FAQ · Trust and evidence
Is it secure? Can it pass my firm's vendor review?
Each kit ships the documents a vendor review usually asks for, including a filled-in security questionnaire, a software bill of materials and signed release files. The security testing behind them was done by Reamer Labs itself; no outside firm has audited either product. Whether that is enough depends on your firm's policy, and you can test the binaries yourself.
Each kit ships the documents a vendor review usually asks for, including a filled-in security questionnaire, a software bill of materials and signed release files. The security testing behind them was done by Reamer Labs itself; no outside firm has audited either product. Whether that is enough depends on your firm's policy, and you can test the binaries yourself.
What ships for the review
- A vendor questionnaire pack, written to send as-is to an infrastructure, risk or procurement team. It covers architecture, access control, encryption, the support model, vulnerability disclosure and patch policy, data handling and business continuity.
- A software bill of materials in CycloneDX format, listing every third-party component and its version. There are only a few: a JSON library, a networking library, a pinned Ed25519 signing library, and the system's own curl for activation.
- Signed releases. Every download comes with a checksum and two Ed25519 signatures, one over the checksum and one over the archive itself. The deployment guide shows how to verify them and how to confirm the signing key through a channel separate from the download.
- A security hardening log recording the defects found and fixed at the C interface and in the licence code, such as out-of-bounds reads and an argument-injection risk in activation. Each fix has a regression test and was checked with memory and undefined-behaviour sanitisers.
What it does not have
- No outside audit or certification. The hardening was an internal review by the people who built the product, and the log says so.
- No source code. Both products are closed source. Reviewers get the public header, the compiled library and the documents, not the engine's implementation.
- No support desk. One person handles support and security reports, on best-effort targets rather than a contractual SLA unless one is agreed in an order form.
What helps the review
Both products run inside your network and send nothing to Reamer Labs beyond licence activation, which limits what a reviewer has to assess. See Does my strategy code or data ever leave my machine? For a firm buying Reamer Server, the For firms page covers order forms and procurement.
Next questions
Are there customer reviews?Not yet. Reamer Research and Reamer Server are newly launched, and there are no published customer reviews or testimonials. Reviews will appear on the public software listings as customers post them. Until then, the evidence you can check is the uncut integration recordings, the published benchmark method and raw data, and the trial.Reamer Labs is one person. What happens if it stops?Your installed copy keeps running until its licence term ends, because the licence is checked on your machine, not against a server. What stops is updates, support, renewals and moving the licence to a new machine. If you need protection beyond that, you can set up a source escrow at your own cost, which releases the source to you only if Reamer Labs becomes insolvent or ends the product.Does my strategy code or data ever leave my machine?No. Reamer Research and Reamer Server run entirely on your own machine, and neither sends strategy code, data, results or orders to Reamer Labs. Their only contact with Reamer Labs is activating or deactivating a licence, which sends the licence key and a one-way hash of the machine's identity. There is no telemetry, no usage analytics and no crash reporting.Have the benchmarks been independently verified?No. No third party has audited the Reamer Research or Reamer Server benchmarks; Reamer Labs ran them itself. What you can check is the method, published as a whitepaper with a DOI, the raw output of every run, also published, and your own hardware, using the benchmark programs that ship in each kit.
Every answer here restates the documents that ship in the kit,
which are authoritative. All questions.
Buy a licence30-day trial or annual licence. Key and kit by email on payment.