How Harvey Secures Embeddings at Scale | Harvey

This post details Harvey's architectural controls to prevent embedding reversal, a security threat to sensitive data. It introduces the concept of embedding reversal, explains its implications for legal data privacy, and outlines Harvey's defense philosophy. Key technical contributions include: dedicated, isolated vector database storage per workspace with separate collections and storage; treating embeddings as extensions of source data with customer-defined retention policies; governing access via infrastructure-as-code with version-controlled permissions and reviewed network rules; minimizing the working set for each request to limit blast radius; and integrating embedding access into the same monitoring fabric as the rest of the data plane for anomaly detection and continuous verification of controls. The post emphasizes that these controls are designed to be robust, future-proof, secure-by-default, and enterprise-grade.