security page separately allows customer-requested bespoke training on that customer's data only. Harvey does use publicly available legal information to develop its platform. | Confirm the signed no-training clause covers prompts, outputs, uploads, embeddings, feedback and telemetry, that no Covered AI Service or bespoke model changes it for our tenancy, and that public-data training is out of scope of our content. | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Privacy Center (updated 13 July 2026)](https://www.harvey.ai/legal/harvey-privacy-center); [Harvey — Security](https://www.harvey.ai/security) |
| Feedback and usage data | Public claim only | Feedback is defined as suggestions and corrections and excludes Customer Data and Content; Harvey may freely use Feedback but not in a way that identifies the customer or its content. Usage Data (access, volume, feature use — not Customer Data or Content) may be used to develop, improve, support and operate the Service, and may be shared only if aggregated and anonymised or under confidentiality. Preview Feature feedback may be used to improve the Service. | Confirm thumbs-up/down, edits and prompt logs are treated as Customer Content (not Feedback), are not used to train, and can be excluded from any service-improvement analytics. | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms) |
| Retention and zero data retention | Public claim only | Security FAQ: Harvey requires zero data retention by model providers. Privacy Center: when a subprocessor must retain content for a feature, that feature is disabled by default and administrator-enabled; scope is in the Service Terms. Service Terms: workspace retention settings do not apply to certain features (help article is login-gated); Covered AI Services allow subprocessors to retain content for their services, safety review or law. Detailed per-store periods were not in the public pages. | List retention for prompts, uploads, embeddings, outputs, logs, backups and each optional feature in our tenancy, including Covered AI Services, and confirm ZDR is on the order form for every enabled model endpoint. | [Harvey — Security](https://www.harvey.ai/security); [Harvey — Privacy Center (updated 13 July 2026)](https://www.harvey.ai/legal/harvey-privacy-center); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms) |
| Deletion on instruction and exit | Public claim only | DPA s 14: within 30 days of termination or a reasonable request, Harvey shall, and shall direct each subprocessor to, return or delete Customer Personal Data unless required by law to retain it. Security page: customers can delete data anytime and set retention. Matter-level self-service deletion, backup rotation period and a deletion certificate are not specified in the public DPA text reviewed. | Confirm matter-level deletion, backup purge lag, flow-down to every subprocessor including model-provider stores, export formats, and whether a deletion certificate is issued without request. | [Harvey — Data Processing Addendum](https://www.harvey.ai/legal/data-processing-addendum); [Harvey — Security](https://www.harvey.ai/security) |
| Vendor and provider human access | Public claim only | Platform Agreement: subprocessors other than cloud storage providers will not retain or log Customer Content or Data for human review. Privacy Center: Harvey accesses Customer Data or Content only to provide or support the Service or to comply with law. Security-by-design post: support personnel do not have default access; access requires specific individual authorisation. Covered AI Services expressly allow subprocessor safety review of content when those features are enabled. | For our enabled features, who at Harvey or a subprocessor can read content, is that access logged and visible to us, and are Covered AI Services off? | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Privacy Center (updated 13 July 2026)](https://www.harvey.ai/legal/harvey-privacy-center); [Security by Design: How Harvey Engineered Trust from Day One](https://www.harvey.ai/blog/security-by-design); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms) |
| SSO, MFA, SCIM and ethical walls | Public claim only | Security page lists SAML SSO, audit logs, IP allow-listing and ethical-wall synchronisation from the firm's walls provider (Harvey does not create or delete walls). A November 2025 blog said SCIM would enter early access later that year; a help.harvey.ai/articles/scim-integration URL exists but is login-gated, so general availability was not confirmed from public text. Command Center describes syncing employee profile attributes. | Confirm SAML SSO can be enforced with local passwords disabled, whether SCIM is generally available on our tier, and demonstrate wall changes taking effect at query time on our DMS. | [Harvey — Security](https://www.harvey.ai/security); [Scale Securely With Finer Admin Controls](https://www.harvey.ai/blog/finer-admin-controls); [Harvey — Command Center](https://www.harvey.ai/platform/command-center) |
| Encryption in transit and at rest | Public claim only | Security Addendum s 3: AES-256 (or better) at rest for Customer Data and Content; TLS 1.2 (or better) in transit over public or untrusted networks; keys rotated at least annually and held in hardware security modules, logically separated from content. Customer-managed keys were not described. | Does at-rest encryption cover embeddings, indexes, logs and backups, is BYOK available, and is the model-provider hop included in the TLS commitment? | [Harvey — Security Addendum](https://www.harvey.ai/legal/security-addendum) |
