Who legally controls your AI vendors?
Hosting is where your data sits. Control is which jurisdictions may have legal reach over the vendor holding it — and those are different questions. We record the contracting entity behind an AI vendor, quoted from the document that names it, with its country and the governing law of its terms. Paste your stack and see how many of your vendors contract through a US contracting entity or a US parent — free, no signup.
Our record isn't for sale. We prove it in code · Corrections & right of reply.
What Vannus is
Vannus is the jurisdiction record for AI vendors. It establishes who legally controls the vendor — the contracting entity a customer signs with, that entity's country, and the governing law of its terms — and so which jurisdictions may have legal reach over the vendor and the data it controls. It also records whether the vendor runs its own model, and whether it trains on your data. The catalog lists 376 AI tools; 177 AI vendors carry a contracting record, and a tool not yet assessed says so.
How the record is sourced: a finding says where it came from. 252 of the 376 tools carry a citation to the vendor for which model the product runs. A further 69 were established to run no foundation model at all — 11 of those cited to the vendor, the rest established from what the product is, and labeled that way. For 14 the product uses AI and the vendor does not name the provider, and the entry says exactly that. For the remaining 41 we have not established it: 39 of those findings rested on a page from a site whose terms we read as forbidding a scripted read, and 2 on pages the record does not hold, so none is published. Every tool in the catalog sits in one of those four states. No vendor can pay to change a finding, and there is no paid placement on a record, in the catalog or in search. The modules listed in the neutrality attestation cannot import the affiliate code, and a test fails the build if they ever could.
The free catalog and the stack check cost nothing. A self-serve AI Subprocessor Jurisdiction Report on your own stack is a one-time $299. A Stack Jurisdiction Review, which establishes which of each vendor's published agreements applies to a buyer in your position, starts at $1,500 and is invoiced. A founder-led Concierge audit of a full AI stack is $7,500.
Free check + catalog
Paste your stack and see how many of your vendors contract through a US contracting entity or a US parent, and how many name more than one contracting entity. Or search the catalog of 376 AI tools by name.
AI Subprocessor Jurisdiction Report
A dated record you can hand over. Per vendor: who controls it, the contracting entity, the sentence in the vendor's own documentation each finding rests on (or says where it has not established one), and checks to run against your own agreements.
Stack Jurisdiction Review
20–40 vendors from your own list: which of each vendor's published agreements applies to a buyer in your position. Five business days, invoiced.
Concierge Audit
Founder-led audit of your full AI stack. Delivery planned within 14 days for a stack of up to about 30 tools. Pre-screened intake.