Sample report · an illustrative stack, not a customer

This is the $299 AI Subprocessor Jurisdiction Report, rendered by the code that renders a paid one, for an illustrative stack of four vendors: Neo4j, Mistral AI, DeepL and Hugging Face. Example Co. is a placeholder name, not a customer, and nobody bought this report. The vendors were chosen to show the report’s range: Neo4j contracts through more than one entity; the record gives Mistral AI and DeepL an EU origin and puts Hugging Face under US corporate control; and where the record does not establish a fact, the report says “Not established” rather than filling the cell.

Generated from the live record on 29 September 2026, by the same pipeline and renderer that produce a paid report, with the buyer’s country of incorporation set to the United States. Nothing below this box was written or edited by hand. Each quote with a source link beside it carries a note saying when its document was read, or that the record keeps no read date; a vendor may have changed a document since.

What your own report adds: your own stack, as you list it, with any tool the catalog cannot match named before you pay; and your own country of incorporation, as you give it on the order page. Where a vendor contracts through different entities depending on where the customer is incorporated, your report reads that vendor’s published clause, as the record holds it, against that country: it names the entity the clause selects for that country, or says that it cannot name one.

Get your own report — $299 · Compare what we sell

Vannus · AI Subprocessor Jurisdiction Report

Example Co. (illustrative — not a customer)

Report sample · Generated 2026-09-29 · Rendered 2026-09-29 · 4 vendors assessed against the published Vannus methodology

Executive summary

1 of 4 assessed vendors is under US corporate control. 2 train on your data by default. For 2 of the 4 assessed vendors, who controls them is not established from a cited source, so this report makes no US-control finding about them either way — that is not a clearance. For 1, a US entity contracts in some regions and another elsewhere, so which one binds you depends on your own agreement — read its contracting clause before treating it either way.

under US corporate control

US control not established

contract through more than one entity

in a jurisdiction of concern

single-model wrappers

train on your data by default

data stated to be held outside the US

neither country nor data location established

Vendor assessment

Vendor	Origin · data jurisdiction	US corporate control	Training on your data
Neo4j Binds youNeo4j, Inc. for customers incorporated in all other countries, and for transactions through a cloud-provider (CSP) marketplace	Not established · United States	Region-dependent	Not recorded
Mistral AI Binds youMistral AI (SAS), RCS Paris 952 418 325	France · —	Not established	Trains on your data unless you opt out, on the default plan
DeepL Binds youDeepL SE	Germany · European Economic Area	Not established	Trains on your data by default, with no published opt-out
Hugging Face Binds youHugging Face, Inc., a Delaware corporation	United States	Yes	Not recorded

What changes on a paid plan

For the vendor below, the paid-plan answer differs from the default-plan answer shown in the table above. We publish this only where the vendor states it in a document we can quote and link, so the list is shorter than your stack.

DeepL — On DeepL Pro, the vendor states it does not train on your data; on retention: “DeepL will only temporarily store Content or Processed Content to the extent technically required to provide its Services.”, which is not a zero-retention commitment. From the DeepL Pro page FAQ (“How does DeepL secure my data as a Pro subscriber?”), which names Pro subscribers and not API Pro or Write Pro separately: “For Pro subscribers, DeepL temporarily stores both original content and processed results only as technically needed to provide its services and deletes it afterward unless otherwise specified. Additionally, it's never used to train DeepL's AI models.” source ↗ · no read date recorded for this quote

One caution. A negotiated contract overrides all of this; these are published default terms for the named plans, not your signed agreement. Where the two disagree, yours governs.

How to read this report

What this report is, and what it is not. The EDPB’s Recommendations 01/2020 set out six steps. This report is evidence for two of them, so far as its records go: step 1, knowing your transfers to these AI vendors; and, for step 3, assessing the third country’s law, who controls each vendor, and so which jurisdictions may have legal reach over it and the data it controls. It is not the finished transfer assessment. The transfer tool (your SCCs or BCRs) and any supplementary measures are for you and your counsel.
“Not recorded” means we hold no answer for that field in the default-plan column. It is a gap in our records, not a finding about the vendor: the vendor may publish an answer we have not yet read. Ask them, and tell us, and we will research it.
“Not assessed” means we have not yet researched that vendor against a citable source. We say so rather than filling the cell with a default, because a default that reads as a finding is how false claims get published about real companies.
Vendors with no catalog match are not assessed at all. Any such names were listed to you before payment.
Every quote with a source link beside it traces to the document that link opens. Where the training column states a posture, that posture is curated research, not a quote; a cell reading “Not recorded” is a gap in our records. No vendor pays for a finding, for placement, or to be excluded.
Training and retention posture is per plan. Every posture in the table describes the vendor’s default plan, which is what their public documentation covers. Where we located a vendor’s paid-plan terms and could quote them, they appear under “What changes on a paid plan”. Enterprise, team and API agreements frequently differ — often materially, and sometimes in the opposite direction — and a negotiated contract can override the published default entirely. If you are on a business plan with any vendor listed here, treat that row as the consumer baseline and confirm your own terms.
On U.S. CLOUD Act reach. We report US corporate control, which is what we can evidence from published documents. The statute itself reaches a provider subject to U.S. jurisdiction over data in its possession, custody or control — a broader test than ownership, which a company founded elsewhere can meet by contracting through a U.S. entity or running substantial U.S. operations. Read this as a starting point for your own review rather than a legal determination, and take advice on anything that matters.
Vendor facts change without notice. This copy was rendered on 2026-09-29 from our records as they stood then. Each quote with a source link beside it carries its own dating note; a vendor may have changed a document since we read it.
Found something wrong, or want a missing vendor researched? Reply to the delivery email or write to support@vannus.co. Corrections are free and we would rather fix an entry than have you quietly doubt the rest.

