Skip to content

Vaultr Journal · Briefings

Reading an AI vendor's security page like a lawyer 

“Bank-grade encryption.” “SOC 2 compliant.” “Your data is yours.” A field guide to the four weasel patterns — and the questions that turn marketing back into facts.

28 August 2026 · 6 min read

Back to Journal

You will read a dozen vendor security pages this year, and most are engineered to survive your reading. They are not lying, usually. They are achieving something subtler: sentences that are technically true and informationally empty. Here are the four patterns worth spotting on sight.

Pattern one: the unowned superlative

“Bank-grade encryption.” Banks get breached. “Military-grade.” Which military, for which asset? The superlative has no owner and no standard; it is adjectives where a specification should be. The repair: ask for the exact mechanism — “AES-256 at rest, TLS 1.3 in transit” is a sentence; “bank-grade” is a mood.

Pattern two: the borrowed certification

“SOC 2 compliant” deserves its own caution. SOC 2 is an attestation about a service's controls over a period — asking which entity, which type, which period, and which systems are in scope is not paranoia, it is the reading the certification itself invites. The pattern to fear is borrowed glow: a cloud provider's certification described as if it covered the vendor's own service. We publish what we have *not* done for exactly this reason; an honest gap list is the antidote to borrowed glow.

Pattern three: the passive retention

“Data is retained in accordance with our policies.” Whose policies? For how long? Deletable by whom, with what effect? Retention is where confidentiality actually erodes. The repair is a table, not a paragraph: data class, retention, deletion. If a vendor's page lacks the table, the packet you request should contain it.

Pattern four: the unverifiable promise

“Your data never leaves our secure environment.” Tested how? By whom? The pattern's tell is the absence of a procedure. The strongest pages end with something you can run — ours ends with a boundary test for precisely this reason, edges stated. A security claim without a verification path is not necessarily false; it is just not evidence yet.

The question that repairs every pattern is the same: “show me the sentence I could hold you to, and the test I could run.”

None of this requires hostility. Vendors respond to the questions they are asked; a market that asks for specifications instead of superlatives gets specification-writing vendors. Be that market.