# Harvey — Legal AI platform whose agents run end-to-end legal work for law firms and in-house teams.

> Source: The Agents Index — https://theagentsindex.com/harvey-ai (structured, researched, re-verified)
> Facts last verified: 2026-10-18

Harvey is a legal AI platform for law firms and in-house teams, pairing document vaults, legal research and contract review with agents that take a task end to end and return cited work. Admins run it as a governed enterprise workspace.

| Fact | Value |
| --- | --- |
| Website | https://harvey.ai |
| Price | Price on request |
| Free tier | Not applicable |

## What it does

**Done-for-you service** · No — Harvey sells software a firm runs itself on one platform, not a consultancy engagement where Harvey's people do the legal work.

> Firms and legal departments do their best work with Harvey. Run everything your team and practice needs on one collaborative platform.
> — https://www.harvey.ai/ · Homepage, 'One Platform for Legal Work' section intro

## How much it does unattended

**Runs autonomously** · Partly — Agents execute tasks end to end and run in the background or on a schedule, but the vendor keeps a human approving the plan and reviewing output.

> Preview the plan, adjust the scope, and approve work before Harvey begins.
> — https://www.harvey.ai/platform/agents · Agents page, 'Control the Quality of Work' - 'Review and Approve Work'

**Multi-agent** · Yes — The vendor states that one task can be split across several agents working in parallel, with routing to the right agent.

> Hand off one task or ten. Harvey coordinates multiple agents to complete work in parallel and deliver review-ready outputs.
> — https://www.harvey.ai/platform/agents · Agents page, 'Parallel Execution' feature block

**Agent permissions** · Partly — Scope is approved before a run and the agent escalates to a human when judgment is needed; API tokens additionally carry per-endpoint permission lists.

> Harvey proactively brings you in when your judgment is needed, then keeps work moving.
> — https://www.harvey.ai/platform/agents · Agents page, 'Nudges' feature block

## Which models it runs on

**Claude** · Yes — Anthropic models are integrated across the platform, with the vendor naming Claude Opus and Sonnet releases running in Harvey products.

> Claude Opus 4.6, for example, excels at agentic reasoning and deep multi-step legal analysis
> — https://www.harvey.ai/blog/why-harvey-is-multi-model-by-design · Blog 'Why Harvey is Multi-Model by Design', 'Quality: The Best Model for Every Task'

**GPT** · Yes — OpenAI models are among the frontier models incorporated, and the vendor describes GPT-5.2 behaviour inside the platform.

> while GPT-5.2 pairs strong analytical abilities with capability awareness
> — https://www.harvey.ai/blog/why-harvey-is-multi-model-by-design · Blog 'Why Harvey is Multi-Model by Design', 'Quality: The Best Model for Every Task'

**Open models** · No — The vendor's own account of its multi-model architecture names only three closed frontier providers, with no open-weight option offered to customers.

> expanding its platform to incorporate leading foundation models from Anthropic, Google DeepMind, and OpenAI
> — https://www.harvey.ai/blog/why-harvey-is-multi-model-by-design · Blog 'Why Harvey is Multi-Model by Design', opening paragraph

**Model choice** · Yes — Workspace admins decide which providers are enabled and individual users can pick a model in the selector, so the choice is the customer's.

> Harvey allows workspace administrators to determine which models are available to their organization.
> — https://www.harvey.ai/blog/why-harvey-is-multi-model-by-design · Blog 'Why Harvey is Multi-Model by Design', 'Choice: Putting Control Where it Belongs'

## Where you use it

**In a browser** · Yes — Harvey is a hosted workspace reached in the browser, with admin settings pages, plus Word and Outlook add-ins and native mobile apps alongside it.

> To create and manage API tokens for your organization’s workspace, visit the "API Tokens" section in your workspace settings.
> — https://developers.harvey.ai/api-reference/authentication · Authentication page, info callout at top

## Whose machine it runs on

**Self-hosted** · No — Harvey runs only in its own Azure cloud environment; the customer choice offered is which region processes the data, not which infrastructure.

