For the Most Sensitive Matters
Harvey keeps your client data safe with world-class security and data privacy measures.
Explore Security PortalEnterprise-Grade Protection
Dedicated Security Expertise
Harvey’s in-house security team spans infrastructure, product, and operations. We implement robust security protections across the stack, with 24/7 coverage and end-to-end monitoring.
Data Sovereignty and Control
With Harvey, you retain full control over your data. Decide which data to upload, set retention policies, delete data anytime, and keep everything in-region—EU or Switzerland, US, or Australia.
No Model Training
Harvey contractually guarantees through our Platform Agreement that your data stays yours. We don’t use inputs, outputs, or uploaded documents to train underlying models.
Enterprise-grade Features
Harvey includes default controls that enterprise teams expect: SAML SSO, audit logs, IP allow-listing, data lifecycle management, and more.
Enforceable Commitments
Harvey’s Security Addendum includes binding terms on data protection, data access, incident response SLAs, and other controls aligned with SOC 2, ISO, GDPR and other standards. Our commitments are auditable, enforceable, and built to exceed standard vendor terms.
Independently Tested
Harvey partners with top-tier security firms, including Schellman, NCC Group and Bishop Fox, to perform in-depth audits. This offers external validation that Harvey meets the highest standards of resilience.
Enterprise-grade security and controls
Harvey is built on a non-negotiable principle: protecting the security and confidentiality of our customers' data. We've designed our platform from the ground up to safeguard the most sensitive information.
Explore Security PortalSecurity is Fundamental to Everything We Do
We’ve built a comprehensive system that protects data at every level—from robust user authentication to vigilant network monitoring. Our approach combines cutting-edge technology with rigorous protocols, ensuring that information remains secure in an ever-changing digital landscape. We constantly test and improve our defenses, staying ahead of potential threats to maintain the trust our clients place in us.
Explore Security PortalHarvey defines “customer data” as documents uploaded into the application by customers of Harvey. This does not include queries or responses. We define “customer content” as queries provided by a user to Harvey and corresponding responses from Harvey. This does not include the raw uploaded documents, but model responses may be derived from uploaded documents. While these are separate terms defined in Harvey’s legal contracts and service agreements, in most cases we talk about customer data and content together.
Harvey encrypts all data at rest and in transit, uses strong access controls, and, by default, never trains on customer data. Harvey undergoes annual SOC 2 Type II and ISO 27001 audits to validate these controls. Additionally, Harvey passes on these obligations and contractual security commitments to subprocessors and external model providers. Customer data for each customer is logically separated to prevent any commingling of data between customers and Harvey implements strict access controls following the principle of least privilege.
Harvey hosts its cloud environment in Microsoft Azure. For customers with requirements or preferences for data localization we offer processing in the EU and Switzerland or Australia. This applies to Harvey subprocessors as well.
Harvey enforces strict role-based access controls and logical workspace separation to ensure that only authorized users can access specific customer data. Customers can determine what data to upload to Harvey, how long it is retained, and whether that data can be shared with others within the company.
Harvey contractually prohibits model providers from training on customer data and only uses your data for processing your requests, not for model improvement. Harvey requires Zero Data Retention (ZDR) by model providers.
Yes, but only if you explicitly request it. In that case, a bespoke model is created exclusively for you, and your data is never used to train models used by other customers.
Harvey conducts automated vulnerability scans, annual third-party penetration tests, and maintains continuous security monitoring.




