Data retention policy
Customers can set retention policies and delete data at any time. Within 30 days after termination, Harvey securely deletes remaining Customer Data or Content unless the customer instructs otherwise. Customer Personal Data governed by Harvey’s Data Processing Addendum is returned or deleted within 30 days of service termination or a reasonable request, unless applicable law requires retention. Audit logs are retained for at least one year and up to ten years.
Data archiving and removal policy
Customers can set retention policies and delete data at any time. Within 30 days after termination, Harvey securely deletes remaining Customer Data or Content unless the customer instructs otherwise. Customer Personal Data governed by Harvey’s Data Processing Addendum is returned or deleted within 30 days of termination or a reasonable request, unless applicable law requires retention.
Data storage policy
Harvey stores and processes Customer Data and Content in the geographic region specified in the customer’s order form or otherwise agreed in writing. Data is logically separated by customer and encrypted using AES-256 or better at rest and TLS 1.2 or better in transit.
Data hosting company
Microsoft Azure
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
OpenAI GPT-5, o3, GPT-4.1 and GPT-4o; Anthropic Claude Sonnet and Opus 4; and Google Gemini 2.5 Pro. Harvey selects models based on each request.
LLM retention settings
For Harvey’s core service, model providers use Zero Data Retention and may not retain data for human review. Optional admin-enabled Extended AI Features may have different retention terms disclosed in Harvey’s Service Terms.
LLM data tenancy policy
Customer workspaces are logically separated. Harvey and its model providers do not use Customer Data or Content to train shared models, and providers are contractually barred from using it to train or improve their services.
LLM data residency policy
Customer Data and Content are processed in the customer’s agreed region. Supported regions include the US, EU/Switzerland, and Australia. Model-provider locations are listed at harvey.ai/legal/subprocessors.