> Harvey hosts its cloud environment in Microsoft Azure.
> — https://www.harvey.ai/security · Security page FAQ, 'Where is my data hosted and processed?'

## What it costs to run

**API access** · Yes — A documented REST API with bearer tokens covers assistant completions, Vault projects, review tables, audit logs and client matters.

> The Harvey API uses bearer token authentication. Include the token in the Authorization header of all API requests.
> — https://developers.harvey.ai/api-reference/authentication · Authentication page, first body paragraph

**MCP server** · Partly — A hosted MCP server exposes five Harvey tools to Claude, Gemini and Copilot, but the docs say a user must be enrolled in the feature first.

> The Harvey MCP Server exposes some of Harvey's core features — legal Q&A, Vault document analysis, and research knowledge sources as MCP tools.
> — https://developers.harvey.ai/guides/harvey_mcp.md · Harvey MCP guide, 'What is the Harvey MCP Server?'

## Buying it for a team

**A company can buy it** · Yes — The unit of sale is an organisation workspace with admin settings, named customer success contacts and firm-wide deployments.

> Rate limits are applied per organization and are reset every minute.
> — https://developers.harvey.ai/api-reference/ratelimits.md · Rate Limits page, opening paragraph

**Admin controls** · Yes — Admins constrain the agent and its users through role-based access, model availability, IP allow-listing, retention rules and synced ethical walls.

> Harvey enforces strict role-based access controls and logical workspace separation to ensure that only authorized users can access specific customer data.
> — https://www.harvey.ai/security · Security page FAQ, 'How do you respect access controls for client data?'

**Audit log** · Yes — Audit logs are both an enterprise control and a documented API, queryable and paginable for workspace activity monitoring.

> Audit Logs: Query and retrieve audit logs for workspace activity monitoring
> — https://developers.harvey.ai/llms.txt · Documentation index, Guides list entry for Audit Logs

**Single sign-on** · Yes — SAML SSO is named as a default enterprise control alongside audit logs and IP allow-listing; OIDC is not mentioned.

> delivering 24/7 monitoring alongside enterprise-grade controls, including SAML SSO, audit logs, IP allow-listing, and data lifecycle management
> — https://www.harvey.ai/security · Security page, 'Purpose-Built Security' card

## What happens to your code

**Opt out of training** · Yes — No training on customer data is the contractual default rather than a setting, and the vendor requires zero data retention from model providers.

> We don’t use inputs, outputs, or uploaded documents to train underlying models.
> — https://www.harvey.ai/security · Security page, 'No Model Training' card

**Data residency** · Yes — Processing can be kept in-region in the EU or Switzerland, the US or Australia, and the regional API endpoints match those deployments.

> set retention policies, delete data anytime, and keep everything in-region—EU or Switzerland, US, or Australia
> — https://www.harvey.ai/security · Security page, 'Data Sovereignty and Control' card

**Getting out** · Partly — Customers set retention and can delete data at any time, and usage and query history are exportable by API, but no document bulk-export or credit-expiry terms are published.

> Customers can determine what data to upload to Harvey, how long it is retained, and whether that data can be shared with others within the company.
> — https://www.harvey.ai/security · Security page FAQ, 'How do you respect access controls for client data?'

**Certifications** · Yes — Annually audited SOC 2 Type II and ISO 27001, with ISO 27701 and 42001, GDPR and CCPA also claimed and third-party penetration testing.

> Harvey undergoes annual SOC 2 Type II and ISO 27001 audits to validate these controls.
> — https://www.harvey.ai/security · Security page FAQ, 'How does Harvey keep my data private and secure?'

## What changed

- 2026-10-18 — Capabilities · Free tier · Price · Terms

## Keeping it current

These facts are re-checked against Harvey's own pages and updated when they change. If you represent Harvey, sign in and update the listing from your dashboard at https://theagentsindex.com/dashboard. The operations this site accepts from an agent are listed at https://theagentsindex.com/.well-known/agents.json — that catalog needs no key to read, and each entry states its own auth.