Vendor record · harvey.ai
What Harvey promises about your data.
Where Harvey publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Harvey lists its sub-processors at harvey.ai/legal/subprocessors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at harvey.ai/legal/data-processing-addendum (read October 14, 2026) gives you 15 days to object.
- Window
- 15
- Sub-processors
- 14
- Pages
- 4
- Copies
- 26
days to object when it adds a sub-processor
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Harvey DPA
Harvey's data processing agreement gives 15 days to object to a new sub-processor. Here is the clause, from our October 14, 2026 copy:
15
days to object
“You may, within 15 days of receiving the notice of the change, reasonably object to Harvey’s use of a Subprocessor on reasonable grounds relating to the protection of Customer Personal Data (the “Objection”) by following the instructions set forth in the Subprocessor List or by contacting [email address on the vendor's page] (the “Objection Notice”).”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Harvey published it.
harvey.ai/legal/data-processing-addendum · read 2026-10-14 · fingerprint f8e1ca9bdb11f14e…
How it says it sends notice
“LexisNexis | Ask LexisNexis | US | ** Harvey Entities If your Terms are with a Harvey entity other than Harvey AI Corp., the following is a list of Harvey entities that act as subprocessors. Subprocessor Name | Purpose | Location** | Harvey AI Corp | Provide the services | US | Customers may contact [email address on the vendor's page] with questions or concerns, and…”
harvey.ai/legal/subprocessors · read 2026-10-14
How it says it sends notice
“If You subscribe to receive email notifications at the Subprocessor List, then Harvey will notify You if Harvey intends to add one or more Subprocessors to the Subprocessor List at least 30 days before the change takes effect.”
harvey.ai/legal/data-processing-addendum · read 2026-10-14
Harvey sub-processors
Harvey publishes a sub-processor list at harvey.ai/legal/subprocessors; we last read it on October 15, 2026. It names 14 entries. The entries, as the list prints them: Amazon Web Services; Anthropic, PBC; Baseten Labs, Inc.; DeepL SE; ElevenLabs Inc.; Fireworks.ai, Inc.; Google Cloud Platform; Harvey AI Corp; Microsoft Corp; Mistral AI SAS; OpenAI, LLC; Parallel Web Systems Inc.; RELX Inc., d.b.a. LexisNexis; SuSea, Inc (you.com). The same list is in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
14 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Harvey keeps your data
We hold no statement about data retention from Harvey's watched pages. The pages we watch: data processing agreement harvey.ai/legal/data-processing-addendum; privacy policy harvey.ai/legal/privacy-policy; sub-processor list harvey.ai/legal/subprocessors; trust and security page harvey.ai/security. On training with customer data, Harvey's trust and security page (harvey.ai/security, in the copy read October 11, 2026) says: “In that case, a bespoke model is created exclusively for you, and your data is never used to train models used by other customers. ### How often do you perform security audits and vulnerability assessments? Harvey conducts automated vulnerability scans, annual third-party penetration tests, and maintains continuous security monitoring. ## Secured by a World-Class Team [ ### Security by Design: Ho…”
Training on customer data
“We may aggregate or de-identify Personal Data so that You can no longer be identified and use the aggregated or de-identified data for the following purposes: - to investigate and study the effectiveness of our Services; - to update and improve our Services; - to develop, improve, and update the way in which we provide support and carry out our other business practices; - to conduct research and …”
harvey.ai/legal/privacy-policy · read 2026-10-10
Training on customer data
“Decide which data to upload, set retention policies, delete data anytime, and keep everything in-region—EU or Switzerland, US, or Australia. ### No Model Training Harvey contractually guarantees through our Platform Agreement that your data stays yours.”
harvey.ai/security · read 2026-10-11
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 14 · 6 name an AI provider we list
Amazon Web Services
AI provider and cloud services provider
US, EU, Switzerland, Australia
Anthropic, PBCAI · Anthropic
AI provider
US*
Baseten Labs, Inc.AI · Baseten
AI provider
US, EU, Australia
DeepL SE
AI provider (machine translation)
US, EU
ElevenLabs Inc.AI · ElevenLabs
AI provider (including voice services)
US, EU
Fireworks.ai, Inc.AI · Fireworks AI
AI provider
US, EU, Australia
Google Cloud Platform
AI provider
US, EU, Switzerland, Australia
Harvey AI Corp
Provide the services
US
Microsoft Corp
AI provider and cloud services provider
US, EU, Switzerland, Australia
Mistral AI SASAI · Mistral AI
AI provider
EU
OpenAI, LLCAI · OpenAI
AI provider
US, EU, Switzerland, Australia
Parallel Web Systems Inc.
Knowledge Sources and Web browsing
US, EU
RELX Inc., d.b.a. LexisNexis
Ask LexisNexis
US
SuSea, Inc (you.com)
Web browsing
US, EU
Certifications the trust page names · ISO 27001 · SOC 2 · SOC 2 Type II
Laws the trust page names · GDPR
The pages' own stamps: Last updated 2026-09-21 · Last updated 2026-08-02 · Last updated 2026-07-13
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
What this page doesn’t tell you
No score.
Nothing here rates Harvey. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Harvey? With an email at harvey.ai you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Harvey in your product? Hear the morning we read a change.
You get the lines that moved, in Harvey’s own words, and the date any window closes. No card. Nothing to cancel.