Which means the statute we report on reaches us too. That is a fair thing to raise before you spend anything here, and there is no version of answering it that involves us being an exception.
So this page is our own entry. Same scoring functions as every tool in the catalog, same evidence gate on every field, nothing adjusted because it is us. Below our own entry is everything we hold about you, how long we hold it, and how to make us delete it.
Produced by
verification.score_tool() and
sovereignty.assess_sovereignty() — the functions that assess
the catalog — passed through the same to_public_dict()
boundary a vendor's entry goes through. We do not get a wider window into our
own scoring than a vendor gets into theirs.
Until 8 September 2026 this page published a grade, and the grade was a D. We argued that the D was the correct answer — no third-party certifications, no integration surface, and a methodology doing its job by marking us down. That argument was fine. The letter was not, and it came off every vendor in the catalogue on the same day it came off us.
A letter grade is an adjudication. No document anywhere says Vannus is a D — it was our own arithmetic, published in the same voice as the record and indistinguishable from it. The whole claim of this house is that a determination quotes the vendor's own published words with a source and a date. A grade was the one thing here that could never be sourced that way, so it went.
The discipline the grade was carrying survives, and it is the only part that ever mattered: we run ourselves through the same pipeline as everyone else and publish whatever comes out. What comes out now is a jurisdiction determination, and it is worse for us than the D was. Vannus is a US company selling analysis of US legal reach, so the CLOUD Act reaches us exactly as it reaches the vendors we report on. That is quotable, it is dated, it is adverse, and it is about the one question we claim to be expert in. A D on integration count never cost us anything to admit.
PRAXIS AI LLC is a United States company. The CLOUD Act reaches a provider subject to US jurisdiction over data in its possession, custody or control. That includes us. If a US legal process compelled production of a customer's tool list, we would be subject to it exactly as the vendors we grade are. We are not offering a way around that, and any vendor that claims to sell one is worth reading twice.
24 months by default, so the link keeps working and so we can correct the record if we got something wrong. Zero retention is opt-in at checkout rather than the default, and that choice is ours to defend: most buyers want the link to keep resolving, and we would rather that be a decision you make than one we make for you.
Vannus is a small team, and research, product and audit delivery run through one of us. There is no on-call rotation and no acquirer waiting, and our own entry below reflects that. If continuity is part of your vendor review, weigh it — and ask us directly what happens to your report and your data if we stop. We will answer in writing.
Sovereignty fields are researched for some of the catalog, not all of it. Where a field was never established we publish "not assessed" rather than a default, because a default that reads as a finding is how a rating product does real damage to a real company.
| If you | We hold | For how long |
|---|---|---|
| A purchased AI Subprocessor Jurisdiction Report | Your email address, the organization name you gave, the tool list you submitted, the report we generated from it, a salted hash of your IP, and the timestamp at which you accepted the Terms. | 24 months from purchase, then deleted — or 72 hours after delivery if you select zero retention at checkout. Sooner on request either way. |
| A free stack check at /api/stack/rate | Your submission is not written to any database, log or backup, and the response carries Cache-Control: no-store. Your IP sits in an in-memory rate-limit bucket and is purged within minutes. Two global tallies are kept: how often each catalog tool is submitted across all callers, and how often pairs appear together — sums with no timestamp, cost, email or address attached, and a pair is only counted once both tools have already been submitted at least five times by earlier callers — so your submission can never be what makes a pair eligible — and only published once at least five separate submissions contain it. | The submission itself is not retained. The global tallies are cumulative and carry nothing that identifies a caller. |
| A free-tier audit | The same fields as a purchased report. | The share link stops resolving 7 days after creation, enforced by a daily sweep. The underlying row is retained until erased on request — expiry blocks access, it does not delete. |
| A Concierge engagement | Whatever you send us, held in Vannus's operational email account. | The longer of 3 years or what tax and accounting law requires. |
Two routes. At checkout, select zero retention and the erasure happens automatically 72 hours after you first open the report — no email, no waiting on us. Otherwise: email support@vannus.co and ask us to delete your data. We will erase the report, the tool list, the organization name, the email and the IP hash. The Privacy Policy commits to 30 days; the operation itself takes one call, so in practice it happens the day we read the message. Payment records live at Stripe and in accounting, contain no part of your tool list, and are kept as long as tax law requires.
Verbatim from the scoring functions. If the prose above ever disagrees with this block, the block is right.
{
"assessment": {
"assessed": true,
"dimensions_assessed": 4,
"dimensions_total": 6,
"model_provenance_assessed": false,
"single_upstream_dependency": null,
"summary": "Vannus records what Vannus publishes about the entity a customer contracts with, the governing law of its terms, and which model it runs. Each finding on this page is quoted to the vendor's own document, or marked not disclosed where the vendor publishes nothing.",
"tool_name": "Vannus"
},
"sovereignty": {
"country_of_origin": "USA",
"data_jurisdiction": "US",
"is_us_controlled": true,
"training_data_usage": "never",
"us_reach_established": true,
"warnings": [],
"zdr_compliant": false
}
}
If you think anything on this page or anywhere in the catalog is factually wrong — about us or about a vendor we record — the correction route is right of reply. It is free and does not require a lawyer. Our methodology is at structural neutrality.