How Vannus makes money — and what it never touches.
Vannus is the jurisdiction record for AI vendors, built around an evidence-gated methodology — where a vendor's own published documents say which company you contract with and under whose law, we record it, quoted and linked to the source. No vendor can pay to change a finding, and there is no paid placement on a record, in the catalog or in search. We can earn commissions through affiliate links to some of the vendors we record. Every one of those links is on this page, disclosed on the partner’s card, and this page explains how that revenue is kept away from the code that builds a record.
Vannus charges for reports and audits, whoever buys them.
Vannus also has affiliate relationships with some of the vendors it records. They are listed in full below. When you sign up for a tool through a partner link on this page, we may earn a commission.
Here's what that means and — more importantly — what it doesn't mean.
Each finding in a record is quoted to its source and dated, or marked not disclosed where the vendor publishes nothing, so it can be checked against the vendor's own documents. The methodology page explains how a record is built, and the neutrality attestation lists the modules that do not import the affiliate code, and the test that fails the build if one of them does, directly or through the modules it imports in turn, including through a package’s __init__ file. If you think a partner vendor's record is wrong, the corrections process is free and open to anyone.
In the catalog by 12 March 2026, before Vannus joined its partner program on 30 March 2026.
See its record →Added to the catalog on 31 March 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 6 June 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 6 June 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 5 May 2026, in a batch made while partner sign-ups were under way; Vannus joined its partner program on 6 June 2026.
See its record →Added to the catalog on 6 June 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 30 April 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 12 April 2026, when Vannus joined its partner program.
See its record →In the catalog by 12 March 2026, before Vannus joined its partner program on 6 June 2026.
See its record →Added to the catalog on 9 April 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 5 May 2026; Vannus joined its partner program on 7 May 2026.
See its record →Added to the catalog on 30 April 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →In the catalog by 12 March 2026, before Vannus joined its partner program on 22 July 2026.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →Added to the catalog on 22 July 2026, when Vannus joined its partner program.
See its record →If we ever discover that an affiliate relationship has influenced a record — through a bug, a bias in the data, or a human error — we will disclose it publicly on this page, correct the record, and terminate the partnership if the conflict cannot be resolved.
A record that a vendor's money could change is not one a buyer can rely on. That is why commission links stay on this page, disclosed on each partner's card, and are kept off every page that shows a record.
14 October 2026. We read the partner vendors’ own documents again, where our rules let a script read them, and two have values back, each beside the vendor’s own words. Dify’s privacy policy says it does not use your AI interaction data to train models, and its data processing addendum says it undergoes annual SOC 2 Type II and ISO 27001 audits; none of its documents we read claims GDPR compliance, so that stays off. folk’s privacy policy says it does not use personal data to train AI models and that it is committed to comply with the GDPR, and its site states SOC 2 audited controls. Both had been typed as training on your data unless you opt out, which their own documents contradict. The rest stay withdrawn. For five vendors, the documents we read state no training posture and claim none of the standards that were listed. For seventeen, a script does not read the site at all, because the vendor’s own terms forbid it or because we hold the site until its terms are read by hand.
13 October 2026. The catalog entry of every vendor on this page, and of Dry Ground AI, listed compliance standards such as SOC 2 and GDPR, and eighteen of them a training posture (BILL and Foxit PDF Editor that they never train on your data, the others that they do unless you opt out). No quote or source stood behind any of them; for most, they were typed in when the vendor entered the catalog with its partner program, and they were shown as if researched. They are withdrawn. A partner vendor’s record states either again only with a quote from a published document.
8 October 2026. Three cards on this page said where a vendor is based, which is not what Vannus’s record establishes, and one described how a vendor handles your email, which no record of ours shows. folk contracts as Folk Inc., a Delaware corporation; Printify contracts as Printify, Inc., at an address in Wilmington, Delaware, and states no place of incorporation; Notify Me publishes no contracting entity, and its terms choose the law of British Columbia. SaneBox’s card and catalog entry said it processes message headers rather than full message contents. Those words are gone, and each card now links to the vendor’s record.
29 September 2026. From 30 July 2026 until this correction, the model-provenance source link on Turbotic’s tool page carried the PartnerStack parameters that Turbotic’s partner link redirects with (the partner key itself was cut to “...”); it now links to the same Turbotic page without them. Turbotic’s sub-processor record was built from a walk on 16 September 2026 that started at that partner link, which was then Turbotic’s catalog address. That page returned almost no text, so the record established nothing, and nothing from it is shown on vannus.co. The record still rests on that walk: it is marked for re-reading from turbotic.com, whose terms must be read by hand first.