Procurement and finance
Vendor profile, buying path, onboarding information, commercial contacts, invoicing, and applicable procurement options.
Vendor and partner due diligence
Review aisecurity.llc before procurement, pilot, or production.
Use this page as the public cover sheet for security, legal, procurement, finance, and OEM partner review.
Review the materials available now, understand what a tailored packet can contain, and request only the diligence materials relevant to the relationship you are evaluating.
We publish the assurance posture, contracting paths, data boundaries, and interface commitments reviewers need. Proprietary implementation details remain protected and are disclosed only when necessary, under the appropriate agreement.
Early-stage vendor · Review path available. aisecurity.llc does not claim SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or another formal certification unless expressly stated in a signed agreement or updated Trust Center notice.
Security practicesResponsible AIData and evidence handlingContract pathAuthorized testing boundariesQuestionnaire support
Shared cover sheet
One review link for every internal stakeholder
Product and technical teams may evaluate aisecurity.llc as a specialist, OEM licensor, technology partner, assessment provider, or training provider.
Procurement systems will usually classify the outside company as a vendor.
This page supports that administrative review without changing the commercial relationship or exposing unnecessary implementation detail.
Legal
NDA, DPA where applicable, SOW, assessment terms, Rules of Engagement, partner terms, and licensing boundaries.
Security and assurance
Security practices, responsible-AI boundaries, evidence handling, retention, vulnerability reporting, and current claim status.
Product and engineering
Proposed scope, deployment boundary, interface expectations, responsibilities, authorization, pilot criteria, and expected outputs.
Review paths
Choose the review path
A standard vendor review and an OEM partner review overlap, but they do not ask the same questions.
Choose the path that matches the relationship being evaluated.
Vendor & Procurement Review Packet
For organizations buying services, products, assessments, or training
Use this path when evaluating a direct engagement with aisecurity.llc, including:
- AI product security assessments
- AI launch security reviews
- Adversarial testing and red teaming
- Agentic workflow security
- Buyer-evidence and sales-enablement work
- AI Security Academy programs
- Other professional services or licensed products
A tailored packet may include:
- Vendor profile and engagement summary
- Current security and responsible-AI posture
- Contract and onboarding path
- DPA applicability review
- Evidence-handling and retention references
- Security-questionnaire support
- Commercial contacts and buying path
- Applicable NDA, SOW, terms, and addenda
- Engagement-specific technical checklist where required
OEM Partner Due-Diligence Packet
For organizations evaluating embedded or licensed Workbench capabilities
Use this path when evaluating an OEM pilot, embedded analysis capability, sidecar or worker deployment, private deployment, scanner integration, offensive-platform integration, managed-service model, or other technology partnership.
It is designed for:
- Scanner and AppSec vendors
- Offensive and adversarial platforms
- Security-product companies
- MSSPs and managed-security providers
- Consulting and assessment firms
- Workforce and training platforms
- Other technology partners
A tailored packet may include:
- Supplier and partner profile
- Proposed capability and pilot boundary
- Partner-owned and AI Security LLC-owned responsibilities
- Supported invocation and deployment models
- Data, evidence, and processing boundary
- Sanitized request and result contracts
- Partner profile and native-object requirements
- Compatibility, versioning, and update model
- Support and escalation model
- IP, confidentiality, and disclosure boundaries
- Vulnerability and incident-handling process
- Pilot success and acceptance criteria
- Production decision and licensing path
- NDA, pilot SOW, DPA, security exhibit, and OEM terms where required
The packet supports evaluation and negotiation. It is not a representation that every deployment mode, module, compatibility window, support tier, or partner integration is already available.
IP boundary note
An OEM review evaluates the interface, deployment model, data boundary, operational dependency, and license.
It does not require disclosure of Workbench source code, internal prompts, scoring logic, detector definitions, rule catalogs, proprietary corpora, or other unnecessary implementation detail.
Selected request
Vendor & Procurement Review Packet
Continue through the existing procurement-fast-track request flow. Your source, UTM, referrer, and partner-page context are retained when supplied.
Do not submit credentials, customer data, proprietary source code, active vulnerability evidence, or other sensitive material through this form.
Public evidence
Review the public evidence now
These materials can be reviewed before a tailored packet is requested.
Engagement-specific documents may add stricter requirements and become binding only when completed and executed.
Security Practices
Current public security posture, operating boundaries, and assurance status.
Review Security PracticesResponsible AI
How AI assistance, human review, customer content, and publication boundaries are handled.
Review Responsible AI PrinciplesAI Usage Policy
Public boundaries for the use of AI systems in delivery and operations.
