What a vendor review of an embedded AI layer should cover

Vendor reviews of AI providers tend to spend their effort in the wrong place. Model choice and feature comparisons occupy the meeting, while the questions that decide whether the arrangement survives a client's own audit get a single line in a questionnaire. The five that matter are unglamorous: residency, isolation, access, retention and exit.

The second failure mode is accepting certification language as an answer. A certification describes a process audit at a point in time. It does not tell a reviewer whether one client's documents can influence another client's output, or whether a decision made two years ago can still be produced with its sources. Ask for the mechanism, not the badge.

Reuben AI is not SOC 2 certified, and says so in writing rather than implying otherwise through careful wording. What can be described is the mechanism: isolation per tenant, residency selection where obligations apply, access scoped through the partner's identity provider, retention configured per tenant, and export as a term of the arrangement rather than a concession at the end of it.

Each tenant holds its own mandate, records, documents and decision history. Access is scoped per tenant, and the partner chooses the residency option that matches its own obligations. Nothing is pooled across tenants to produce a shared model of a partner's flow.

Reuben AI is software. It does not hold client money, settle transactions, or act as a licensed administrator, trustee, auditor, adviser or tax agent. Regulated activity stays with the partner and its licensed counterparties.