Harvey for Word Add-In: Security and Data Privacy

Overview

The Harvey for Word add-in allows users to modify Word documents by editing existing text or adding new content. Suggestions can be generated through user prompts or by analyzing uploaded precedents to identify relevant clauses.

The add-in follows the same stringent security and data privacy standards as the Harvey web application, including ISO 27001 certification and SOC 2 Type II compliance. For full details, visit our Trust Center.

Frequently Asked Questions

Q: What is the difference between the Harvey for Word add-In and a plug-in?

A Word add-in like Harvey’s is a web-based extension built with HTML, CSS, and JavaScript. It leverages Harvey’s secure platform infrastructure for processing, enabling robust security protocols and compatibility across platforms.

A Word plug-in, by contrast, is developed with COM technology (e.g., C# or VB.NET), it is installed locally, offering deeper integration options. However, Plug-Ins are limited to desktop use, more complex to deploy, and carry higher security risks due to their reliance on local system resources.

Q: What documents or system files does the Harvey for Word add-in have access to?

The Harvey for Word add-in only accesses the content in the document the user currently has open. It cannot access other documents on the user's device, or other files owned by their company or colleagues within Microsoft 365.

• When generating suggested prompts: Upon opening the Harvey for Word add-in, Harvey analyzes the full document content to generate relevant, context-aware suggestions. This analysis occurs only when the add-in is first opened, and the resulting prompts are cached locally for the duration of the session. The document analysis uses the same secure infrastructure and encryption standards as all other Harvey features. Document content is processed in accordance with Harvey's data retention policies.

  • Note on user control: The Word add-in does not open automatically on any document. The user must explicitly open the Word add-in on a document, so they can retain full control over which documents they want to use the Word add-in on.
• When making revisions: The add-in processes only the text explicitly highlighted by the user and any content uploaded as precedent.
• When drafting new content: Harvey looks at 50 characters before and after the cursor, to provide context for formatting and language, though we're limited to examining the current paragraph only. This may change in the future.
• When using Playbooks functionality: The entire active document is processed so Harvey can apply your custom Playbook ruleset across each section.

Access to the document ends when the document is closed or the add-in is exited. Users must activate the Word add-in separately for each document they wish to use Harvey with.

Q: How does the Harvey for Word add-in process data?

The Harvey for Word add-in utilizes the same infrastructure as Harvey’s web application. Download the latest Architecture Diagram from our Trust Center.

Q: Is data accessed by the Harvey for Word Add-In encrypted?

The Harvey for Word add-in applies the same encryption standards as the Harvey web application.

• Data in Transit: Secured using HTTPS and TLS 1.2 or higher to ensure protection during transmission.
• Data at Rest: Encrypted with AES-256 or higher, providing strong security for stored data.

Q: How are users authenticated when opening the Harvey for Word add-in?

The Harvey for Word add-in uses the same authentication method configured for your Harvey workspace. Users log in with their Harvey credentials, including single sign-on (SSO) via SAML if enabled for your workspace.

To access the add-in, users must also have specific permissions granted by Harvey, even after downloading it. Harvey administrators should work with their account team to designate which team members should have access. In 2025, Harvey will allow administrators to manage add-in permissions directly through the Harvey web application, eliminating the need for external coordination.

Q: Are Harvey's edits, redlines, and comments attributed to Harvey in the document?

No. Tracked changes, redlines, and comments created through the Harvey Word Add-In are not labeled "Harvey" or "AI-generated." They appear under the name of the signed-in Word/Microsoft user, exactly as they would if the user had made the edits manually. Anyone reviewing the document's content or comment threads sees the Harvey user as the author, with no visible indication that Harvey was involved.

The author name shown is your Word/Microsoft display name. If you'd like edits attributed differently — for example, to your firm name — you can change this in Word's own settings (not in Harvey).

Q: Can a recipient tell that Harvey was used to create or edit a document?

Not from the visible document. Edits, redlines, and comments are attributed to the signed-in user, and nothing in the document body or comments identifies Harvey.

However, Harvey does write a small amount of metadata to the file:

• A custom document property with a hydoc prefix, which links the document to Harvey's backend and does not contain the word "Harvey." The property can be viewed in Word via File → Properties → Custom.
• A reference to the add-in's Microsoft ID (WA200007271) in the file's underlying XML (word/webextensions/webextension1.xml). This also does not name Harvey explicitly. This reference can only be seen by examining the file's raw XML.

If you want to remove this metadata before sending a document outside your organization, you have several options:

• Document Inspector (Windows only): Use Word's built-in Document Inspector to remove custom document properties and web extension data.
• Manual removal: Delete the custom property directly via File → Properties → Custom.

Administrator Visibility and Audit Logging

All activity within the Harvey Word Add-In is visible to your organization’s Harvey administrators through the Workspace History and Usage dashboards.

Additionally, this activity can be viewed with in the Audit log page in Command Center (Command Center → Reporting → Audit logs).

You can access detailed API documentation here. If you don’t currently have an API key and would like one for monitoring purposes, please reach out to your Harvey account team.

Q: Do Harvey’s existing compliance certifications apply to the Harvey for Word add-in?

Yes, Harvey’s ISO 27001 and SOC 2 Type II compliance certifications extend to the Word add-in. The same infrastructure independently audited to achieve these certifications is used for processing data within the add-in. You can access these certifications and other compliance documentation at any time in our Trust Center.

In addition, Microsoft applies rigorous validation processes to all Office add-ins, ensuring adherence to strict security and quality standards. For more details, you can review Microsoft’s Certification Policies & Publishing Requirements.

Q: Is my voice data stored when I use the prompt dictation feature?

No. Audio is processed to generate a transcript and then deleted immediately. Only the resulting text is retained.

Deployment Options

Please consult your Harvey account team to determine the best deployment method for your organization. We support the following options:

1. Microsoft 365 Admin Center (Preferred): Centrally deploy the Word Add-In to specific users, groups, or the entire organization.
2. Approved Add-In Catalogs: Curate a private catalog for employees to browse and install approved add-ins.
3. Software Distribution Systems (e.g., SCCM, Intune): Automate deployment using tools like SCCM or Intune. Harvey can provide deployment packages or scripts to assist.
4. Self-Installation: Users can download the Word Add-In directly from the Microsoft App Store.
5. Sideloading: Distribute the manifest file for manual installation in Word.