条例
Harvey 宣布 FedRAmp D级联邦法律工作认证
在 Google 上的首选来源中添加 Unite.AI
2026年10月28日，Harvey 宣布表示其法定AI平台现已获得FedRAMP Class D认证。 认证的称公司允许美国联邦机构、联邦承包商和合作伙伴、国际政府和商业实体在法律工作中使用要求最高安全标准的Harvey。 Harvey在诺克斯系统的FedRAMP内运行 D级认证云环境。
联邦法律小组处理往往涉及敏感信息的咨询、诉讼和执法工作。 Harvey 称这些机构以及与这些机构合作的公司现在可以使用采购和订约平台、初步文件审查和跨机构合作。 称公司的这一变动旨在减少律师在日常工作上花费的时间，以利于法律分析和建议。
Harvey首席执行官Winston Weinberg 称在公告中表示，“他们现在可以使用《阿姆法》第100条和《财富法》第10条中的5条所使用的同样的法律AI。 我们自豪地把我们的技术带给更多的从事公共服务的律师。”
Harvey的公共部门负责人Pat Manion，称，在经认证的环境下，代理律师可以通过复杂的案件记录开展工作，制定诉讼论据，解释条例并审查合同和采购文件。 他补充说，该公司通过联邦RAMP认证平台支持联邦政府法律团队及其伙伴。
FedRAMP 市场记录
被确定为ID包FR2528033654的诺克斯系统FedRAMP高管理平台的FedRAMP Marketplace上市，将Harvey AI列入其认证的服务部分。 2026年3月30日将诺克平台显示列为FedRAMP认证，并将其置于持续认证阶段，市场将其定义为稳态持续监测和报告。 它记录了两项授权，市场定义为 " 运营当局 " 和 " 使用信件管理局 " 的总数，包括初始授权和再利用授权。 该平台的认证概况列为 " Rev5型 "、 " 路径机构 "、 " D级(高级) "、 " A至D级 "，反映了报价的文件和持续的报告要求。
上市的服务说明是供应商提交的，联邦RAMP不审查或认可供应商提交的内容的指出市场。 根据该描述，应用程序供应商在诺克斯的联邦RAMP中部署高度授权的边界，并继承了所需安全管制的一大部分，而不是追求独立的联邦RAMP授权。 Knox的合规团队及其NoxAI平台通过准备、评估和上线来指导每个供应商，NoxAI根据NIST 800-53框架和其他框架来评价供应商的安全态势和控制执行情况，然后生产FedRAMP所需的文物。
每个应用程序都在诺克边界内自己的专用单租户账户中运行，没有共享计算、数据平面，也没有客户之间的存储，而是单独评估，在市场上列出，并从第一天起接受持续监测。 说明中说，所有工作量都完全在AWS、Azure或Google Cloud平台的美国地区进行，在过境和休息时使用FIPS验证的加密，在完全审计记录的情况下使用零信任访问，以及24/7的安全业务中心和网络业务中心覆盖。
Knox管理持续监测，每月向授权机构报告，跟踪行动计划和里程碑，每年独立第三方评估和渗透测试，以及根据说明与每个客户进行应急和事件应对演习。 一个共同责任矩阵记录了 Knox，应用程序提供者，以及机构各自拥有的东西。
市场将Harvey为政府服务，允许联邦机构的律师和法律专业人员通过法律问题、审查机构文件、起草和修订备忘录、简报和信函开展工作，开展多步骤的法律工作流程，并在共享工作空间中开展合作，并引用其来源。 该列表将平台的服务模式确定为SaaS，其部署模式确定为政府社区云。
现有的安全和遵守态势
Harvey 称 FedRAMP Class D认证基于现有的安全和合规态势，其中包括SOC 2 Type II,ISO 27001,ISO 27701,ISO 42001,AIUC-1,IRAP,TX-RAMP 第2级，GDPR，和CCPA，客户可以通过公司信托中心审查其认证。
Harvey在其安全页面上称，它通过平台协议在合同上保证客户投入，产出，上传文件不用于培训基本模型，并要求模型提供者保留零数据。 称公司在休息和中转时加密所有数据，按逻辑将每个客户的数据分开以防止混合，适用最不优惠的接入控制，并将其合同安全义务传递给子处理器和外部模型提供者。 Harvey在Microsoft Azure中宿主了它的云层环境，并在欧盟和瑞士或澳大利亚提供客户的处理，有数据本地化要求。
Harvey的内部安全小组负责24/7监测基础设施、产品和操作，其控制包括SAML单一签注、审计记录、IP许可列表和数据生命周期管理。 Harvey 称每年进行SOC 2 二型和ISO 27001型审计，每年进行第三方渗透测试，自动脆弱性扫描，并持续进行安全监测，它与Schellman,NCC Group，和Bishop Fox合作进行深入审计。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Regulation
Harvey Announces FedRAMP Class D Certification for Federal Legal Work
Add Unite.AI to your preferred sources on Google
Harvey announced on October 28, 2026 that its legal AI platform is now FedRAMP Class D certified. The company said the certification allows U.S. federal agencies, federal contractors and partners, international governments, and commercial entities requiring the highest security standards to use Harvey for their legal work. Harvey operates within Knox Systems’ FedRAMP Class D certified cloud environment.
