Vendor and partner due diligence

Review aisecurity.llc before procurement, pilot, or production.

Use this page as the public cover sheet for security, legal, procurement, finance, and OEM partner review.

Review the materials available now, understand what a tailored packet can contain, and request only the diligence materials relevant to the relationship you are evaluating.

We publish the assurance posture, contracting paths, data boundaries, and interface commitments reviewers need. Proprietary implementation details remain protected and are disclosed only when necessary, under the appropriate agreement.

Request Vendor Review Packet Request OEM Partner Due-Diligence Packet

Review public evidence Review Vendor Pilot

Early-stage vendor · Review path available. aisecurity.llc does not claim SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or another formal certification unless expressly stated in a signed agreement or updated Trust Center notice.

Security practicesResponsible AIData and evidence handlingContract pathAuthorized testing boundariesQuestionnaire support

Shared cover sheet

One review link for every internal stakeholder

Product and technical teams may evaluate aisecurity.llc as a specialist, OEM licensor, technology partner, assessment provider, or training provider.

Procurement systems will usually classify the outside company as a vendor.

This page supports that administrative review without changing the commercial relationship or exposing unnecessary implementation detail.

Procurement and finance

Vendor profile, buying path, onboarding information, commercial contacts, invoicing, and applicable procurement options.

Legal

NDA, DPA where applicable, SOW, assessment terms, Rules of Engagement, partner terms, and licensing boundaries.

Security and assurance

Security practices, responsible-AI boundaries, evidence handling, retention, vulnerability reporting, and current claim status.

Product and engineering

Proposed scope, deployment boundary, interface expectations, responsibilities, authorization, pilot criteria, and expected outputs.

Review paths

Choose the review path

A standard vendor review and an OEM partner review overlap, but they do not ask the same questions.

Choose the path that matches the relationship being evaluated.

Vendor & Procurement Review Packet

For organizations buying services, products, assessments, or training

Use this path when evaluating a direct engagement with aisecurity.llc, including:

AI product security assessments
AI launch security reviews
Adversarial testing and red teaming
Agentic workflow security
Buyer-evidence and sales-enablement work
AI Security Academy programs
Other professional services or licensed products

A tailored packet may include:

Vendor profile and engagement summary
Current security and responsible-AI posture
Contract and onboarding path
DPA applicability review
Evidence-handling and retention references
Security-questionnaire support
Commercial contacts and buying path
Applicable NDA, SOW, terms, and addenda
Engagement-specific technical checklist where required

Request Vendor Review Packet

OEM Partner Due-Diligence Packet

For organizations evaluating embedded or licensed Workbench capabilities

Use this path when evaluating an OEM pilot, embedded analysis capability, sidecar or worker deployment, private deployment, scanner integration, offensive-platform integration, managed-service model, or other technology partnership.

It is designed for:

Scanner and AppSec vendors
Offensive and adversarial platforms
Security-product companies
MSSPs and managed-security providers
Consulting and assessment firms
Workforce and training platforms
Other technology partners

A tailored packet may include:

Supplier and partner profile
Proposed capability and pilot boundary
Partner-owned and AI Security LLC-owned responsibilities
Supported invocation and deployment models
Data, evidence, and processing boundary
Sanitized request and result contracts
Partner profile and native-object requirements
Compatibility, versioning, and update model
Support and escalation model
IP, confidentiality, and disclosure boundaries
Vulnerability and incident-handling process
Pilot success and acceptance criteria
Production decision and licensing path
NDA, pilot SOW, DPA, security exhibit, and OEM terms where required

Request OEM Due-Diligence Packet

The packet supports evaluation and negotiation. It is not a representation that every deployment mode, module, compatibility window, support tier, or partner integration is already available.

IP boundary note

An OEM review evaluates the interface, deployment model, data boundary, operational dependency, and license.

It does not require disclosure of Workbench source code, internal prompts, scoring logic, detector definitions, rule catalogs, proprietary corpora, or other unnecessary implementation detail.

Packet request

Choose the relationship being reviewed

Use the vendor path for a direct purchase or engagement. Use the OEM path for an embedded capability, technology partnership, or licensing review.

Request Vendor Review Packet Request OEM Partner Due-Diligence Packet

Public evidence

Review the public evidence now

These materials can be reviewed before a tailored packet is requested.

Engagement-specific documents may add stricter requirements and become binding only when completed and executed.

Security Practices

Current public security posture, operating boundaries, and assurance status.

Review Security Practices

Responsible AI

How AI assistance, human review, customer content, and publication boundaries are handled.

