Which means the statute we report on reaches us too. That is a fair thing to raise before you spend anything here, and there is no version of answering it that involves us being an exception.
So this page is our own entry. The same functions that produce every vendor's entry in the catalog, the same evidence gate on every field, nothing adjusted because it is us. Below our own entry is everything we hold about you, how long we hold it, and how to make us delete it.
Produced by
determination.determination_for() (the entry above) and
sovereignty.assess_sovereignty() (the raw block below) — the
functions behind every vendor's entry. We do not get a wider window into our
own entry than a vendor gets into theirs.
Vannus withdrew its grades on 8 September 2026. This page kept its own, a D, one day longer: it came off here on 9 September. We argued that the D was the correct answer — no third-party certifications, no integration surface, and a methodology doing its job by marking us down. That argument was fine. The letter was not. Every place grades stayed live after they were withdrawn, this page included, is dated in We used to grade AI vendors. Here is why we stopped.
A letter grade is an adjudication. No document anywhere says Vannus is a D — it was our own arithmetic, published in the same voice as the record and indistinguishable from it. The whole claim of this house is that a determination quotes the vendor's own published words with a source and a date. A grade was the one thing here that could never be sourced that way, so it went.
The discipline the grade was carrying survives, and it is the only part that ever mattered: we run ourselves through the same pipeline as everyone else and publish whatever comes out. What comes out now is a jurisdiction determination, and it is worse for us than the D was. Vannus is a US company selling analysis of US legal reach, and our own entry says what a US-incorporated vendor’s entry says: within reach of US legal process. That is quotable, it is dated, it is adverse, and it is about the one question we claim to be expert in. A D on integration count never cost us anything to admit.
PRAXIS AI LLC is a United States company. The CLOUD Act reaches a provider subject to US jurisdiction over data in its possession, custody or control. That includes us. US legal process may reach a customer's tool list we hold, as it may reach any vendor we record that is subject to US jurisdiction. We are not offering a way around that, and any vendor that claims to sell one is worth reading twice.
24 months by default, so the link keeps working and so we can correct the record if we got something wrong. Zero retention is opt-in at checkout rather than the default, and that choice is ours to defend: most buyers want the link to keep resolving, and we would rather that be a decision you make than one we make for you.
Vannus is a small team, and research, product and audit delivery run through one of us. There is no on-call rotation and no acquirer waiting, and nothing in our own entry below measures continuity. If it is part of your vendor review, weigh it — and ask us directly what happens to your report and your data if we stop. We will answer in writing.
Sovereignty fields are researched for some of the catalog, not all of it. Where a field was never established we publish "not assessed" rather than a default, because a default that reads as a finding is how a rating product does real damage to a real company.
| If you | We hold | For how long |
|---|---|---|
| A purchased AI Subprocessor Jurisdiction Report | Bought at checkout: your email address, the organization name you gave, the tool list you submitted, the country where your company is incorporated and the country where it is located or billed, how you bought each tool, the report we generated from it, and the timestamp at which you accepted the Terms, with no IP hash. Bought with an access token through POST /api/audit: your email address, the tool list you submitted, any country answers and answers about how you bought each tool sent with it, the report we generated from it, and a keyed hash of your IP in place of the Terms timestamp. | 24 months from purchase, then deleted — or 72 hours after you first open the report if you select zero retention at checkout (our daily deletion can take up to a day longer). Sooner on request either way. |
| A free stack check at /api/stack/rate | Your submission is not written to any database, log or backup, and the response carries Cache-Control: no-store. Your IP sits in an in-memory rate-limit bucket and is purged within minutes. Two global tallies are kept: how often each catalog tool is submitted across all callers, and how often pairs appear together — sums with no timestamp, cost, email or address attached, and a pair is only counted once both tools have already been submitted at least five times by earlier callers — so your submission can never be what makes a pair eligible — and only published once at least five separate submissions contain it. | The submission itself is not retained. The global tallies are cumulative and carry nothing that identifies a caller. |
| A free-tier audit | Your email address if you gave one, the tool list you submitted, the report we generated from it, a keyed hash of your IP, and any other answers sent with it. | The share link stops resolving 7 days after creation, enforced by a daily sweep. The underlying row is kept until the 24-month sweep erases it, or sooner on request — expiry blocks access, it does not delete. |
| A Concierge engagement | Whatever you send us, held in Vannus's operational email account. | The longer of 3 years or what tax and accounting law requires. |
Two routes. At checkout, select zero retention and the erasure happens automatically 72 hours after you first open the report (our daily deletion can take up to a day longer) — no email, no waiting on us. Otherwise: email support@vannus.co and ask us to delete your data. We will erase the whole record, and with it whichever of these it holds: the report, the tool list, the organization name, the email, each country answer, the answers about how you bought each tool, and the IP hash. The Privacy Policy commits to 30 days; the operation itself takes one call, so in practice it happens the day we read the message. Payment records live at Stripe and in accounting, contain no part of your tool list, and are kept as long as tax law requires.
Verbatim from the functions that produce every vendor's entry. If the prose above ever disagrees with this block, the block is right.
{
"sovereignty": {
"country_of_origin": "USA",
"data_jurisdiction": "US",
"is_us_controlled": true,
"training_data_usage": "never",
"us_reach_established": true,
"warnings": [],
"zdr_compliant": false
}
}
If you think anything on this page or anywhere in the catalog is factually wrong — about us or about a vendor we record — the correction route is right of reply. It is free and does not require a lawyer. Our methodology is at structural neutrality.