What Harvey does with your access.

Access by tier

Access rises with the tier, and never beyond what the tier needs:

• Free scan — source only. You give us read access to your repository (or a code archive). No database, no API keys, no production contact. We read the code; that's all.
• Connected audit — adds a read-only database connection. To verify live state (RLS behavior, Supabase advisors, PII protection) we connect to your database read-only. We run queries that read; we never write, alter schema, or change data. If you decline this access, the database-dependent checks are recorded as "not run — no access" in your coverage ledger and the rest of the audit still runs.
• Full audit — adds a local stand-up. The live pen-test needs a running app to attack, so Harvey provisions its own local copy of your stack from your code and migrations, seeds test data, and attacks that copy. Your production environment is never stood up, never attacked, and never contacted.

What we collect, and why

• Your source code — to run the audit. Held only for the duration of the engagement.
• Read-only database output (connected tier) — the results of the read-only checks, not a copy of your whole database. We pull what the specific checks need, not a bulk export.
• Your contact details and what you told us (email, repo, any context) when you request a scan — to run the scan and get the report back to you.

We do not use your code or data to train models, we do not sell it, and we do not share it with any third party outside the tightly-scoped service providers below.

Findings are built to avoid your raw data in the first place

Two of Harvey's checks touch the kind of data you'd most want handled carefully, and both are built to minimize what they retain:

• Data classification (PII/PHI/PCI). By default this check looks at column names, types, and table context — it never reads or stores actual cell values, and the finding it produces records only the column name and inferred category (e.g. "email — PII, high confidence"), never real customer data. A deeper mode that samples real values to classify free-text or generic columns exists as a design only — we have deliberately not built it until there is a clear consent model for sampling your data, so it cannot run against your engagement today.
• Credential/secret scanning. When a check finds something that looks like a live credential, the finding stores a redacted excerpt (a short prefix plus a length, e.g. sk_live_51Q…[redacted, 44 chars]) — enough to confirm and locate the match, never the usable secret itself.

Where it lives

Scan requests are delivered to us by email through Resend, our transactional email provider. The audit itself runs on controlled machines under our operator's direct control. The list of sub-processors is small and will be published here as it is finalized; today it is the email provider (Resend) and the site host (Vercel). We will not add a sub-processor that receives your code or data without updating this page.

Retention and deletion

• During the engagement we hold your code and any read-only results only as long as needed to produce and deliver the report.
• After delivery our default is to delete the working copy of your code and any database output once the report is delivered and the engagement is closed, retaining only the finished report and routine business records.
• On request you can ask us to delete everything we hold about your engagement, including the finished report and your intake details, and we will confirm when it is done.

The exact default retention period is being finalized alongside our engagement terms; until it is published here, treat "deleted on engagement close unless you ask us to keep the report" as the operating commitment.

Read-only, and reversible

Every database interaction on the paid tiers is read-only by design. Nothing Harvey runs will write to your data, change your schema, or take a system offline. You can revoke any access you granted the moment the engagement ends — and we recommend you do.