Review Responsible AI Principles

AI Usage Policy

Public boundaries for the use of AI systems in delivery and operations.

Review AI Usage Policy

Contracts and Legal Documents

The current path for NDAs, DPAs, SOWs, assessment terms, schedules, and Rules of Engagement.

Browse Contracts and Legal Docs

Vendor Profile

A public summary of the company, delivery model, and available engagement paths.

Review Vendor Profile

Data Processing Addendum

The current DPA path when personal data or customer-controlled data is in scope.

Review the DPA Summary

Evidence Handling

How collected evidence is transferred, handled, restricted, and incorporated into deliverables.

Review Evidence Handling Policy

Retention and Redaction

How engagement evidence, sensitive material, and publication-safe outputs are retained or redacted.

Review Retention & Redaction Policy

Security Operations

Operational expectations for access, communication, escalation, and engagement handling.

Review Security Operations Schedule

Publication and Claim Readiness

How evidence is reviewed before it becomes a public claim, customer-facing statement, or reusable proof artifact.

Review Publication & Claim-Readiness Policy

Assessment Terms

The baseline terms and boundaries that apply to technical assessment work.

Review Assessment Terms

Rules of Engagement

Authorization, targets, timing, stop conditions, communication, and evidence requirements for scoped testing.

Review Rules of Engagement

Vulnerability Disclosure

The path for reporting security issues affecting aisecurity.llc systems or public services.

Review Vulnerability Disclosure

Engagement and license models

Seven models, one bounded first step

Exact fees, minimums, license units, margins, and support commitments are defined in the applicable proposal, SOW, and license - not on this page.

Fixed-scope expert engagement

A bounded, priced assessment or advisory engagement delivered directly by AI Security LLC.

Bounded Vendor Pilot

One representative workflow, agreed acceptance criteria, and a documented production decision.

OEM or embedded license

A selected engine or capability operates behind a partner product surface.

Private-label delivery

The partner brands the service or output while AI Security LLC retains technical and evidence control.

White-label capability

Deeper product-level branding, packaging, and distribution rights, explicitly licensed.

Resale or channel agreement

An authorized reseller sells approved offers without engine redistribution rights by default.

Technology alliance

An approved joint integration with a defined contract, ownership, and claim language.

Sample package

The real sample artifacts, not dead cards

Sample pilot plan

The representative pilot structure used in the Vendor Pilot walkthrough.

Review the Vendor Pilot

Sample input and output envelopes

Sanitized sample input and finding/output envelopes referenced by the pilot.

View sample envelopes

Scanner Provider Pilot SOW

A public-safe pilot SOW example and the route to a signer-ready version.

Review the Pilot SOW

Disclosure boundary

Transparent where diligence requires evidence. Controlled where disclosure would expose IP.

Reviewers should be able to understand the company, assurance posture, data boundaries, contracting process, and proposed interface.

They do not need unrestricted access to the proprietary implementation that creates the value.

Publicly reviewable

Available without an NDA:

Company and service description
Current assurance and certification status
Security and responsible-AI practices
Data, evidence, retention, and redaction summaries
Contract and authorization paths
High-level OEM and deployment models already published
Request and escalation paths

Prepared for a named organization

Available after a qualified request:

Completed vendor profile
Vendor and security questionnaire responses
Relevant commercial and operational information
Applicable contract package
Request-specific assurance summary
Proposed relationship and review path

Shared under NDA when necessary

Available when required for real diligence:

Sanitized architecture and data-flow summary
Relevant processor or infrastructure information
Input and output interface description
Responsibility matrix
Deployment and support model
Versioning and update expectations
Sanitized fixtures or evidence examples

Limited to a scoped pilot or executed contract

Available only when required for implementation:

Integration-specific schema
Pilot fixtures
Entitlement and licensing configuration
Acceptance criteria
Permitted-use boundaries
Redistribution or white-label rights
Production support and update commitments

Boundary statement: Source code, internal prompts, detector definitions, rule catalogs, scoring formulas, validation internals, proprietary corpora, customer evidence, credentials, and other unnecessary implementation details are not included in the public packet.

Tailored packet

What we prepare after a qualified request

A tailored packet combines the relevant public materials with organization-specific vendor, commercial, legal, assurance, and technical information.

It is assembled for the proposed relationship rather than sending every document and internal detail indiscriminately.

