AI Subprocessor Jurisdiction Report

Know which of your AI vendors can be compelled — and by whom.

Name: AI Subprocessor Jurisdiction Report
Brand: Vannus
Price: 299 USD
Availability: InStock

A dated, source-cited report on your AI stack: which vendors sit within reach of the U.S. CLOUD Act, which resell a single upstream model, and which train on your data by default. Written to be handed to security, legal, or your board.

$299one-time · on screen as soon as payment clears

Where this fits in a AI Subprocessor Jurisdiction Report

The EDPB’s Recommendations 01/2020 set out six steps. This report produces the evidence for two of them — the two that stall most assessments, because the answer is not in your own systems.

1. Know your transfers	Covered, for your AI vendors
2. Identify the transfer tool	Not covered — that is your SCCs or BCRs
3. Assess the third country’s law	This is the report. Who controls each vendor, which jurisdiction can compel disclosure, cited to the vendor’s own documents
4. Adopt supplementary measures	Not covered — encryption, contractual and organisational measures are yours to choose
5. Procedural steps	Not covered
6. Re-evaluate at intervals	Not covered — the record carries the date each document was read, so you re-run it when your own review cycle calls for it

So this is the evidence pack, not the finished assessment. It answers the question your own records cannot — who actually controls the vendor and under whose law — and leaves the transfer tool and the supplementary measures where they belong, with you and your counsel. If you want the whole thing mapped to your own contracts and residency commitments, that is the Concierge audit.

What you get

Every vendor mapped to its origin, controlling jurisdiction, and U.S. CLOUD Act reach
Model ownership per vendor — who builds their own AI and who resells someone else’s. Where a vendor does not publish this, the report says so rather than inferring it
Training-data posture vendor by vendor — who trains on your data by default, who lets you opt out, and who does not say
Each finding traced to the vendor’s own published documentation, or marked “not disclosed” rather than guessed
A print-ready document (browser → PDF) you can attach to a vendor file

How this differs from the free check

The free check tells you which vendors sit within reach. This gives you the sentence in the vendor’s own documentation each finding rests on, and the link to it — so it survives someone asking “says who?”
It is dated and carries its own report ID, so it reads as a record rather than a screenshot.
Of the 376 tools in the catalog, 252 grades cite vendor documentation directly. Where a vendor publishes nothing, your report says “not disclosed” instead of guessing — including when that is the least convenient answer for us.
No vendor can pay for a favourable finding or for placement, in this report or anywhere on this site.

Which one do you need

This report — $299, once. Answers “what is in our stack right now, and who controls it?” A dated, cited document. Buy this if you need a record.
Stack Jurisdiction Review — from $1,500, once. Answers “is the answer we are about to file actually right?” We take 20–40 vendors from your list and establish which of each vendor’s several published agreements applies to a buyer in your position — because the document that comes up first is often the wrong one. Where the answer turns on your own Order Form or MSA, we say so and name the clause to pull rather than guess. Signed PDF and a spreadsheet, every cell dated and quoted. See pricing.
Concierge audit — $7,500, once. Answers “what should we actually do about this?” A person maps the findings onto your contracts, data flows and commitments, and names the vendors whose published terms state what an incumbent’s do not — quoted and dated, never ranked. See Concierge.
They are sequential, not alternatives — the report tells you where you stand, the review checks the answer you are about to put your name on. We would rather you bought nothing than bought the wrong one.

What happens to what you paste

Your tool list, email and organization name are stored so your report can be generated and re-opened at its link. That is the whole purpose we use them for.
Your report lives at an unguessable URL and is marked not-indexable, so it will not turn up in search. Anyone you send the link to can open it — treat it like a shared document, because that is what it is.
We do not sell your stack, share it with vendors, or use it to sell you anything. Ask us to delete it and we will: support@vannus.co.

Get your report

Your AI tools

Paste as many as you like — no cap, and the price does not change. We match them against the 376-tool catalog and tell you exactly what we can and cannot assess before you pay.

Organization

Appears as the title of your report. Optional — if you leave it blank we derive one from your email domain (jane@acme‑financial.com becomes “Acme Financial”). Type something here if you would rather it did not.

Where is your company incorporated?

This is what the report is for. Twenty-nine of the vendors we hold contract through more than one legal entity, split by where the customer is incorporated — and the split is not what most people expect. A UK company contracting with OpenAI signs with a US entity under Irish law. Tell us where you are and we resolve each of those vendors to the entity that actually binds you, quoting the clause so you can check it. Leave it blank and we state the conditions instead of resolving them.

Which plan are you on?

Optional. Some vendors publish different terms for free, paid and enterprise customers, and the training-data answer in particular often changes between them.

We have signed order forms or negotiated agreements with some of these vendors

Say so and we will not pretend otherwise. A negotiated order form outranks the vendor’s published terms — OpenAI’s own conflict clause ranks it above the Agreement, and Google’s entity table carries “unless previously agreed”. Where you have one, the report tells you the published position and that your own paperwork governs, rather than giving you a confident answer from a document that does not bind you.

Zero retention — erase everything 72 hours after delivery

We delete the report, your tool list, your email and your organization name 72 hours after we deliver, and your share link stops resolving. We are a U.S. company, so the CLOUD Act reaches us too — this is the only complete answer to that, because we cannot be compelled to produce a list we no longer hold. Leave it unticked and the report stays available for 24 months. You can ask us to erase at any time either way.

Where should we send it?

Used to deliver your report. No marketing list.

Payment handled by Stripe. Vannus never sees your card details.
No account required.

No vendor can pay for a finding · Every claim cited or marked undisclosed · Try the free check first →