Harvey Announces FedRAMP Class D Certification for Federal Legal Work

Harvey announced on October 28, 2026 that its legal AI platform is now FedRAMP Class D certified. The company said the certification allows U.S. federal agencies, federal contractors and partners, international governments, and commercial entities requiring the highest security standards to use Harvey for their legal work. Harvey operates within Knox Systems’ FedRAMP Class D certified cloud environment.

Federal legal teams handle advisory, litigation, and enforcement work that often involves sensitive information. Harvey said those agencies, and the companies that partner with them, can now use the platform for procurement and contracting, initial document reviews, and cross-agency collaboration. The company said the change is intended to reduce the time attorneys spend on routine tasks in favor of legal analysis and advice.

“Federal legal teams help deliver critical services that benefit all of us,” Harvey CEO Winston Weinberg said in the announcement. “They can now access the same legal AI used by 80% of the Am Law 100 and five of the Fortune 10. We are proud to bring our technology to more attorneys working in public service.”

Harvey’s Head of Public Sector, Pat Manion, said that within the certified environment, agency attorneys can work through complex case records, develop litigation arguments, interpret regulations, and review contracts and procurement documents. He added that the company supports federal government legal teams and their partners through the FedRAMP-certified platform.

FedRAMP Marketplace Record

The FedRAMP Marketplace listing for the Knox Systems FedRAMP High Managed Platform, identified as Package ID FR2528033654, includes Harvey AI in its certified services section. The listing shows the Knox platform as FedRAMP Certified as of March 30, 2026, and places it in the Ongoing Certification phase, which the marketplace defines as steady-state continuous monitoring and reporting. It records two authorizations, a figure the marketplace defines as the total of Authority to Operate and Authority to Use letters, including initial and reuse authorizations. The platform’s certification profile is listed as Type Rev5, Path Agency, Class D (High), with classes A through D reflecting an offering’s documentation and ongoing reporting requirements.

The listing’s service description is vendor-submitted, and the marketplace notes that FedRAMP does not review or endorse vendor-submitted content. According to that description, application providers deploy into Knox’s FedRAMP High authorized boundary and inherit a substantial share of the required security controls rather than pursuing a standalone FedRAMP authorization. Knox’s compliance team and its KnoxAI platform guide each provider through readiness, assessment, and go-live, and KnoxAI evaluates a provider’s security posture and control implementation against the NIST 800-53 framework and additional frameworks, then produces the artifacts FedRAMP requires.

Each application runs in its own dedicated single-tenant account within the Knox boundary, with no shared compute, data plane, or storage between customers, and is individually assessed, listed on the marketplace, and covered by continuous monitoring from day one. The description states that all workloads run exclusively in US regions of AWS, Azure, or Google Cloud Platform, with FIPS-validated encryption in transit and at rest, zero-trust access with full audit logging, and 24/7 Security Operations Center and Network Operations Center coverage.

Knox manages continuous monitoring with monthly reporting to authorizing agencies, tracking of plans of action and milestones, annual independent third-party assessments and penetration testing, and contingency and incident response exercises with every customer, according to the description. A Shared Responsibility Matrix documents what Knox, the application provider, and the agency each own.

The marketplace describes Harvey for Government as a service that lets attorneys and legal professionals at federal agencies work through legal questions, review agency documents, draft and revise memos, briefs, and correspondence, run multi-step legal workflows, and collaborate in shared workspaces, with responses that cite their sources. The listing identifies the platform’s service model as SaaS and its deployment model as Government Community Cloud.

Existing Security and Compliance Posture

Harvey said the FedRAMP Class D certification builds on an existing security and compliance posture that includes SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, AIUC-1, IRAP, TX-RAMP Level 2, GDPR, and CCPA, and that customers can review its certifications through the company’s trust center.

On its security page, Harvey states that it contractually guarantees through its Platform Agreement that customer inputs, outputs, and uploaded documents are not used to train underlying models, and that it requires Zero Data Retention by model providers. The company said it encrypts all data at rest and in transit, logically separates each customer’s data to prevent commingling, applies least-privilege access controls, and passes its contractual security obligations on to subprocessors and external model providers. Harvey hosts its cloud environment in Microsoft Azure and offers processing in the EU and Switzerland or Australia for customers with data-localization requirements.

The security page also states that Harvey’s in-house security team spans infrastructure, product, and operations with 24/7 monitoring, and that its controls include SAML single sign-on, audit logs, IP allow-listing, and data lifecycle management. Harvey said it undergoes annual SOC 2 Type II and ISO 27001 audits, annual third-party penetration tests, automated vulnerability scans, and continuous security monitoring, and that it works with Schellman, NCC Group, and Bishop Fox for in-depth audits.