| Independent security and AI-management assurance | Public claim only | Security page displays SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001 and AIUC-1 badges and names Schellman, NCC Group and Bishop Fox. ISO 42001 was announced 5 June 2026. The Security Addendum promises annual third-party audits and that SOC 2 Type II reports, ISO certificates, statements of applicability and penetration-test summaries are available on request. The reports themselves were not inspected in this review. | Provide the current SOC 2 Type II report, ISO 27001 and 42001 certificates with scope, any exceptions, a bridge letter, and the latest penetration-test executive summary covering AI features. | [Harvey — Security](https://www.harvey.ai/security); [Harvey — Security Addendum](https://www.harvey.ai/legal/security-addendum); [AI Governance at Harvey: ISO 42001 Certification](https://www.harvey.ai/blog/governance-iso-42001) |
| Contract, DPA, liability and forum | Public claim only | Public Platform Agreement (customer owns Content; no-training; confidentiality covers Content and Customer Data), DPA, Security Addendum and Service Terms are incorporated. Liability cap is the greater of 12 months' fees or USD 250,000; data-breach/confidentiality claims the greater of 2× fees or USD 500,000. IP indemnity covers the Service, not Output. Governing law is California (or England and Wales for EEA/UK/Switzerland customers) with arbitration. Australian law/forum is not offered in the public terms. | Will you execute the public DPA and Security Addendum without dilution, raise the data-breach cap, and offer Australian law or an Australian forum for our order? | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Data Processing Addendum](https://www.harvey.ai/legal/data-processing-addendum); [Harvey — Security Addendum](https://www.harvey.ai/legal/security-addendum) |
| Cross-border processing and Australian residency | Public claim only | Security page: keep everything in-region — EU/Switzerland, US or Australia — including subprocessors. Clayton Utz's media release states storage and processing for its tenancy take place in Australia. Service Terms: web browsing, Knowledge Sources and Ask LexisNexis subprocessors may process outside the selected region; Covered AI Services may store and process in a different location. Privacy Policy has an Australia section addressing the Privacy Act 1988 (Cth). | For our AU region, list every exception (web, Ask LexisNexis, Covered AI, support, backups, telemetry) with country and APP 8 basis, and confirm inference as well as storage stays in Australia for Basic Service. | [Harvey — Security](https://www.harvey.ai/security); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms); [Harvey — Privacy Policy](https://www.harvey.ai/legal/privacy-policy); [Clayton Utz media release: adopts Harvey (via Lexology)](https://www.lexology.com/library/detail.aspx?g=97ef546d-5d58-47e8-8daa-3c97c2747cc0) |
| Breach notification | Public claim only | Security Addendum s 8: if Harvey becomes aware of a Security Incident affecting Customer Data or Content, it will notify without undue delay and in any case within 48 hours after becoming aware, at the security notice email on the order form; it will contain, investigate and mitigate, preserve relevant logs for at least one year, and share nature, consequences, investigation status and a contact point. No public incident register or status-page history was reviewed. | Name the notice email on our order form, confirm 48 hours runs from discovery (not confirmation), that subprocessor incidents flow through on the same clock, and provide any incident history for the last 24 months. | [Harvey — Security Addendum](https://www.harvey.ai/legal/security-addendum) |
| Unilateral changes and model updates | Public claim only | Platform Agreement: Harvey may update Terms but not so as to detract from confidentiality, Customer Data/Content or security obligations without written authorisation. If an update negatively impacts the customer, a 15-day discussion window applies, then the customer may terminate with a pro-rata refund of unused prepaid fees. Service Terms: Preview Features may change or be discontinued. No contractual advance-notice period for production model swaps was found. | What notice and testing window apply to production model or prompt changes, and can we pin a model version for a defined period? | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms); [Why Harvey is Multi-Model by Design](https://www.harvey.ai/blog/why-harvey-is-multi-model-by-design) |
| Exit, export and termination | Public claim only | Either party may terminate for material breach uncured in 30 days, with pro-rata refund of unused prepaid fees. DPA requires return or deletion of Customer Personal Data within 30 days, including subprocessors. A self-service bulk export of conversations, playbooks, Vault objects and audit logs in open formats was not demonstrated in public documentation. API/MCP is documented at developers.harvey.ai. | Show a trial export of documents, chats, playbooks, workflows and audit logs in open formats, the post-termination export window, and certified deletion including embeddings and backups. | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Data Processing Addendum](https://www.harvey.ai/legal/data-processing-addendum); [Harvey — Ecosystem](https://www.harvey.ai/platform/ecosystem) |
| Connectors and DMS permissions | Public claim only | iManage integration is described as OAuth, bidirectional, with one-click disconnect at user or workspace level and the same segregation/retention as other customer data. On-prem iManage is supported via a customer-controlled network path. Administrators can enable or disable integrations from feature settings. Whether retrieval honours live DMS ACLs versus a copied index is not fully specified in public text. | For each connector we will enable, what data leaves the source system, are permissions checked at query time, and can we disconnect without residual copies in Vault? | [Building Harvey's iManage Integration](https://www.harvey.ai/blog/building-harveys-imanage-integration); [Harvey — Ecosystem](https://www.harvey.ai/platform/ecosystem); [Scale Securely With Finer Admin Controls](https://www.harvey.ai/blog/finer-admin-controls) |
