What your procurement team will ask for.

The five that block a deal

Ranked by how often they stop a purchase, not by how interesting they are.

• Training and retention, in the DPA and flowed down to every model provider.
• SOC 2 Type II with its report period, plus an AI-governance layer above it.
• Blast radius — what the agent may do, under whose identity, and how fast it stops.
• Liability and insurance, with an affirmative AI certificate.
• The fourth-party chain — one named indemnifier, whoever built the agent.

One named indemnifier

Areev is the merchant of record and the operator on every listing, including partner-built ones. When a third party's agent errs on your data, there is one entity to hold accountable.

The compliance pack

SOC 2 Type II with report period, ISO 27001, ISO 42001, the DPA, the sub-processor and model list with 30 days' change notice, and the data-residency statement — as one file, under NDA.

Private shelves

A catalogue scoped to your organisation, with your approved listings, your approvers and your regions.