Organization and relationship

Company and service description
Proposed relationship type
Relevant contacts
Delivery model and supported regions
Proposed engagement, pilot, or license path

Legal and onboarding

Mutual NDA
DPA when applicable
SOW or pilot SOW
Applicable assessment, commercial, OEM, or partner addenda
Standard vendor-onboarding responses
Questionnaire response path

Security and AI assurance

Current security-practices summary
Responsible-AI and AI-usage boundaries
Evidence-handling and retention references
Vulnerability-reporting path
Human-review and claim boundaries
Current assurance and certification status

Technical or OEM review

Scope and system boundary
Proposed input and output interface
Deployment or invocation model
Access and authorization requirements
Data and evidence handling
Responsibility matrix
Technical contacts and stop conditions
Expected outputs and acceptance criteria

Commercial path

Fixed-fee engagement path where applicable
PO, invoice, and payment workflow
Private-offer or direct-SOW path
Pilot-to-production path
License, entitlement, support, update, and redistribution topics where applicable

Sensitive-information note: Sensitive security answers, tax or banking documents, credentials, customer data, unredacted architecture, active vulnerability evidence, and proprietary implementation details are not published on this page or collected through an unsecured public form.

Parallel review

Move diligence in parallel instead of waiting sequentially

Vendor onboarding, legal review, assurance review, and technical scoping can begin at the same time.

Active testing, production access, integration, or licensed deployment still requires the applicable executed agreements and authorization.

Procurement

Output

Vendor profile, onboarding responses, and commercial path

Legal

Output

NDA, DPA if applicable, SOW, addenda, and licensing boundaries

Security

Output

Assurance summary, evidence handling, retention, vulnerability reporting, and claim boundaries

Technical or OEM

Output

Scope, interface, deployment boundary, responsibilities, pilot plan, and acceptance criteria

Start a packet request

Limitations

What this page does not represent

It is not a certification, audit opinion, attestation, endorsement, or warranty.
It does not authorize testing, system access, integration, deployment, redistribution, or use of proprietary technology.
Public summaries do not replace executed NDAs, DPAs, SOWs, assessment terms, Rules of Engagement, pilot terms, or OEM license agreements.
A packet request does not grant access to source code, internal prompts, rule catalogs, scoring logic, validation internals, or proprietary corpora.
Sensitive evidence and credentials must use an approved secure channel after the required agreements are in place.
Engagement scope, pilot scope, access, deliverables, support, permitted use, and acceptance criteria are defined in executed documents.
Compatibility, technical readiness, public examples, and adapter support do not by themselves establish a commercial partnership or production integration.

FAQ

Frequently asked questions

Why is aisecurity.llc described as a vendor if we are evaluating an OEM partnership?

Vendor is the administrative term many organizations use for an outside company they may pay, license technology from, or depend on for delivery. The commercial relationship may still be an OEM, technology, software-licensing, or services partnership.

Does aisecurity.llc currently claim SOC 2 or ISO 27001 certification?

No. aisecurity.llc does not claim SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or another formal certification unless expressly stated in a signed agreement or updated Trust Center notice. The Trust Center describes the current public practices and document paths available for review.

Can you complete our vendor or security questionnaire?

Yes. We can complete standard vendor-onboarding and security questionnaires using current evidence, explicit claim boundaries, and the context of the proposed relationship. Sensitive answers are provided through the appropriate diligence channel rather than published as a public answer bank.

What technical information can an OEM partner review?

A qualified partner can review the information needed to evaluate the proposed interface, deployment model, data boundary, responsibilities, support model, versioning, security process, and pilot criteria. The review does not automatically include source code, internal prompts, detector definitions, scoring logic, proprietary corpora, or other unnecessary internal IP.

Does requesting a packet authorize testing or integration?

No. Testing, access, integration, deployment, and redistribution begin only after the applicable scope, authorization, SOW, Rules of Engagement, pilot terms, license, and technical boundaries are approved.

What should not be submitted through the request form?

Do not submit passwords, API keys, access tokens, production credentials, regulated data, unredacted customer records, sensitive architecture, active vulnerability evidence, proprietary source code, model weights, private attack corpora, or other restricted material through a public form.

Can procurement, legal, and technical review begin before a final paid agreement?

Yes. The no-cost scoping path can establish confidentiality, diligence requirements, access boundaries, requested materials, and a draft review or pilot plan before paid work begins. Active testing, production delivery, and licensed use still require the applicable executed documents.

Final review step

Give every reviewer the same starting point.

Request the packet that matches the relationship being evaluated. We will prepare the relevant public, request-specific, and NDA-gated materials without exposing unnecessary proprietary information.

Request Vendor Review Packet Request OEM Partner Due-Diligence Packet

Do not submit credentials, customer data, proprietary source code, active vulnerability evidence, or other sensitive material through this form.