For each AI tool you list that we assess: who controls the vendor and which company you sign with, where our records establish them.

AI Subprocessor Jurisdiction Report

Know which jurisdictions may have legal reach over your AI vendors — and the data they control.

Name: AI Subprocessor Jurisdiction Report
Brand: Vannus
Price: 299 USD
Availability: InStock

A dated, source-cited report on your AI stack: whether each vendor is under US corporate control (which may bring it within U.S. CLOUD Act reach), who contracts with you and under which law where the record holds them, which resell a single upstream model, and which train on your data by default. Written to be handed to security, legal, or your board.

$299one-time · on screen as soon as payment clears

Where this fits in a Transfer Impact Assessment

The EDPB’s Recommendations 01/2020 set out six steps for a transfer of personal data to a third country. This report supplies part of the evidence for two of them, for the AI vendors it assesses and so far as our records go: facts about each vendor, drawn from its own documents, a public register or our curated research rather than from your systems. The assessment itself is yours and your counsel’s.

1. Know your transfers	Partly. For each AI vendor you list that we assess: the entity its published terms name, the vendor’s country of origin, and where the vendor says data is stored, where our records hold them. Mapping which personal data you send each vendor, and where it goes from there, is yours.
2. Identify the transfer tools you rely on	Not covered. Whether you rely on an adequacy decision, SCCs, BCRs or another tool is yours to identify.
3. Assess whether the Article 46 transfer tool you rely on is effective, in light of the third country’s law and practice	Partly. The report supplies inputs: who controls each vendor, the entity its published terms name and the law that governs them, and so which jurisdictions may have legal reach over it and the data it controls, each cited where our records hold a source. Beyond stating what the U.S. CLOUD Act provides, it does not assess any country’s law or practice, or whether an Article 46 transfer tool is effective; that is yours and your counsel’s.
4. Adopt supplementary measures	Not covered. Technical measures such as encryption, and contractual and organizational measures, are yours and your counsel’s to choose.
5. Procedural steps	Not covered
6. Re-evaluate at intervals	Not covered. Re-evaluating at intervals is yours. The note beside each linked quote in the report says when its document was read or re-checked, or that our records keep no read date for it.

So this is part of the evidence, not the assessment. It records facts about each vendor, drawn from its documents, a public register or our curated research rather than from your systems: who controls the vendor, the entity its published terms name and the law that governs them, where our records hold them. Identifying your transfer tool, assessing it where it is an Article 46 tool, and choosing any supplementary measures stay with you and your counsel. If you want these findings mapped to your own contracts and residency commitments, that is the Concierge audit.

What you get

Every vendor mapped to its origin and to whether it is under US corporate control (which may bring it within U.S. CLOUD Act reach), with the contracting entity and governing law where the record holds them
Model ownership per vendor — who builds their own AI and who resells someone else’s. Where a vendor does not publish this, the report says so rather than inferring it
Training-data posture vendor by vendor — who trains on your data by default, who lets you opt out, and who does not say
Each finding traced to the vendor’s own published documentation, or marked “not disclosed” rather than guessed
A print-ready document (browser → PDF) you can attach to a vendor file

How the quotes on who controls a vendor are kept. Of the 177 records on who legally controls a vendor, 176 quote a document and link to it. Our checker re-checks a quote against its document only when we run it by hand; nothing runs it on a schedule. Its last run was on 19 October 2026; that day, 58 of today's 176 quotes were found again in the document they link to. Of the rest, for 112 the checker did not fetch the page, because we read the site's terms as forbidding a scripted read or its own rules held the page back; for 4 the checker got no readable page; 1 links to a dated archive copy, which the checker does not fetch; and for 1 the checker's reading was unreliable, so no result is recorded. Across all 176 quotes, the checker cannot re-check 113: 82 link to pages on sites whose own terms, as we read them today, forbid a scripted read, and its own rules hold back 31 more, such as pages on a site whose terms we have not yet ruled on. Of the 58 found again, 58 link to pages it may still read.