Federal legal teams handle advisory, litigation, and enforcement work that often involves sensitive information. Harvey said those agencies, and the companies that partner with them, can now use the platform for procurement and contracting, initial document reviews, and cross-agency collaboration. The company said the change is intended to reduce the time attorneys spend on routine tasks in favor of legal analysis and advice.
“Federal legal teams help deliver critical services that benefit all of us,” Harvey CEO Winston Weinberg said in the announcement. “They can now access the same legal AI used by 80% of the Am Law 100 and five of the Fortune 10. We are proud to bring our technology to more attorneys working in public service.”
Harvey’s Head of Public Sector, Pat Manion, said that within the certified environment, agency attorneys can work through complex case records, develop litigation arguments, interpret regulations, and review contracts and procurement documents. He added that the company supports federal government legal teams and their partners through the FedRAMP-certified platform.
FedRAMP Marketplace Record
The FedRAMP Marketplace listing for the Knox Systems FedRAMP High Managed Platform, identified as Package ID FR2528033654, includes Harvey AI in its certified services section. The listing shows the Knox platform as FedRAMP Certified as of March 30, 2026, and places it in the Ongoing Certification phase, which the marketplace defines as steady-state continuous monitoring and reporting. It records two authorizations, a figure the marketplace defines as the total of Authority to Operate and Authority to Use letters, including initial and reuse authorizations. The platform’s certification profile is listed as Type Rev5, Path Agency, Class D (High), with classes A through D reflecting an offering’s documentation and ongoing reporting requirements.
The listing’s service description is vendor-submitted, and the marketplace notes that FedRAMP does not review or endorse vendor-submitted content. According to that description, application providers deploy into Knox’s FedRAMP High authorized boundary and inherit a substantial share of the required security controls rather than pursuing a standalone FedRAMP authorization. Knox’s compliance team and its KnoxAI platform guide each provider through readiness, assessment, and go-live, and KnoxAI evaluates a provider’s security posture and control implementation against the NIST 800-53 framework and additional frameworks, then produces the artifacts FedRAMP requires.
Each application runs in its own dedicated single-tenant account within the Knox boundary, with no shared compute, data plane, or storage between customers, and is individually assessed, listed on the marketplace, and covered by continuous monitoring from day one. The description states that all workloads run exclusively in US regions of AWS, Azure, or Google Cloud Platform, with FIPS-validated encryption in transit and at rest, zero-trust access with full audit logging, and 24/7 Security Operations Center and Network Operations Center coverage.
Knox manages continuous monitoring with monthly reporting to authorizing agencies, tracking of plans of action and milestones, annual independent third-party assessments and penetration testing, and contingency and incident response exercises with every customer, according to the description. A Shared Responsibility Matrix documents what Knox, the application provider, and the agency each own.
The marketplace describes Harvey for Government as a service that lets attorneys and legal professionals at federal agencies work through legal questions, review agency documents, draft and revise memos, briefs, and correspondence, run multi-step legal workflows, and collaborate in shared workspaces, with responses that cite their sources. The listing identifies the platform’s service model as SaaS and its deployment model as Government Community Cloud.
Existing Security and Compliance Posture
Harvey said the FedRAMP Class D certification builds on an existing security and compliance posture that includes SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, AIUC-1, IRAP, TX-RAMP Level 2, GDPR, and CCPA, and that customers can review its certifications through the company’s trust center.
On its security page, Harvey states that it contractually guarantees through its Platform Agreement that customer inputs, outputs, and uploaded documents are not used to train underlying models, and that it requires Zero Data Retention by model providers. The company said it encrypts all data at rest and in transit, logically separates each customer’s data to prevent commingling, applies least-privilege access controls, and passes its contractual security obligations on to subprocessors and external model providers. Harvey hosts its cloud environment in Microsoft Azure and offers processing in the EU and Switzerland or Australia for customers with data-localization requirements.
The security page also states that Harvey’s in-house security team spans infrastructure, product, and operations with 24/7 monitoring, and that its controls include SAML single sign-on, audit logs, IP allow-listing, and data lifecycle management. Harvey said it undergoes annual SOC 2 Type II and ISO 27001 audits, annual third-party penetration tests, automated vulnerability scans, and continuous security monitoring, and that it works with Schellman, NCC Group, and Bishop Fox for in-depth audits.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.