Skip to main content
Harvey logo

Harvey

GDPR evidence

Legal AI tailored for leading law firms and corporate legal teams

harvey.aiLegal techLast verified 2 Nov 2026
Request the report Are you Harvey?
GDPR mark, CertReports state Vendor-stated as of 2 Nov 2026Vendor-stated

Harvey and GDPR

Harvey states it holds a data processing agreement. CertReports captured this on 2 Nov 2026 from its trust centre (Drata); it is a vendor statement, not an independent confirmation.

Evidence

Vendor-statedVendor states GDPR on its trust centre
as of 2 Nov 2026 · confidence 80%
SourceCapturedQuoteLinks
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
1 Nov 2026GDPR
Live page Snapshotsha256 de20ba0619
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
31 Oct 2026GDPR
Live page Snapshotsha256 aa036d0507
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
29 Oct 2026GDPR
Live page Snapshotsha256 2bd4697d16
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
27 Oct 2026GDPR
Live page Snapshotsha256 98f2767667
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
25 Oct 2026GDPR
Live page Snapshotsha256 cb46888cfc
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
23 Oct 2026GDPR
Live page Snapshotsha256 4758b4ab16
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
21 Oct 2026GDPR
Live page Snapshotsha256 bff92eb6ad
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
19 Oct 2026GDPR
Live page Snapshotsha256 e3e7e44701
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
17 Oct 2026GDPR
Live page Snapshotsha256 16e8d90807
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
15 Oct 2026GDPR
Live page Snapshotsha256 f943cb2a27
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
13 Oct 2026GDPR
Live page Snapshotsha256 9ee4b9073e
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
11 Oct 2026GDPR
Live page Snapshotsha256 d1c84994f7
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
9 Oct 2026GDPR
Live page Snapshotsha256 43067d6414
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
7 Oct 2026GDPR
Live page Snapshotsha256 b0e3c6dd8a
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
5 Oct 2026GDPR
Live page Snapshotsha256 d6065810c0
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
3 Oct 2026GDPR
Live page Snapshotsha256 b51fd54070
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
1 Oct 2026GDPR
Live page Snapshotsha256 f4330de665
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
29 Sep 2026GDPR
Live page Snapshotsha256 b2ba3c61a3
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
27 Sep 2026GDPR
Live page Snapshotsha256 65324502f0
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
25 Sep 2026GDPR
Live page Snapshotsha256 d61b1b1c81
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
21 Sep 2026GDPR
Live page Snapshotsha256 1e26f58378
Harvey AI trust centre (Drata)
Vendor trust centre · HTTP 200
18 Sep 2026GDPR
Live page Snapshotsha256 1bfbf458d9
This is wrong
Vendor-statedVendor states ISO/IEC 27701 on its trust centre
as of 2 Nov 2026 · confidence 80%
SourceCapturedQuoteLinks
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
1 Nov 2026ISO/IEC 27701
Live page Snapshotsha256 de20ba0619
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
31 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 aa036d0507
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
29 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 2bd4697d16
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
27 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 98f2767667
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
25 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 cb46888cfc
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
23 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 4758b4ab16
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
21 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 bff92eb6ad
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
19 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 e3e7e44701
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
17 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 16e8d90807
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
15 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 f943cb2a27
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
13 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 9ee4b9073e
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
11 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 d1c84994f7
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
9 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 43067d6414
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
7 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 b0e3c6dd8a
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
5 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 d6065810c0
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
3 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 b51fd54070
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
1 Oct 2026ISO/IEC 27701
Live page Snapshotsha256 f4330de665
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
29 Sep 2026ISO/IEC 27701
Live page Snapshotsha256 b2ba3c61a3
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
27 Sep 2026ISO/IEC 27701
Live page Snapshotsha256 65324502f0
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
25 Sep 2026ISO/IEC 27701
Live page Snapshotsha256 d61b1b1c81
Harvey trust centre (Drata)
Vendor trust centre · HTTP 200
21 Sep 2026ISO/IEC 27701
Live page Snapshotsha256 1e26f58378
Harvey AI trust centre (Drata)
Vendor trust centre · HTTP 200
18 Sep 2026ISO/IEC 27701
Live page Snapshotsha256 1bfbf458d9
This is wrong
VerifiedActive: EU-US Certification, UK Extension Certification, SW-US Certification
as of 2 Nov 2026 · confidence 100%
Kind
Listing
Issued or listed
26 Jun 2024
Expires or valid through
8 Jun 2027
Scope
Harvey AI Corporation processes personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF in two capacities: As a data processor: Personal data processed in this capacity includes names, email addresses, job titles, and other information contained in documents and content submitted by authorized users of Harvey's service. As a data controller: Harvey processes the following categories of personal data: (1) Account and platform data of authorized users, including name, email address, professional information, account credentials, and usage and log data, to provide, maintain, and improve the Services; (2) HR and employment data of employees and contractors located in the EU and UK only, including name, work email, job title, department, employment dates, and compensation information, to administer employment relationships — this data is shared with affiliates, payroll administrators, and benefits providers; (3) Website visitor and marketing data, including name, email address, and marketing interaction data, collected with consent where required, to communicate about Harvey's services.
SourceCapturedQuoteLinks
Data Privacy Framework list
Official registry · HTTP 200
2 Nov 2026Harvey AI Corporation: Active: EU-US Certification, UK Extension Certification, SW-US Certification
Live pagesha256 56524c1630
This is wrong
What GDPR means, and what it does not