What the report adds to the free pages

The free pages come first. Every vendor record on this site is free to read: the determination, the contracting entity, its country, the governing law, and a link to the document each comes from, where the record holds them. The free check tells you how many of your vendors contract through a US contracting entity or a US parent on a cited record. If you need those facts for a few vendors and nothing to hand to anyone, read the pages; you do not need this report.
The clause, in the vendor’s words. A record page gives the finding and links its document. The report quotes the clause each finding rests on, for each vendor in your stack where the record holds one, beside the link and the date its document was read, where the record keeps one — so it survives someone asking “says who?”
The entity that binds you. Where a vendor contracts through more than one entity, its record page says so and points at the clause. The report reads the vendor’s clause against your answers on this page and names the entity it selects for you, or says that it cannot name one.
Your whole stack in one document. Every tool you list, matched against the catalog, with any name we cannot match shown to you before you pay, and a summary across the stack: how many contract through a US entity or a US parent, and how many train on your data by default.
A record that holds still. It is dated, carries its own report ID, and is stored as delivered, so it reads as a record rather than a screenshot: if a vendor’s record changes later, your copy does not. If it contains a factual error about a vendor, tell us and we correct the record and reissue the report at no charge (Terms §12.12.5), unless you chose zero retention and it has been erased; a reissued report says it was reissued.
Of the 376 tools in the catalog, 252 cite vendor documentation directly. Where a vendor publishes nothing, your report says “not disclosed” instead of guessing — including when that is the least convenient answer for us.
No vendor can pay to change a finding, and there is no paid placement on a record, in the catalog or in search. Some links elsewhere on the site are affiliate links and are disclosed where they appear; no finding depends on them.

Which one do you need

This report — $299, once. Answers “what is in our stack right now, and who controls it?” A dated, cited document. Buy this if you need a record.
Stack Jurisdiction Review — from $1,500, once. Answers “is the answer we are about to file actually right?” We take 20–40 vendors from your list and establish which of each vendor’s several published agreements applies to a buyer in your position — because the document that comes up first is often the wrong one. Where the answer turns on your own Order Form or MSA, we say so and name the clause to pull rather than guess. Signed PDF and a spreadsheet, every cell dated and quoted. See pricing.
Concierge audit — $7,500, once. Answers “what should we actually do about this?” A person maps the findings onto your contracts, data flows and commitments, and names the vendors whose published terms state what an incumbent’s do not — quoted and dated, never ranked. See Concierge.
Each answers a different question, so buy the one that answers yours — the report tells you where you stand, the review checks the answer you are about to put your name on. We would rather you bought nothing than bought the wrong one.

What happens to what you paste

Your tool list, email, organization name, the country where your company is incorporated, the country where it is located or billed, and how you bought each tool are stored so your report can be generated and re-opened at its link. That is what we use them for.
Continuing to checkout saves these before payment; if you do not pay, we erase them after 30 days.
Where a vendor’s entity turns on them, your answers appear in your report, and anyone with its link can see them.
Checking your list before payment keeps no copy of it.
Your report lives at an unguessable URL and is marked not-indexable, so it will not turn up in search. Anyone you send the link to can open it — treat it like a shared document, because that is what it is.
We do not sell your stack or share it with vendors. Ask us to delete it and we will: support@vannus.co. Transactional emails about your order, such as the one that delivers your report, may mention Vannus’s other services.

Get your report

Your AI tools

Paste as many as you like — no cap, and the price does not change. We match them against the 376-tool catalog and tell you exactly what we can and cannot assess before you pay.

Organization

Appears as the title of your report. Optional — if you leave it blank we derive one from your email domain (jane@acme‑financial.com becomes “Acme Financial”). Type something here if you would rather it did not.

Where is your company incorporated?

The country under whose law your company was formed. A US company can give its state, such as Delaware.

Where is your company located or billed?

The country of your principal place of business. Some vendors choose by billing address or account country instead; we read this answer for those too, and the report says where it did.

This is what the report is for. Thirty-one of the vendors we hold contract through more than one legal entity. Where our record holds the clause that chooses between them, some choose by where the customer is incorporated, most by where it is located or billed. A UK company contracting with OpenAI signs with a US entity under Irish law. Answer both and we resolve each of those vendors, where its clause lets us, to the entity that binds you, quoting the clause so you can check it.

Zero retention — erase your report and what it was built from 72 hours after you first open it, or up to a day later

We delete the report, your tool list, your email, your organization name, both country answers and how you bought each tool 72 hours after you first open the report (our daily deletion can take up to a day longer), and your share link then stops resolving. If you never open it, we erase it 30 days after it is produced (or up to a day later). The payment record, which holds your email and billing details but no part of your tool list, is kept as tax law requires. A checkout you started and did not pay for, such as one you backed out of at Stripe, is a separate record; we erase it after 30 days. We are a U.S. company, so U.S. law may have legal reach over us too; a list we have deleted is a list we no longer hold. Leave it unticked and the report stays available for 24 months. You can ask us to erase at any time either way.

Where should we send it?

Used to deliver your report. No marketing list.

Payment handled by Stripe. Vannus never sees your card details.
No account required.

No vendor can pay to change a finding · No paid placement on a record, in the catalog or in search · Every claim cited or marked undisclosed · Try the free check first →