For your role

For vendor management and procurement

A vendor review of an embedded decision layer turns on five things: where data sits, how tenants are isolated, who can reach what, how long records are kept, and what exit looks like. Those answers are published rather than negotiated, and claims we cannot substantiate are stated as absent rather than dressed up.

What we say before you ask

Reuben AI is not SOC 2 certified. We will not claim a certification we have not obtained, and we will not imply one through wording in a questionnaire response. What we can describe in detail is tenant isolation, residency selection, access control, retention configuration and export.

Reuben AI is software. It does not hold client money, settle transactions, or act as a licensed administrator, trustee, custodian, registry, adviser, auditor or tax agent. Regulated activity stays with you and your licensed counterparties, which usually narrows the scope of the review considerably.

No certification claims beyond what we hold
No client money, no settlement, no licensed activity
Isolation, residency, access, retention and export described in writing

Data handling, stated plainly

Each partner sits in an isolated tenant, with client-level isolation inside it where required. Data is not pooled across tenants to build a shared model of any partner's flow. Retention rules are configured per tenant rather than fixed by us.

Hosting jurisdiction is selected where a partner has residency obligations. Where a partner's own system of record stays authoritative, the layer reads and writes through the API rather than requiring a migration, which keeps the data footprint of the arrangement smaller than a replacement would be.

Access, identity and agent actions

Users authenticate through the partner's identity provider with SSO. Permissions are scoped per tenant, and where partner agents act through the tool interface those actions are recorded in the same provenance chain as a human action, so an audit does not have a gap where automation was involved.

Questionnaires, diligence packs and evidence

We complete security questionnaires directly and answer architecture questions from engineering rather than from a sales template. Where the honest answer is that something is not in place, the questionnaire says so.

For a first pass, the vendor review pack page collects the architecture, tenancy, residency, availability, support and exit material in one place so a review can proceed without waiting on a call.

Architecture and tenancy description
Residency options and hosting arrangements
Access control, identity and audit trail
Retention configuration and export format
Support model and escalation path

Exit before entry

Export is part of the arrangement rather than a concession at the end of one. Records and decision history travel with the tenant, so a decision to move on later does not strand the evidence the partner's own clients may still ask about.

This seat, by partner archetype

By market

Questions in this seat

Are you SOC 2 certified?

No. We will not say otherwise in a procurement process. We can describe the isolation, residency, access and retention controls that are in place.

Where is data hosted?

Hosting jurisdiction is selected per tenant where residency obligations apply. The specific arrangement is confirmed in writing during the review.

Do you subprocess model providers?

Model selection is part of the deployment configuration and is disclosed in the review. Partners with constraints on which models may touch their data can set them.