| Web browsing and Knowledge Sources | Public claim only | Service Terms treat Web Browsing and Knowledge Sources as optional, administrator-configurable Targeted Source Features. SuSea (you.com) and Parallel process Customer Data and Content in the locations on the subprocessor list and may not process in the selected region; you.com is stated as not HIPAA compliant. Queries can hit public websites. These features are not part of proving a closed, in-region Vault workflow. | Confirm web browsing and Knowledge Sources are off for our workspace, or if on, which URLs and query text leave Australia and under which subprocessor. | [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms); [Harvey — Subprocessor List (updated 2 August 2026)](https://www.harvey.ai/legal/subprocessors) |
| Agent actions and human authorisation | Public claim only | Product pages state agents preview the plan, the user approves work before Harvey begins, and high-impact work is nudged back to a person. ISO 42001 post: agentic actions require explicit human authorisation before proceeding. Service Terms allow External Collaboration in Shared Spaces, which can let outside users view, edit, download and query Resources. Autonomous send/share/delete without confirmation is not described as a default, but the full action catalogue is not public. | List every action an agent can take on email, DMS or the web in our configuration, which require per-action approval, and how we stop a running agent. | [Harvey — Home / Agents](https://www.harvey.ai/); [AI Governance at Harvey: ISO 42001 Certification](https://www.harvey.ai/blog/governance-iso-42001); [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms) |
| Human review of outputs | Public claim only | Platform Agreement: Output is AI-generated and may contain errors or be incomplete; it is not legal advice. Product copy: every claim is backed by a citation and every step is logged. ISO 42001 post: outputs cite sources so users can verify results; audit logs are enabled by default. Verification time on the firm's own Australian documents is not published. | Show sample outputs for our tasks with per-statement source pinpoints, 'not found' behaviour, and an exportable log of who approved each agent run. | [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement); [Harvey — Home / Agents](https://www.harvey.ai/); [AI Governance at Harvey: ISO 42001 Certification](https://www.harvey.ai/blog/governance-iso-42001) |

## Notes

List price, order-form term/uplift/overage, SCIM GA status (help article is login-gated), Support and SLA terms text, full SOC 2/ISO reports, matter-level deletion certificate, and native Australian primary-law coverage were not verified from public pages. Covered AI Services, web browsing and Ask LexisNexis are the main residency/retention exceptions and must be confirmed off or mapped for any Australian tenancy.

## Sources

- [Harvey — Security](https://www.harvey.ai/security) (checked 2026-09-20)
- [Harvey — Customers](https://www.harvey.ai/customers) (checked 2026-09-20)
- [Harvey — Security Addendum](https://www.harvey.ai/legal/security-addendum) (checked 2026-09-20)
- [Building Harvey's iManage Integration](https://www.harvey.ai/blog/building-harveys-imanage-integration) (checked 2026-09-20)
- [Why Harvey is Multi-Model by Design](https://www.harvey.ai/blog/why-harvey-is-multi-model-by-design) (checked 2026-09-20)
- [Harvey Raises $550M at a $15.5B Valuation](https://www.harvey.ai/blog/harvey-raises-dollar550m-at-a-dollar155b-valuation-to-help-legal-teams-own-their-intelligence) (checked 2026-09-20)
- [AI Governance at Harvey: ISO 42001 Certification](https://www.harvey.ai/blog/governance-iso-42001) (checked 2026-09-20)
- [Vals Legal AI Report (VLAIR), February 2025](https://www.vals.ai/industry-reports/vlair-2-27-25) (checked 2026-09-20)
- [Harvey — Privacy Center (updated 13 July 2026)](https://www.harvey.ai/legal/harvey-privacy-center) (checked 2026-09-20)
- [Security by Design: How Harvey Engineered Trust from Day One](https://www.harvey.ai/blog/security-by-design) (checked 2026-09-20)
- [Scale Securely With Finer Admin Controls](https://www.harvey.ai/blog/finer-admin-controls) (checked 2026-09-20)
- [Harvey — Data Processing Addendum](https://www.harvey.ai/legal/data-processing-addendum) (checked 2026-09-20)
- [Harvey — Command Center](https://www.harvey.ai/platform/command-center) (checked 2026-09-20)
- [Harvey — Privacy Policy](https://www.harvey.ai/legal/privacy-policy) (checked 2026-09-20)
- [Clayton Utz media release: adopts Harvey (via Lexology)](https://www.lexology.com/library/detail.aspx?g=97ef546d-5d58-47e8-8daa-3c97c2747cc0) (checked 2026-09-20)
- [Harvey — Platform Agreement](https://www.harvey.ai/legal/platform-agreement) (checked 2026-09-20)
- [Harvey — Subprocessor List (updated 2 August 2026)](https://www.harvey.ai/legal/subprocessors) (checked 2026-09-20)
- [Harvey — Service Terms (updated 16 September 2026)](https://www.harvey.ai/legal/service-terms) (checked 2026-09-20)
- [Harvey — Home / Agents](https://www.harvey.ai/) (checked 2026-09-20)
- [Harvey — Vault](https://www.harvey.ai/platform/vault) (checked 2026-09-20)
- [Harvey — Knowledge](https://www.harvey.ai/platform/knowledge) (checked 2026-09-20)
- [Harvey — Ecosystem](https://www.harvey.ai/platform/ecosystem) (checked 2026-09-20)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.