Harvey

Harvey platform (Assistant, Vault, Knowledge, Agents, workflows), enterprise. Your firm or legal department signs an order form with Harvey. Harvey's website offers a demo request, not a self-service sign-up.

Settings that lower the risk

1. Workspace retention settingWhat it does: Sets how long workspace data is kept. Harvey says options run as short as three hours, counted from upload or from last use. The Service Terms say the setting does not apply to certain features listed in Harvey's documentation.
2. Covered AI ServicesWhat it does: An optional feature that customer administrators configure. When it is used, the model company may keep data. Its people may review data for safety. Data may be processed outside your region. It has its own card.
3. Web Browsing and Knowledge Source featuresWhat it does: Optional features that administrators configure. The Service Terms say the subprocessors for these features may process data outside your selected region.
4. Ask LexisNexisWhat it does: Brings answers from Lexis+ AI into Harvey. The Service Terms say LexisNexis may process data outside your selected region. Harvey's subprocessor list gives its location as the US.
5. Email HarveyWhat it does: Lets users send questions to Harvey by email. The email subprocessor does not keep emails or allow human review of them. The exceptions are legal requirements and enforcement of its acceptable use policy. From November 15, 2026, that review is tied to automated scans that detect suspicious activity.
6. External Collaboration (Shared Spaces)What it does: Lets authorized users invite people outside the firm into a shared space. The Service Terms say shared material stays under the firm's own storage, processing, and retention settings.
7. Bring Your Own Key (BYOK)What it does: Harvey says customers who use BYOK manage the key that encrypts their stored data. Harvey says revoking the key makes the data inaccessible, including to Harvey. This is on Harvey's blog, not in the published terms.
8. MemoryWhat it does: Harvey says administrators control whether Memory is available, for all users or a subset. Harvey says each user can review, edit, search, or delete memories, or turn Memory off.

Worth knowing

• Covered AI Services lift the core promises on retention, human review, and data location for the traffic they handle. They have their own card.
• The Service Terms say the workspace retention setting does not apply to certain features. Harvey lists those features in its customer help center, which requires a login.
• From November 15, 2026, new Service Terms let Harvey employees or contractors, called Harvey Specialists, help with setup and use. The firm decides what information, if any, they receive.
• From November 15, 2026, Harvey's subprocessor list adds Applied Compute, an AI provider, and Confluent, a data infrastructure provider.
• Harvey may update its Service Terms and policies by posting them. The Platform Agreement says an update cannot weaken Harvey's obligations on confidential information, customer data, or security without the firm's written authorization.

What the policy says

Your data, in plain English

How long it is kept

• The firm sets a workspace retention period.
• Harvey says options run as short as three hours, counted from upload or from last use.
• Harvey says uploaded source files are securely destroyed when the period ends.
• The Service Terms say the setting does not apply to certain features.
• Harvey lists those features only in its customer help center, which requires a login.
• Within 30 days after the contract ends, Harvey must securely delete any remaining customer data and content, unless the firm instructs otherwise.
• Audit logs are kept for at least 1 year and up to 10 years.

What happens after you delete

Harvey says users can delete their data in the app at any time. Harvey's public pages do not say how fast deleted data leaves its systems. Harvey says uploaded source files are securely destroyed when the firm's retention period ends.

Copies kept anyway

• Audit logs are kept for at least 1 year and up to 10 years.
• Under the core terms, subprocessors other than cloud storage providers may not keep your content. Harvey says its model partners delete data once a request is complete.
• Data sent through Covered AI Services may be kept by the model company. See that card.
• Backups are not mentioned.

Temporary chat

Not offered as a named mode. The firm can set workspace retention as short as three hours.

Memory

• Harvey announced Memory on August 26, 2026, in early access, as part of Harvey II.
• Memory saves a user's preferences when the user asks, or when a prompt signals a preference.
• Harvey shows a confirmation card for each saved memory.
• Harvey says memories are scoped to the individual user.
• Users can review, edit, search, or delete memories, or turn Memory off.
• Administrators control whether Memory is available.
• Harvey says memories are never used to train AI models.
• Harvey does not say how long memories are kept.

Who at the provider can read it

• The Security Addendum lets Harvey personnel access customer data and content only to provide or support the service, or to comply with the law or a binding government order.
• Harvey personnel must sign confidentiality agreements.
• Under the core terms, subprocessors other than cloud storage providers may not log your content for human review.
• From November 15, 2026, Harvey Specialists, who are Harvey employees or contractors, may help the firm with configuration, implementation, or use.
• The firm decides what information, if any, they receive.
• Harvey treats that information as confidential.
• Harvey limits access to Specialists who need it.

Who else receives it

• Harvey's subprocessor list (September 21, 2026) names these AI providers: Microsoft, OpenAI, Google Cloud, Amazon Web Services, Anthropic, ElevenLabs, DeepL, Mistral AI, Baseten, and Fireworks.ai.
• The contract forbids every subprocessor to train on your data.
• From November 15, 2026, the list adds Applied Compute and Confluent.
• Web browsing uses you.com and Parallel Web Systems.
• Ask LexisNexis sends data to LexisNexis in the US.
• Firms that subscribe to notices get 30 days' warning of a new subprocessor.
• They may object within 15 days.
• No advertising use is stated.
• The DPA requires Harvey to tell the firm about binding law-enforcement requests, where the law allows.
• Harvey's law-enforcement policy says it sends requesters to the customer.
• The policy says Harvey discloses only the minimum.

Contract

• Harvey Platform Agreement (last updated January 9, 2026), Service Terms (September 16, 2026; a new version takes effect November 15, 2026), Security Addendum (December 26, 2025), and Data Processing Addendum (August 2, 2026), plus the firm's order form.
• The no-training promise binds Harvey.
• It also binds Harvey's subprocessors.
• The DPA makes Harvey the processor for customer personal data.
• Harvey is an independent controller for account and usage data.
• Your prompts, responses, and uploaded documents are your confidential information under the contract.
• Use of protected health information requires a signed Harvey Business Associate Addendum.

All sources for this plan (17)

• Harvey Service Terms, §2.2, §4.4, §5.3, §6.4, §7.2. Supports: retention setting does not apply to certain features; region exceptions; Email Harvey; Shared Spaces.
• Your Data, Your Control (Harvey blog), Data Flow: From Input to Deletion; Encryption and Customer Control. Supports: retention from upload or last use; source files destroyed; BYOK; model partners delete data.
• Harvey Platform Agreement, §7.4; §1.3.2. Supports: deletion within 30 days after termination; updates may not weaken obligations.
• Harvey Security Addendum, §9.2; §5.3. Supports: audit logs 1 to 10 years; personnel confidentiality.
• Harvey Data Processing Addendum, §4.1; §5.1. Supports: subprocessor notice and objection; law-enforcement notice.
• Harvey Subprocessor List, AI Model Providers and Infrastructure; Product Features. Supports: subprocessors.
• Harvey Subprocessor Preview Page, AI Model Providers and Infrastructure. Supports: subprocessors from November 15, 2026.
• Law Enforcement Requests, Policy. Supports: government requests.
• Harvey Security, FAQ. Supports: model providers keep no data (marketing statement).

Last checked against Harvey's pages on October 25, 2026.