Harvey for Outlook: Security and Data Privacy

Add-In: A web-based extension built with HTML, CSS, and JavaScript. It uses Harvey’s secure platform infrastructure, ensuring strong security protocols and cross-platform compatibility.

Plug-In: Developed with COM technology (for example, C# or VB.NET), installed locally. Plug-ins offer deeper system integration, but are limited to desktop use, more complex to deploy, and introduce higher security risks due to their reliance on local system resources.

Harvey for Outlook only has access to the currently open email thread. It does not scan your entire inbox or any other part of Outlook. Harvey does not automatically read your emails; it only has context of the current thread when you hit “Ask”.

• When asking questions: Harvey uses the context of the open thread and its attachments.
• When saving to Vault: Harvey will save the current email thread and its attachments to Vault.

Once the thread is closed or Harvey for Outlook is exited, access to that email ends.

Harvey for Outlook utilizes the same infrastructure as Harvey’s web application. Download the latest Architecture Diagram from our Trust Center.

Not at this time, though we are exploring this capability to offer more control.

Yes. Harvey for Outlook maintains the same encryption standards as the Harvey web application:

• Data in transit: Secured using HTTPS and TLS 1.2 or higher to ensure protection during transmission.
• Data at rest: Encrypted with AES-256 or higher, providing strong security for stored data.

Authentication is the same as your Harvey workspace:

• Users log in with their Harvey credentials, including single sign-on (SSO) via SAML (if enabled).
• Access also requires Add-In permissions granted by Harvey, even after downloading it. Admins should work with their Harvey Customer Success Manager to designate which team members should have access.

Coming soon in 2025, Harvey will allow Admins to manage Add-In permissions directly through the Harvey web application, without Success team coordination.

All activity is visible to Harvey administrators in the Workspace History and Usage dashboards.

In addition, activity streams to the History and Audit Log API endpoints, enabling programmatic tracking and integration with your internal systems. Review the Developer Docs for details.

If you need an API key for monitoring purposes, please reach out to your Harvey Success team.

Yes. Harvey’s ISO 27001 and SOC 2 Type II certifications extend Harvey for Outlook. Data processed in the Add-In uses the same independently audited infrastructure. You can access these certifications and other compliance documentation at any time in our Trust Center.

Microsoft also applies strict validation to all Office Add-Ins. For more details, you can review Microsoft’s Certification Policies & Publishing Requirements.