TechPrufer
Get started
Harvey
Harvey logoHarvey · Feature trail

Security by Design Program

1 post · May 2025 – Apr 2026

What this trail covers

Harvey's security posture continues to evolve, emphasizing a 'Provably Secure' internal mantra. This involves deep engineering into access control, encryption, and data lifecycle management. Key advancements include zero data access principles enforced through RBAC and network segmentation, Infrastructure as Code (IaC) for reproducible and auditable environments, and robust encryption (AES-256) for data in transit and at rest. The platform supports Bring Your Own Key (BYOK) for enhanced customer control and has implemented hardware tokens for FIDO2-based MFA to protect against phishing. The security team represents 10-20% of the engineering organization and focuses on proactive, offensive-minded defense, going beyond compliance to address AI-specific risks like prompt injection and sensitive information disclosure by ensuring customer data is used only at inference time and not for model training.

All Harvey trails
  1. How Harvey Secures Embeddings at Scale | HarveyThis post details Harvey's architectural controls to defend against embedding reversal attacks. Key contributions include: 1. **Database-level isolation:** Partitioning vector storage so each workspace has a dedicated, isolated footprint with separate collections and storage, preventing cross-tenant bleed-through. 2. **Treating embeddings as source data extensions:** Generating vectors solely for retrieval and search within a workspace, adhering to the same retention policies as source documents. 3. **Disciplined access control:** Governing access to embeddings via infrastructure-as-code, version-controlled permissions, network rules, and service identities, with encryption under the same controls as source documents and programmatic refresh of short-lived credentials. 4. **Minimizing working set:** Retrieving only the most relevant vectors for a workspace into a narrow context window scoped to the interaction, with tenant-bound and encrypted performance caches. 5. **Integrated monitoring:** Logging, correlating, and anomaly detection for embedding access, verifying control effectiveness.
  2. Your Data, Your Control: How Harvey Manages Customer DataThis post details Harvey's engineering approach to customer data security, focusing on 'Provably Secure' principles. It outlines zero data access through RBAC and network segmentation, Infrastructure as Code (IaC) for environment management, and comprehensive encryption (in transit and at rest, AES-256) with BYOK support. It also describes the ephemeral nature of data context during processing and the strict lifecycle for uploaded documents, including secure destruction. Continuous monitoring of access logs and system activity is highlighted as a validation mechanism for security controls.
  3. Security by Design: How Harvey Engineered Trust from Day OneThis post details Harvey's 'Security by Design' program, emphasizing proactive, layered security and trust from day one. Key technical contributions include the implementation of hardware tokens for FIDO2-based MFA to prevent phishing, a focus on zero data access principles enforced through RBAC and network segmentation, the use of Infrastructure as Code (IaC) for reproducible environments, and robust encryption (AES-256) for data in transit and at rest. It also highlights the company's approach to AI-specific risks, such as prompt injection and sensitive information disclosure, by using customer data only at inference time and not for model training. The post also mentions a scalable platform for real-time security data analytics ingesting over 2 billion signals daily and a 24/7 incident response capability with a 48-hour customer notification SLA for security incidents.