What this means

Jurisdictional exposure. The U.S. CLOUD Act (18 U.S.C. § 2713) requires a provider subject to U.S. jurisdiction to meet U.S. legal process for data in its possession, custody or control, wherever that data is stored. A vendor incorporated in the United States is subject to that jurisdiction. For a vendor controlled from the United States through a parent, whether U.S. law may have legal reach over the vendor and the data it controls depends on that control and on the circumstances, which this report does not decide. EU or in-region hosting does not by itself remove a U.S. corporate parent from that reach. Vendors listed above with “Yes” should be reviewed against your own data-residency and transfer commitments.
Training-data posture. Where a vendor trains on customer data unless you opt out, the opt-out has to be engaged on the account and recorded in your DPA — it is not on by default. Where the table says no published opt-out, there is nothing to engage: the only controls are what you can negotiate into a contract, restricting what goes into the product, or replacing it. Advice to “engage the opt-out” does not apply to those vendors, and the per-vendor actions below say so individually.
For 1 of the assessed vendors a US entity contracts in some regions and another elsewhere. Which one binds you is in your own agreement — read its contracting clause and governing law before treating this stack as clear.

Model provenance — the published words each finding rests on

Mistral AI

Today, we announce Mistral 3, the next generation of Mistral models.mistral.ai ↗ · quote re-checked 14 Sep 2026

DeepL

We built it on a specialized LLM architecture and years of proprietary translation data.deepl.com ↗ · quote re-checked 14 Sep 2026

Hugging Face

Easily run models from top-tier providers like fal, Replicate, Together AI, and others.huggingface.co ↗ · quote re-checked 14 Sep 2026

1 of the vendors above runs no foundation model at all — infrastructure, a library, a database — so the question does not apply to them and is recorded as not applicable rather than counted against them.

Jurisdiction — the contracting documents

Neo4j ● DEPENDS ON YOUR LOCATION — Two contracting entities, split by where the CUSTOMER is incorporated: Neo4j Sweden AB for customers incorporated in Europe, the Middle East, Africa, China and Singapore; Neo4j, Inc. for customers incorporated in all other countries, and for transactions through a cloud-provider (CSP) marketplace. An Order Form or SOW may name a different entity, which takes precedence. · Swedish law with exclusive jurisdiction in the courts of Malmö, Sweden (Neo4j Sweden AB); California law with exclusive jurisdiction in the state and U.S. federal courts in Santa Clara, California (Neo4j, Inc.)
This vendor contracts through more than one entity, selected by where you are or how you bought. Do not read one entity as the answer. The clause below states the split; confirm which limb applies to you before citing it.

“Governing Courts” and “Governing Laws” mean for customers contracting with Neo4j Sweden AB, the Governing Laws are Swedish law with exclusive jurisdiction in the courts of Malmö, Sweden; and for customers contracting with Neo4j, Inc., the Governing Laws are the laws of California with exclusive jurisdiction in the state and U.S. federal courts located in Santa Clara, California. ... “Neo4j Contracting Entity” means (i) the entity specified in an Order Form or SOW; (ii) Neo4j Inc. for transactions through a CSP marketplace; (iii) Neo4j Sweden AB for Customers incorporated in Europe, Middle East, Africa, China and Singapore; or (iv) Neo4j, Inc. for Customers incorporated in all other countries. source ↗ · clause re-checked 17 Sep 2026
read from terms of service · inferred from the address, not the heading
Mistral AI — Mistral AI (SAS), RCS Paris 952 418 325 · French law / Paris courts by default; California law and Santa Clara County courts for Americas customers; Singapore law for APAC
a French limited joint-stock corporation, incorporated in Paris, under number 952 418 325 source ↗ · clause re-checked 17 Sep 2026
read from terms of service
DeepL — DeepL SE · the law of England and Wales, with any mandatory statutory consumer regulations of a consumer's country of residence left unaffected
DeepL SE, Maarweg 165, 50825 Cologne, Germany (“DeepL”) specialises in services based on machine learning, e.g., machine translation services, and provides its online services at deepl.com. ... 1.11 “Customer” refers to the person or entity ordering or subscribing to the DeepL Services as the contracting party of DeepL. source ↗ · clause read 26 Sep 2026
read from terms of service
Governing law · law read 16 Sep 2026
Hugging Face — Hugging Face, Inc., a Delaware corporation · Law of the State of New York, excluding its choice of law rules
In other words, these Terms are a binding agreement between us, Hugging Face, Inc. a Delaware corporation ("Hugging Face", "Company", "us", "we"), and You, whether you are a user ("User", "You") or a customer ("Customer", "you"). source ↗ · clause re-checked 17 Sep 2026
read from terms of service

These are the clauses behind the US-corporate-control column in the table above.