Review AI Usage PolicyContracts and Legal Documents
The current path for NDAs, DPAs, SOWs, assessment terms, schedules, and Rules of Engagement.
Browse Contracts and Legal DocsVendor Profile
A public summary of the company, delivery model, and available engagement paths.
Review Vendor ProfileData Processing Addendum
The current DPA path when personal data or customer-controlled data is in scope.
Review the DPA SummaryEvidence Handling
How collected evidence is transferred, handled, restricted, and incorporated into deliverables.
Review Evidence Handling PolicyRetention and Redaction
How engagement evidence, sensitive material, and publication-safe outputs are retained or redacted.
Review Retention & Redaction PolicySecurity Operations
Operational expectations for access, communication, escalation, and engagement handling.
Review Security Operations SchedulePublication and Claim Readiness
How evidence is reviewed before it becomes a public claim, customer-facing statement, or reusable proof artifact.
Review Publication & Claim-Readiness PolicyAssessment Terms
The baseline terms and boundaries that apply to technical assessment work.
Review Assessment TermsRules of Engagement
Authorization, targets, timing, stop conditions, communication, and evidence requirements for scoped testing.
Review Rules of EngagementVulnerability Disclosure
The path for reporting security issues affecting aisecurity.llc systems or public services.
Review Vulnerability DisclosureEngagement and license models
Seven models, one bounded first step
Exact fees, minimums, license units, margins, and support commitments are defined in the applicable proposal, SOW, and license - not on this page.
Fixed-scope expert engagement
A bounded, priced assessment or advisory engagement delivered directly by AI Security LLC.
Bounded Vendor Pilot
One representative workflow, agreed acceptance criteria, and a documented production decision.
OEM or embedded license
A selected engine or capability operates behind a partner product surface.
Private-label delivery
The partner brands the service or output while AI Security LLC retains technical and evidence control.
White-label capability
Deeper product-level branding, packaging, and distribution rights, explicitly licensed.
Resale or channel agreement
An authorized reseller sells approved offers without engine redistribution rights by default.
Technology alliance
An approved joint integration with a defined contract, ownership, and claim language.
Sample package
The real sample artifacts, not dead cards
Sample pilot plan
The representative pilot structure used in the Vendor Pilot walkthrough.
Review the Vendor PilotSample input and output envelopes
Sanitized sample input and finding/output envelopes referenced by the pilot.
View sample envelopesScanner Provider Pilot SOW
A public-safe pilot SOW example and the route to a signer-ready version.
Review the Pilot SOWDisclosure boundary
Transparent where diligence requires evidence. Controlled where disclosure would expose IP.
Reviewers should be able to understand the company, assurance posture, data boundaries, contracting process, and proposed interface.
They do not need unrestricted access to the proprietary implementation that creates the value.
Publicly reviewable
Available without an NDA:
- Company and service description
- Current assurance and certification status
- Security and responsible-AI practices
- Data, evidence, retention, and redaction summaries
- Contract and authorization paths
- High-level OEM and deployment models already published
- Request and escalation paths
Prepared for a named organization
Available after a qualified request:
- Completed vendor profile
- Vendor and security questionnaire responses
- Relevant commercial and operational information
- Applicable contract package
- Request-specific assurance summary
- Proposed relationship and review path
Shared under NDA when necessary
Available when required for real diligence:
- Sanitized architecture and data-flow summary
- Relevant processor or infrastructure information
- Input and output interface description
- Responsibility matrix
- Deployment and support model
- Versioning and update expectations
- Sanitized fixtures or evidence examples
Limited to a scoped pilot or executed contract
Available only when required for implementation:
- Integration-specific schema
- Pilot fixtures
- Entitlement and licensing configuration
- Acceptance criteria
- Permitted-use boundaries
- Redistribution or white-label rights
- Production support and update commitments
Boundary statement: Source code, internal prompts, detector definitions, rule catalogs, scoring formulas, validation internals, proprietary corpora, customer evidence, credentials, and other unnecessary implementation details are not included in the public packet.
Tailored packet
What we prepare after a qualified request
A tailored packet combines the relevant public materials with organization-specific vendor, commercial, legal, assurance, and technical information.
It is assembled for the proposed relationship rather than sending every document and internal detail indiscriminately.
