The facts, with their sources

Done-for-you service: NoHarvey sells software a firm runs itself on one platform, not a consultancy engagement where Harvey's people do the legal work.Firms and legal departments do their best work with Harvey. Run everything your team and practice needs on one collaborative platform.harvey.ai

Runs autonomously: PartlyAgents execute tasks end to end and run in the background or on a schedule, but the vendor keeps a human approving the plan and reviewing output.Preview the plan, adjust the scope, and approve work before Harvey begins.harvey.ai/platform/agents
Multi-agent: YesThe vendor states that one task can be split across several agents working in parallel, with routing to the right agent.Hand off one task or ten. Harvey coordinates multiple agents to complete work in parallel and deliver review-ready outputs.harvey.ai/platform/agents
Agent permissions: PartlyScope is approved before a run and the agent escalates to a human when judgment is needed; API tokens additionally carry per-endpoint permission lists.Harvey proactively brings you in when your judgment is needed, then keeps work moving.harvey.ai/platform/agents

Claude: YesAnthropic models are integrated across the platform, with the vendor naming Claude Opus and Sonnet releases running in Harvey products.Claude Opus 4.6, for example, excels at agentic reasoning and deep multi-step legal analysisharvey.ai/blog/why-harvey-is-multi-mode…
GPT: YesOpenAI models are among the frontier models incorporated, and the vendor describes GPT-5.2 behaviour inside the platform.while GPT-5.2 pairs strong analytical abilities with capability awarenessharvey.ai/blog/why-harvey-is-multi-mode…
Open models: NoThe vendor's own account of its multi-model architecture names only three closed frontier providers, with no open-weight option offered to customers.expanding its platform to incorporate leading foundation models from Anthropic, Google DeepMind, and OpenAIharvey.ai/blog/why-harvey-is-multi-mode…
Model choice: YesWorkspace admins decide which providers are enabled and individual users can pick a model in the selector, so the choice is the customer's.Harvey allows workspace administrators to determine which models are available to their organization.harvey.ai/blog/why-harvey-is-multi-mode…

In a browser: YesHarvey is a hosted workspace reached in the browser, with admin settings pages, plus Word and Outlook add-ins and native mobile apps alongside it.To create and manage API tokens for your organization’s workspace, visit the "API Tokens" section in your workspace settings.developers.harvey.ai/api-reference/auth…

Self-hosted: NoHarvey runs only in its own Azure cloud environment; the customer choice offered is which region processes the data, not which infrastructure.Harvey hosts its cloud environment in Microsoft Azure.harvey.ai/security

API access: YesA documented REST API with bearer tokens covers assistant completions, Vault projects, review tables, audit logs and client matters.The Harvey API uses bearer token authentication. Include the token in the Authorization header of all API requests.developers.harvey.ai/api-reference/auth…
MCP server: PartlyA hosted MCP server exposes five Harvey tools to Claude, Gemini and Copilot, but the docs say a user must be enrolled in the feature first.The Harvey MCP Server exposes some of Harvey's core features — legal Q&A, Vault document analysis, and research knowledge sources as MCP tools.developers.harvey.ai/guides/harvey_mcp.…

A company can buy it: YesThe unit of sale is an organisation workspace with admin settings, named customer success contacts and firm-wide deployments.Rate limits are applied per organization and are reset every minute.developers.harvey.ai/api-reference/rate…
Admin controls: YesAdmins constrain the agent and its users through role-based access, model availability, IP allow-listing, retention rules and synced ethical walls.Harvey enforces strict role-based access controls and logical workspace separation to ensure that only authorized users can access specific customer…harvey.ai/security
Audit log: YesAudit logs are both an enterprise control and a documented API, queryable and paginable for workspace activity monitoring.Audit Logs: Query and retrieve audit logs for workspace activity monitoringdevelopers.harvey.ai/llms.txt
Single sign-on: YesSAML SSO is named as a default enterprise control alongside audit logs and IP allow-listing; OIDC is not mentioned.delivering 24/7 monitoring alongside enterprise-grade controls, including SAML SSO, audit logs, IP allow-listing, and data lifecycle managementharvey.ai/security

Opt out of training: YesNo training on customer data is the contractual default rather than a setting, and the vendor requires zero data retention from model providers.We don’t use inputs, outputs, or uploaded documents to train underlying models.harvey.ai/security
Data residency: YesProcessing can be kept in-region in the EU or Switzerland, the US or Australia, and the regional API endpoints match those deployments.set retention policies, delete data anytime, and keep everything in-region—EU or Switzerland, US, or Australiaharvey.ai/security
Getting out: PartlyCustomers set retention and can delete data at any time, and usage and query history are exportable by API, but no document bulk-export or credit-expiry terms are published.Customers can determine what data to upload to Harvey, how long it is retained, and whether that data can be shared with others within the company.harvey.ai/security
Certifications: YesAnnually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing.Harvey undergoes annual SOC 2 Type II and ISO 27001 audits to validate these controls.harvey.ai/security