条例
Harvey 宣布 FedRAMP D级联邦法律工作认证
在 Google 上的首选来源中添加 Unite.AI
2026年10月28日，Harvey 宣布表示其合法的AI平台现已获得FedRAMP Class D认证。 认证的称公司允许美国联邦机构、联邦承包商和合作伙伴、国际政府和商业实体在法律工作中使用要求最高安全标准的Harvey。 Harvey 在 Knox Systems 的 FedRAMP 中运行 D级认证云环境。
联邦法律小组处理往往涉及敏感信息的咨询、诉讼和执法工作。 Harvey 称这些机构以及与其合作的公司现在可以利用采购和订约、初步文件审查和跨机构合作的平台。 称公司的这一变动旨在减少律师在日常工作上花费的时间，以利于法律分析和建议。
Harvey首席执行官Winston Weinberg 称在公告中表示，“他们现在可以使用《阿姆法》第100条和《财富法》第10条中的5条所使用同样的法律AI。 我们自豪地把我们的技术带给更多的从事公共服务的律师。”
Harvey的公共部门负责人Pat Manion，称，在经过认证的环境中，代理律师可以通过复杂的案件记录工作，提出诉讼论点，解释条例，审查合同和采购文件。 他补充说，该公司通过联邦RAMP认证平台支持联邦政府法律团队及其合作伙伴。
FedRAMP 市场记录
被确定为ID包FR2528033654的诺克斯系统FedRAMP高管理平台的FedRAMP Marketplace上市，将Harvey AI列入其认证服务部分。 2026年3月30日将诺克斯平台显示列为FedRAMP认证，并将其置于持续认证阶段，市场将其定义为稳态持续监测和报告。 它记录了两项授权，即市场定义的 " 运营当局和使用信件管理局 " 总数，包括初始授权和再利用授权。 该平台的认证简介列为Rev5类型，D类(高级)路径机构，A类至D类反映报价文件和持续报告要求。
上市服务说明是由供应商提交的，联邦RAMP不审查或认可供应商提交内容的指出市场。 根据这一描述，应用程序供应商在诺克斯的联邦RAMP中部署高度授权边界并继承了所需安保控制的大部分，而不是寻求独立的联邦RAMP授权。 Knox的合规团队及其NoxAI平台通过准备、评估和上线来指导每个供应商，NoxAI根据NIST 800-53框架和其他框架来评价供应商的安全态势和控制执行情况，然后生产FedRAMP所需的文物。
每个应用程序都在诺克斯边界内自己的专用单租户账户中运行，没有共享计算、数据平面，也没有客户之间的存储，而是单独评估，在市场上列出，从第一天起接受持续监测。 说明中说，所有工作量完全在AWS、Azure或Google云平台的美国地区运行，在过境和休息时使用FIPS验证加密，在完全审计记录的情况下使用零信任访问，以及24/7安全业务中心和网络业务中心覆盖。
Knox管理持续监测，每月向授权机构报告，跟踪行动计划和里程碑，每年独立进行第三方评估和渗透测试，并根据说明与每个客户进行应急和事件反应演习。 共享责任矩阵记录了 Knox 应用程序供应商和代理商各自拥有的
该市场将Harvey(政府)描述为一种服务，通过法律问题、审查机构文件、起草和修订备忘录、简报和信函、多步骤的法律工作流程、在共享工作空间中合作以及引用其来源的答复，使联邦机构的律师和法律专业人员能够开展工作。 该列表将平台的服务模式确定为SaaS，其部署模式确定为政府社区云。
现有安全和合规态势
Harvey 称 FedRAMP Class D认证基于现有的安全和合规态势，包括SOC 2 Type II,ISO 27001,ISO 27701,ISO 42001,AIUC-1,IRAP,TX-RAMP级别2,GDPR，和CCPA，客户可以通过公司信托中心审查其认证。
Harvey在其安全网页上表示，它通过平台协议以合同方式保证客户投入，产出，以及上传的文件不被用于培训基本模型，它要求模型提供者保留零数据。 称公司在休息和过境时加密所有数据，从逻辑上将每个客户的数据分开以防止混合，适用最不优惠的访问控制，并将其合同安全义务转给子处理器和外部模型提供者。 Harvey在Microsoft Azure托管其云环境，并在欧盟和瑞士或澳大利亚为客户提供处理，需要数据本地化。
Harvey的内部安全小组负责24/7监测基础设施、产品和操作，其控制包括SAML单一签注、审计日志、IP许可列表和数据生命周期管理。 Harvey 称每年进行SOC 2型II和ISO 27001审计，每年进行第三方渗透测试，自动脆弱性扫描，并持续进行安全监测，它与Schellman,NCC集团和Bishop Fox合作进行深入审计。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Regulation
Harvey Announces FedRAMP Class D Certification for Federal Legal Work
Add Unite.AI to your preferred sources on Google
Harvey announced on October 28, 2026 that its legal AI platform is now FedRAMP Class D certified. The company said the certification allows U.S. federal agencies, federal contractors and partners, international governments, and commercial entities requiring the highest security standards to use Harvey for their legal work. Harvey operates within Knox Systems’ FedRAMP Class D certified cloud environment.