Organization and relationship
- Company and service description
- Proposed relationship type
- Relevant contacts
- Delivery model and supported regions
- Proposed engagement, pilot, or license path
Legal and onboarding
- Mutual NDA
- DPA when applicable
- SOW or pilot SOW
- Applicable assessment, commercial, OEM, or partner addenda
- Standard vendor-onboarding responses
- Questionnaire response path
Security and AI assurance
- Current security-practices summary
- Responsible-AI and AI-usage boundaries
- Evidence-handling and retention references
- Vulnerability-reporting path
- Human-review and claim boundaries
- Current assurance and certification status
Technical or OEM review
- Scope and system boundary
- Proposed input and output interface
- Deployment or invocation model
- Access and authorization requirements
- Data and evidence handling
- Responsibility matrix
- Technical contacts and stop conditions
- Expected outputs and acceptance criteria
Commercial path
- Fixed-fee engagement path where applicable
- PO, invoice, and payment workflow
- Private-offer or direct-SOW path
- Pilot-to-production path
- License, entitlement, support, update, and redistribution topics where applicable
Sensitive-information note: Sensitive security answers, tax or banking documents, credentials, customer data, unredacted architecture, active vulnerability evidence, and proprietary implementation details are not published on this page or collected through an unsecured public form.
Parallel review
Move diligence in parallel instead of waiting sequentially
Vendor onboarding, legal review, assurance review, and technical scoping can begin at the same time.
Active testing, production access, integration, or licensed deployment still requires the applicable executed agreements and authorization.
Procurement
Output
Vendor profile, onboarding responses, and commercial path
Legal
Output
NDA, DPA if applicable, SOW, addenda, and licensing boundaries
Security
Output
Assurance summary, evidence handling, retention, vulnerability reporting, and claim boundaries
Technical or OEM
Output
Scope, interface, deployment boundary, responsibilities, pilot plan, and acceptance criteria
Limitations
What this page does not represent
- It is not a certification, audit opinion, attestation, endorsement, or warranty.
- It does not authorize testing, system access, integration, deployment, redistribution, or use of proprietary technology.
- Public summaries do not replace executed NDAs, DPAs, SOWs, assessment terms, Rules of Engagement, pilot terms, or OEM license agreements.
- A packet request does not grant access to source code, internal prompts, rule catalogs, scoring logic, validation internals, or proprietary corpora.
- Sensitive evidence and credentials must use an approved secure channel after the required agreements are in place.
- Engagement scope, pilot scope, access, deliverables, support, permitted use, and acceptance criteria are defined in executed documents.
- Compatibility, technical readiness, public examples, and adapter support do not by themselves establish a commercial partnership or production integration.
FAQ
Frequently asked questions
Why is aisecurity.llc described as a vendor if we are evaluating an OEM partnership?
Vendor is the administrative term many organizations use for an outside company they may pay, license technology from, or depend on for delivery. The commercial relationship may still be an OEM, technology, software-licensing, or services partnership.
Does aisecurity.llc currently claim SOC 2 or ISO 27001 certification?
No. aisecurity.llc does not claim SOC 2, ISO 27001, HIPAA, PCI, FedRAMP, or another formal certification unless expressly stated in a signed agreement or updated Trust Center notice. The Trust Center describes the current public practices and document paths available for review.
Can you complete our vendor or security questionnaire?
Yes. We can complete standard vendor-onboarding and security questionnaires using current evidence, explicit claim boundaries, and the context of the proposed relationship. Sensitive answers are provided through the appropriate diligence channel rather than published as a public answer bank.
What technical information can an OEM partner review?
A qualified partner can review the information needed to evaluate the proposed interface, deployment model, data boundary, responsibilities, support model, versioning, security process, and pilot criteria. The review does not automatically include source code, internal prompts, detector definitions, scoring logic, proprietary corpora, or other unnecessary internal IP.
Does requesting a packet authorize testing or integration?
No. Testing, access, integration, deployment, and redistribution begin only after the applicable scope, authorization, SOW, Rules of Engagement, pilot terms, license, and technical boundaries are approved.
What should not be submitted through the request form?
Do not submit passwords, API keys, access tokens, production credentials, regulated data, unredacted customer records, sensitive architecture, active vulnerability evidence, proprietary source code, model weights, private attack corpora, or other restricted material through a public form.
Can procurement, legal, and technical review begin before a final paid agreement?
Yes. The no-cost scoping path can establish confidentiality, diligence requirements, access boundaries, requested materials, and a draft review or pilot plan before paid work begins. Active testing, production delivery, and licensed use still require the applicable executed documents.
Final review step
Give every reviewer the same starting point.
Request the packet that matches the relationship being evaluated. We will prepare the relevant public, request-specific, and NDA-gated materials without exposing unnecessary proprietary information.
Do not submit credentials, customer data, proprietary source code, active vulnerability evidence, or other sensitive material through this form.
Canonical vendor and partner review page for aisecurity.llc.