"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.

Read the GDPR guide and browse all vendors with evidence

Questions buyers ask

Is Harvey GDPR compliant?

There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.

How does CertReports verify this?

Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.

Change history

  1. 22 Sep 2026DPA changedThe data processing agreement URL changed.
  2. 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.

Alternatives with GDPR evidence

Similar vendors (shared product tags or the Legal tech category) whose GDPR row is verified or vendor-stated, ranked by similarity.

KLDiscovery Ontrack logo

KLDiscovery Ontrack

Legal tech

KLDiscovery delivers AI-driven eDiscovery software and services supporting litigation, investigations, and regulatory matters for legal

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedPCI DSS mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedCyber Essentials mark, CertReports state Vendor-stated
1 verified · 7 stated2 Nov 2026
Everlaw logo

Everlaw

Legal tech

Transform your approach to litigation and

SOC 2 mark, CertReports state VerifiedGDPR mark, CertReports state Vendor-statedFedRAMP mark, CertReports state VerifiedISO 27001 mark, CertReports state Vendor-statedSOC 3 mark, CertReports state VerifiedISO 27017 mark, CertReports state Vendor-stated
4 verified · 7 stated2 Nov 2026
Litera logo

Litera

Legal tech

More than 1 million daily users legal professionals and 99% of the Am Law 100 amplify their impact with Litera’s legal technology

SOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedISO 42001 mark, CertReports state Vendor-statedSOC 3 mark, CertReports state Vendor-statedDPF mark, CertReports state Verified
1 verified · 5 stated2 Nov 2026
Luminance logo

Luminance

Legal tech

End-to-End AI for Every Contract

SOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedDPF mark, CertReports state Verified
1 verified · 3 stated2 Nov 2026
Edge logo

Edge

Legal tech

The ultimate IP assistant.

SOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedDPF mark, CertReports state Expired
2 stated2 Nov 2026
Ironclad logo

Ironclad

Legal tech

AI-powered contract management

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedFedRAMP mark, CertReports state VerifiedISO 27001 mark, CertReports state Vendor-statedCSA STAR mark, CertReports state Verified
3 verified · 9 stated2 Nov 2026
Envoy logo

Envoy

Legal tech

We provide full-scale international legal immigration services and a proprietary online platform related to managing all employment-based

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedCSA STAR mark, CertReports state VerifiedDPF mark, CertReports state Verified
2 verified · 5 stated2 Nov 2026

Understand GDPR evidence

All articles