Infrastructure
Vendor review pack
The material a platform's vendor review, security and procurement teams ask for, published rather than negotiated: what the layer is, how tenants are isolated, where data sits, who can reach it, how long it is kept, how support works and what exit looks like. Where something is not in place, this page says so.
1. What is being reviewed
A decision and operations layer for private capital, embedded behind a partner's own surface. It reads a written mandate per tenant, assesses opportunities against it, produces diligence findings with source attribution, runs the operational workflow around a transaction, and generates portfolio and investor reporting from the same records.
It is software. It does not hold client money, does not settle transactions, and is not a licensed administrator, trustee, custodian, registry, adviser, auditor or tax agent. It is not registered with any securities regulator and does not distribute securities.
2. Certifications, stated without dressing
Reuben AI is not SOC 2 certified. We do not hold certifications we have not obtained and will not imply otherwise in a questionnaire response. Reviews proceed on described and demonstrable controls: tenant isolation, residency selection, access control, retention configuration, audit trail and export.
3. Tenancy and isolation
Each partner is an isolated tenant. Where the partner's own clients require separation from one another, client-level isolation exists inside the partner tenant. Mandate, documents, records and decision history belong to the tenant that created them.
Nothing is pooled across tenants to build a shared model of a partner's flow. That is a design property rather than a policy statement: the mandate and the records that drive an assessment are read from the tenant boundary the request arrives on.
4. Residency and hosting
Hosting jurisdiction is selected where a partner or its clients carry residency obligations, and the specific arrangement is confirmed in writing during the review. Model selection is part of the deployment configuration and is disclosed, so a partner with constraints on which models may touch its data can set them.
5. Access, identity and audit trail
Authentication runs through the partner's identity provider. Permissions are scoped per tenant. Actions are recorded with provenance, including actions taken by partner agents through the tool interface, so automation does not create a gap in the audit trail.
6. Retention, export and exit
Retention rules are configured per tenant. Export is part of the arrangement rather than a concession negotiated at the end of one: records and decision history travel with the tenant, which matters because a partner's own clients may ask about a decision years after it was made.
- Retention configured per tenant
- Records and decision history exportable
- Deletion follows the tenant's configured rules
7. Availability and support
Support boundaries, escalation path and availability commitments are agreed per partnership, because they depend on the deployment model and on the partner's own release and incident process. We do not publish figures we would then have to qualify in a contract.
8. Questionnaires and follow-up
Security questionnaires are completed directly, with architecture questions answered by engineering rather than from a sales template. Where an answer is that a control is not in place, the response says that. A partner review that discovers an overstatement later is more expensive for both sides than an inconvenient answer now.
Frequently asked
Can our security team speak to an engineer?
Yes. Architecture and data handling questions are answered by the people who built it.
Do you have penetration test results?
Security testing arrangements are discussed under the review rather than published, and we describe what exists rather than implying more.
Is a pilot possible before a full vendor review?
That depends on your own policy. Many partners run a scoped pilot on non-sensitive records in parallel with the review.
Who signs the data processing agreement?
The partner and Reuben Ventures Pty Ltd, trading as Reuben AI. Terms follow the residency and retention configuration agreed for the tenant.