Security by Design: How Harvey Engineered Trust from Day One

This post details Harvey's 'Security by Design' program, emphasizing proactive, layered security and trust from day one. Key technical contributions include the implementation of hardware tokens for FIDO2-based MFA to prevent phishing, a focus on zero data access principles enforced through RBAC and network segmentation, the use of Infrastructure as Code (IaC) for reproducible environments, and robust encryption (AES-256) for data in transit and at rest. It also highlights the company's approach to AI-specific risks, such as prompt injection and sensitive information disclosure, by using customer data only at inference time and not for model training. The post also mentions a scalable platform for real-time security data analytics ingesting over 2 billion signals daily and a 24/7 incident response capability with a 48-hour customer notification SLA for security incidents.