Does Harvey train on your data? (Business plans)
Doesn't train by default
Doesn't train on business data by default.
Firms can ask for a bespoke model trained on their own data.
Why this matters: A "no" keeps your prompts and files out of Harvey's models, where they couldn't be removed later. Confirm it covers the plan you use. Why training matters →
Below, check how long Harvey keeps your data and what it says about security and AI-management standards (SOC 2, ISO 27001 and ISO 42001). We also cover data processing agreements (DPAs), business associate agreements (BAAs) and HIPAA support, where data can be stored or processed, and zero data retention. Each answer links to Harvey's own page.
Trains on your data by default
Firms can ask for a bespoke model trained on their own data.
- harvey.ai/legal/terms-of-service · checked Nov 9, 2026
“Harvey will not train any AI models using Your Content or Customer Data. Subprocessors will not train any AI models using Your Content or Customer Data.”
- harvey.ai/security · checked Nov 9, 2026
“Yes, but only if you explicitly request it.”
Data retention
- harvey.ai/security · checked Nov 9, 2026
“Decide which data to upload, set retention policies, delete data anytime”
- harvey.ai/legal/terms-of-service · checked Nov 9, 2026
“Within 30 days of termination, Harvey will securely delete any remaining Customer Data or Content unless otherwise instructed by You.”
SOC 2 Type II
- harvey.ai/security · checked Nov 9, 2026
“Harvey undergoes annual SOC 2 Type II and ISO 27001 audits to validate these controls.”
ISO/IEC 27001
- trust.harvey.ai · checked Nov 9, 2026
“Harvey has successfully completed another SOC 2 Type II audit and renewed our ISO 27001 certification.”
ISO/IEC 42001
- trust.harvey.ai · checked Nov 9, 2026
“Harvey has recently achieved AIUC-1 certification and ISO 42001 certification”
DPA available
- harvey.ai/legal/terms-of-service · checked Nov 9, 2026
“Harvey will at all times abide by the Terms as well as the Data Processing Addendum with respect to the handling and processing of Your Customer Data and Content.”
BAA / HIPAA
- harvey.ai/legal/terms-of-service · checked Nov 9, 2026
“If You utilize Protected Health Information with the Service, such usage will further be subject to the terms of an executed Harvey Business Associate Addendum.”
Data residency options
EU or Switzerland, US, Australia.
- harvey.ai/security · checked Nov 9, 2026
“keep everything in-region—EU or Switzerland, US, or Australia.”
Zero-retention option
Required of model providers.
- harvey.ai/security · checked Nov 9, 2026
“Harvey requires Zero Data Retention (ZDR) by model providers.”
Vendor pages we monitor for this tool
We calculate a code from the page’s visible text each time we check it (a SHA-256 fingerprint). Changes to that code help us spot edits to the vendor’s terms.
| Page | Checked | Fingerprint |
|---|---|---|
| https://www.harvey.ai/legal/terms-of-service | Nov 9, 2026 | ab4ac8bdc1eb… |
| https://www.harvey.ai/security | Nov 9, 2026 | 1838acffab41… |
| https://trust.harvey.ai | Nov 9, 2026 | 2e7475bd506c… |
Compare with
- CoCounsel (Thomson Reuters) Doesn't train
- Adobe Firefly Doesn't train · Design, same training default
- Airtable AI Doesn't train · Productivity, same training default
See all Legal tools · Which AI tools don't train on your data? · Why AI training on your data matters · How we source and verify this