Harvey is an AI-powered legal assistant that streamlines legal research, document drafting, and case management, enhancing efficiency for legal professionals and firms.
Harvey is an AI-powered legal assistant built on advanced models like GPT, trained specifically on legal data to streamline research, document drafting, contract analysis, and case management for legal professionals. Its core value proposition lies in enabling lawyers to delegate complex tasks via natural language, delivering outputs with verifiable citations from authoritative sources, while saving teams an average of 20+ hours per month on repetitive work. Key features include the versatile Assistant for analyzing up to 50 documents at once, extracting clauses, summarizing differences, and drafting long-form content; seamless Microsoft Word integration for editing; continuously updated Knowledge for jurisdiction-specific legal queries across 60+ countries and multiple languages; and specialized Workflows like Smart Redline, document translation, and motion drafting. Designed for top law firms, AmLaw 100 enterprises, and in-house teams at organizations like King & Wood Mallesons and Syngenta, it excels in high-stakes use cases such as contract review, multi-jurisdictional research, and scaling legal operations. What sets Harvey apart is its enterprise-grade security with SOC2, CCPA, ISO 27001, and GDPR compliance, plus adoption by over 1,000 firms and 100,000 professionals, positioning it as a secure, precision-focused platform that prioritizes strategic judgment over routine tasks.[1][3][5]
Harvey explicitly prohibits AI model training on user content and customer data. The ToS clearly states 'Harvey will not
No training on user data means no opt-out is necessary.
Low risk across data training, licensing, and sharing dimensions.
Harvey explicitly prohibits AI model training on user content and customer data. The ToS clearly states 'Harvey will not train any AI models using Your Content or Customer Data' and extends this protection to subprocessors, with an exception only for cloud storage providers.
“[ToS] 'No Training. Harvey will not train any AI models using Your Content or Customer Data. Subprocessors will not train any AI models using Your Content or Customer Data.'”
Harvey grants only a limited, non-exclusive license to process customer data solely for service delivery. The license is restricted to providing the Service and addressing technical problems, with no sublicensing rights beyond essential service delivery.
“[ToS] 'You grant to Harvey and its Affiliates a non-exclusive, worldwide, royalty-free right to process the Customer Data and Your Input to the extent necessary to provide the Service to You or Your Affiliates, to prevent or address service or technical problems with the Service.'”
Harvey may use subcontractors and third-party providers but remains responsible for their performance. While a subprocessor list is published and new subprocessors require 15-day notice, the DPA controls subprocessor obligations. Usage Data may be shared if aggregated and anonymized, creating moderate concern about data sharing scope.
“[ToS] 'Harvey may use subcontractors and other third-party providers in connection with the performance of its activities under these Terms as it deems appropriate, provided that it remains responsible for the performance of any such subcontractors or third-party providers.'”
Harvey commits to secure deletion of remaining customer data within 30 days of termination unless otherwise instructed. The DPA specifies data retention periods aligned with the agreement term and requires deletion or return at the data exporter's choice upon contract termination.
“[ToS] 'Within 30 days of termination, Harvey will securely delete any remaining Customer Data or Content unless otherwise instructed by You.' [DPA] 'After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter.'”
The user/company retains all right, title, and interest in their Content and Customer Data. Harvey claims no ownership rights over user-generated outputs or inputs, and the agreement explicitly states 'As between the parties, You own Your Content.'
“[ToS] 'As between the parties, You own Your Content.' 'As between the parties, You retain all right, title and interest (including any and all intellectual property rights) in and to the Customer Data.'”
Harvey maintains industry-standard insurance and is self-certified under the Data Privacy Framework. However, specific compliance certifications (SOC 2 Type II, ISO 27001, HIPAA) are not explicitly mentioned in the provided documents, though a Security Addendum and trust page are referenced.
“[ToS] 'Harvey will maintain industry-standard insurance provided by companies with a minimum A.M. Best rating of A-, VI or better.' [DPA] 'Harvey is self-certified under the Data Privacy Framework.'”
Track and measure your AI tools with Olakai's observability platform.
Explore Olakai