Federal legal teams handle advisory, litigation, and enforcement work that often involves sensitive information. Harvey said those agencies, and the companies that partner with them, can now use the platform for procurement and contracting, initial document reviews, and cross-agency collaboration. The company said the change is intended to reduce the time attorneys spend on routine tasks in favor of legal analysis and advice.
“Federal legal teams help deliver critical services that benefit all of us,” Harvey CEO Winston Weinberg said in the announcement. “They can now access the same legal AI used by 80% of the Am Law 100 and five of the Fortune 10. We are proud to bring our technology to more attorneys working in public service.”
Harvey’s Head of Public Sector, Pat Manion, said that within the certified environment, agency attorneys can work through complex case records, develop litigation arguments, interpret regulations, and review contracts and procurement documents. He added that the company supports federal government legal teams and their partners through the FedRAMP-certified platform.
FedRAMP Marketplace Record
The FedRAMP Marketplace listing for the Knox Systems FedRAMP High Managed Platform, identified as Package ID FR2528033654, includes Harvey AI in its certified services section. The listing shows the Knox platform as FedRAMP Certified as of March 30, 2026, and places it in the Ongoing Certification phase, which the marketplace defines as steady-state continuous monitoring and reporting. It records two authorizations, a figure the marketplace defines as the total of Authority to Operate and Authority to Use letters, including initial and reuse authorizations. The platform’s certification profile is listed as Type Rev5, Path Agency, Class D (High), with classes A through D reflecting an offering’s documentation and ongoing reporting requirements.
The listing’s service description is vendor-submitted, and the marketplace notes that FedRAMP does not review or endorse vendor-submitted content. According to that description, application providers deploy into Knox’s FedRAMP High authorized boundary and inherit a substantial share of the required security controls rather than pursuing a standalone FedRAMP authorization. Knox’s compliance team and its KnoxAI platform guide each provider through readiness, assessment, and go-live, and KnoxAI evaluates a provider’s security posture and control implementation against the NIST 800-53 framework and additional frameworks, then produces the artifacts FedRAMP requires.
Each application runs in its own dedicated single-tenant account within the Knox boundary, with no shared compute, data plane, or storage between customers, and is individually assessed, listed on the marketplace, and covered by continuous monitoring from day one. The description states that all workloads run exclusively in US regions of AWS, Azure, or Google Cloud Platform, with FIPS-validated encryption in transit and at rest, zero-trust access with full audit logging, and 24/7 Security Operations Center and Network Operations Center coverage.
Knox manages continuous monitoring with monthly reporting to authorizing agencies, tracking of plans of action and milestones, annual independent third-party assessments and penetration testing, and contingency and incident response exercises with every customer, according to the description. A Shared Responsibility Matrix documents what Knox, the application provider, and the agency each own.
The marketplace describes Harvey for Government as a service that lets attorneys and legal professionals at federal agencies work through legal questions, review agency documents, draft and revise memos, briefs, and correspondence, run multi-step legal workflows, and collaborate in shared workspaces, with responses that cite their sources. The listing identifies the platform’s service model as SaaS and its deployment model as Government Community Cloud.
Existing Security and Compliance Posture
Harvey said the FedRAMP Class D certification builds on an existing security and compliance posture that includes SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, AIUC-1, IRAP, TX-RAMP Level 2, GDPR, and CCPA, and that customers can review its certifications through the company’s trust center.
On its security page, Harvey states that it contractually guarantees through its Platform Agreement that customer inputs, outputs, and uploaded documents are not used to train underlying models, and that it requires Zero Data Retention by model providers. The company said it encrypts all data at rest and in transit, logically separates each customer’s data to prevent commingling, applies least-privilege access controls, and passes its contractual security obligations on to subprocessors and external model providers. Harvey hosts its cloud environment in Microsoft Azure and offers processing in the EU and Switzerland or Australia for customers with data-localization requirements.
The security page also states that Harvey’s in-house security team spans infrastructure, product, and operations with 24/7 monitoring, and that its controls include SAML single sign-on, audit logs, IP allow-listing, and data lifecycle management. Harvey said it undergoes annual SOC 2 Type II and ISO 27001 audits, annual third-party penetration tests, automated vulnerability scans, and continuous security monitoring, and that it works with Schellman, NCC Group, and Bishop Fox for in-depth audits.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.