aisecurity.llc
AI SECURITY · PRIVACY · TRUST
SECURITY REVIEW ATTESTATION
Independent Assessment · Evidence-Based · Public-Safe
This attests that
ACME Corp
acmecorp.io
ACME Corp engaged aisecurity.llc to conduct a security review of the systems, processes, and public trust surfaces described below.
Service(s) performed
RAG Authorization Review
Retrieval pipeline authorization, tenant isolation, data access boundaries, and scoping controls.
Prompt & Data Safety Review
Prompt construction, injection surface, output filtering, and data leakage vectors.
Identity & Access Controls Assessment
User-to-data authorization, role-based retrieval scoping, and session boundary enforcement.
Retrieval Boundary Testing
Controlled cross-tenant retrieval probes, context poisoning, and unauthorized data surfacing.
Scope
Results summary
Strong
The RAG authorization controls demonstrated a strong posture within the reviewed scope. Tenant isolation mechanisms are correctly enforced at the retrieval layer. One high-severity finding related to overly broad embedding namespace permissions was identified and is under active remediation.
Domains reviewed
RAG & Data Access
Retrieval pipeline, embedding store trust, and output filtering.
Identity & Access
Multi-tenant authorization, session scoping, and role enforcement.
AI Security
Prompt construction, context boundaries, and model input/output controls.
Data Security
Data classification, embedding-level access, and sensitive data handling.
Application Security
API authorization, input validation, and injection surface.
Privacy & Data Handling
Data retention, PII exposure vectors in retrieved context.
Monitoring & Detection
Retrieval audit logging, anomaly alerting, and abuse telemetry.
Vendor / LLM Provider
Third-party model provider trust boundary and data handling.