Harvey is the fastest-growing AI legal platform, backed by $300M+ in funding and used by Am Law 100 firms and major in-house teams. Its Platform Agreement, DPA, and AI Policy have expanded 4.5x since 2023 — growing from 5KB to 23KB+ — reflecting Harvey's maturation from startup to enterprise vendor. DriftPatrol tracks harvey.ai/legal/platform-agreement and its companion documents across 65+ documented change events.
| Section | What it says | Why it matters |
|---|---|---|
| §11.8 | AI Training Prohibition — extends to ALL sub-processors | Harvey will not train AI on your content. This prohibition flows down to every sub-processor — not just Harvey itself. Strongest no-train clause among all five major legal tech platforms reviewed. Zero carve-outs for "de-identified aggregation" unlike Clio. Best in class |
| §7.4 | Data Deletion — within 30 days of termination | 30-day deletion window post-termination. Shorter than Clio's 90-day retrieval window — plan your data export before you cancel, not after. Request a deletion confirmation certificate for regulatory compliance. Note |
| §11.14 | Mandatory Arbitration — JAMS (US) / ICC (EU) · No court path | Mandatory arbitration in San Francisco (US) or London (EU). Three-arbitrator panel for disputes over $250K. No path to court for US customers. JAMS fees for three-arbitrator panels can run $50K–$200K+ — a material deterrent for mid-market firm disputes. Risk |
| §11.2 | Sub-processor notice — 30 days advance, 15-day objection window | Harvey must give 30 days' advance notice before adding a sub-processor. You have 15 days to object. Short window — if your team isn't monitoring, you'll miss it. DriftPatrol flags sub-processor notices the day they're published. Monitor |
| §10.2–3 | Liability — 12mo fees or $250K floor; data breach doubles to 24mo / $500K | Meaningful liability floor: greater of 12 months of fees or $250,000 for standard claims. Data breach carve-out doubles both figures. Significantly stronger than Clio (6 months, no floor) and Fastcase (effectively zero). Strong |
| §11.13 | Governing Law — California (US) · England and Wales (EU/UK) | US customers governed by California law; EU/UK customers by English law. Clean split — no ambiguity about jurisdiction. California's CCPA adds an extra layer of consumer protection for client data processed in California. Note |
| §11.6 | Confidentiality — reasonable care, same as own sensitive information | Standard reasonable care obligation. Not a "highest degree of care" clause — monitor for any future weakening to "industry standard" language, which courts have interpreted broadly in vendors' favor. Note |
Get a plain-English Monday brief the day any of these clauses change. Audit trail to the second.
See plans →Tracked URLs: harvey.ai/legal/platform-agreement · …/data-processing-addendum · …/ai-policy · Informational only — not legal advice.
