Six to nine vendors, five obligations each: the first AI security exercise is arithmetic

Finish the multiplication the post starts. Five obligations per vendor across six to nine vendors is 30 to 45 recurring items ^[12]: keys with their own rotation stories, egress destinations the firewall has to allow, subprocessor entries on the DPA, breach notification clocks that start independently, dependency trees whose CVE feeds someone is nominally watching ^[6]. None of that arrived as a decision. It arrived one sprint at a time, according to Backboard.io, which wrote the count ^[15].

Then count the stack the post itself lists, and the headline range stops holding. Gateway, vector database, memory service, RAG framework, embedding provider, orchestration layer and observability tool is seven categories before you add the two or three model providers, which puts a typical deployment at nine or ten vendors, not six to nine ^[13]. The company arguing you have too many vendors is undercounting by at least one. Treat 6 to 9 as a floor.

The interesting failure is deletion, and it is a structural one rather than a vendor quality problem. Follow a single user message: it lands in the gateway's request log, a derivative embedding lands in the vector database, the memory service persists a version, and the observability tool captures the whole trace including the completion ^[7]. That is four retention policies and four deletion semantics behind four vendor APIs, which means an erasure request becomes four tickets rather than one executed operation ^[8]. Backboard's framing is the right one: under GDPR Article 17, "we asked our subprocessors" is a weaker position than "we called the delete endpoint and logged the result" ^[16]. The obligation is single and yours; the capability is distributed and mostly not yours.

The escape hatch teams reach for is that embeddings are just numbers, and the cited literature closes it. Morris et al. (2023) demonstrated iterative reconstruction that exactly recovers 92% of short text inputs from their embeddings ^[4], and Song and Raghunathan (2020) showed embeddings leak content and authorship [c5b]. So the vector store is a second queryable copy of the source data, in a different trust boundary, with its own key, and frequently missing from the data map compliance maintains ^[1]. Two questions worth asking before any tooling purchase: whether that key is scoped per workload or reads every namespace ^[11], and whether erasure deletes the embeddings or only the source rows ^[18].

The in-runtime SDK item on the list is not hypothetical either. LangChain shipped a remote code execution vulnerability in its math chain, CVE-2023-29374 ^[9], and the integration layer is by definition the code holding credentials to both the model and data layers ^[3]. Meanwhile the security review goes to the model provider, and the seven services wrapped around it usually get none ^[17].

Backboard sells AI infrastructure and labels that interest at the end of its own post ^[10]. The pitch is consolidation, so discount it accordingly. The arithmetic is free, and it is checkable against artefacts you already have: keys in config, allow rules in the firewall, the subprocessor list in the DPA.