Question 1

Is Harvey SOC 2 compliant?

Accepted Answer

Yes. Harvey completes an annual SOC 2 Type II audit, conducted by Schellman. Harvey also partners with third-party security firms including NCC Group and Bishop Fox for in-depth penetration testing. The SOC 2 Type II report is available to customers and prospects through Harvey's trust center at trust.harvey.ai.

Question 2

Is Harvey ISO 27001 and ISO 42001 certified?

Accepted Answer

Yes to both. Harvey holds ISO/IEC 27001 (information security), renewed annually and audited by Schellman, and ISO/IEC 27701 (privacy information management). Harvey announced ISO/IEC 42001:2023, the AI management system standard, in June 2026, making it one of the legal AI vendors to hold the AI-specific governance certification. Certificates are listed on Harvey's trust center.

Question 3

Does Harvey train its AI models on my firm's data?

Accepted Answer

No, not by default. Harvey states it contractually prohibits its model providers from training on customer data, and uses your data only to process your requests, not for model improvement. Training on a firm's data happens only if the firm explicitly requests it, in which case a bespoke model is created exclusively for that firm and its data is never used to train models used by other customers.

Question 4

Does Harvey offer EU data residency?

Accepted Answer

Yes. Harvey offers in-region data residency for multinational firms, with processing available in the EU and Switzerland, the US, and Australia. This lets firms keep matter data inside their required region rather than relying only on transfer mechanisms. Confirm the specific region and configuration directly with Harvey before purchase.

Question 5

Does Harvey offer a DPA and is it GDPR compliant?

Accepted Answer

Yes. Harvey publishes a Data Processing Addendum and a Security Addendum with binding terms on data protection, data access, and incident response SLAs, and states it covers GDPR and CCPA requirements. The DPA and data transfer terms are available on Harvey's legal pages.

Question 6

Which law firms and professional services firms use Harvey?

Accepted Answer

Publicly named Harvey customers include Allen & Overy (now A&O Shearman), which began trialling Harvey in 2022, PwC, and Macfarlanes. Harvey is used inside large law firms and professional services organisations for legal research, drafting, and matter workflows.

Is Harvey SOC 2 compliant? Yes, plus ISO 27001, ISO 27701 and ISO 42001.

Harvey data handling, residency and GDPR, in detail

Does Harvey train its AI models on my firm's data?

Does Harvey offer EU data residency?

Does Harvey offer a DPA and is it GDPR compliant?

What AI governance certification does Harvey hold?

Harvey

Security Certifications

Public Reference Customers

Pricing Transparency

Data Residency and Training Opt-Out

Outcome Accountability

Time in Market

Team Composition