Country — the documents behind it

Neo4j
Where data is stored — US
By agreeing to the terms governing the Sites and/or Neo4j Products and this Privacy Notice, you consent to the transfer of your Personal Data to the United States of America, and to the processing of that information by Neo4j on servers located in the United States of America as described above. source ↗ · read 15 Sep 2026
read from a privacy notice
Mistral AI
Origin — FRA
MISTRAL AI — jurisdiction of registration FR, registered address country FR source ↗ · read 13 Sep 2026
read from the global LEI register (GLEIF)
DeepL
Origin — DEU
DeepL SE — jurisdiction of registration DE, registered address country DE source ↗ · read 15 Sep 2026
read from the global LEI register (GLEIF)
Where data is stored — EEA
With both DeepL Pro and DeepL Translator, the translation of your documents will be provided exclusively by DeepL and processed on our infrastructure in the EEA. source ↗ · read 15 Sep 2026
read from a privacy notice
Hugging Face
Origin — USA
In other words, these Terms are a binding agreement between us, Hugging Face, Inc. a Delaware corporation ("Hugging Face", "Company", "us", "we"), and You, whether you are a user ("User", "You") or a customer ("Customer", "you"). source ↗ · read 14 Sep 2026
read from terms of service
Where data is stored — US
LOCATION OF PROCESSING AND DATA TRANSFERS The Company and its servers are located in the United States. source ↗ · read 14 Sep 2026
read from a privacy notice

These are the sources behind the country columns in the table above: the vendors’ own sentences, or, where the line says so, GLEIF register fields in our words. Where a line names the kind of document, that is what the sentence was read from: terms of service bind a self-serve buyer, while an enterprise agreement may name a different entity entirely.

Per-vendor actions

Neo4j
- read the contracting-entity clause and the governing law in your own agreement, because this vendor contracts through more than one entity and which one binds you decides the answer.
Mistral AI
- engage the training opt-out in writing and record it on the account.
DeepL
- check which plan you are on before acting — the default plan trains with no published opt-out, but the vendor states in writing that it does not train on DeepL Pro; on the default plan, move the seats to those plans, or treat the controls as contractual and operational.
- the vendor’s own retention words are “DeepL will only temporarily store Content or Processed Content to the extent technically required to provide its Services.”, which is not a zero-retention commitment — ask the vendor in writing if you need one.
Hugging Face
- confirm what your DPA and customer commitments promise about jurisdiction, since in-region hosting does not remove a US parent.

Recommended next steps

Confirm the exposure list against your contracts. For each vendor marked under US corporate control, check what your DPA and data-residency commitments actually promise your own customers and regulators.
When you answer for these vendors. When a customer’s DPA or sub-processor annex, a security questionnaire or an auditor asks about them, cite the quoted line a finding rests on and the document its link opens. A line read from the GLEIF register gives that register’s record fields in our words, so cite the register record, not the line. Where a finding has no quote beside it, this report holds no quoted source for you to cite. Re-verify a row before citing it: the note beside each linked quote says when its document was read or re-checked and what that found, or that the record keeps no read date, and a vendor may have changed a document since. Where a quote’s note reads “no read date recorded for this quote”, re-read the document its link opens before you cite it. What your agreements commit you to, and whether to object to a sub-processor, are for you and your counsel.
Engage opt-outs where training is on by default. Verify per account, in writing, and record it.
Re-check on ownership change. Acquisition changes jurisdiction without changing the product. A vendor built and hosted in-region can come under U.S. control overnight.

Methodology and scope. Vendors are assessed against the published Vannus methodology using catalog records as they stood on 2026-09-29, the date this copy was rendered, and publicly available vendor documentation, as read on the dates, and with the results, noted beside each linked quote. Vannus publishes no grade, score, tier or ranking. A letter grade and a five-band tier appeared in reports generated before 8 September 2026 and were withdrawn on that date; if you hold an earlier report, those figures no longer stand. Each quote with a source link beside it is taken from the document that link opens: usually the vendor’s own, sometimes another publisher’s, such as a model provider’s customer page or a parent company’s page; where the line says it was read from the GLEIF register, the line gives that register’s record fields in our words. Beside each is a note on when it was read or re-checked and what that found, or that the record keeps no read date. A finding shown without a quote beside it — the training column’s default-plan posture among them — was recorded from curated research rather than a quotable sentence. A cell reading “Not recorded” is a gap in our records, not a finding about the vendor. Statements that a vendor sits “within reach of” a legal regime describe that vendor’s apparent corporate or jurisdictional structure as an informational matter. They are not legal advice, not a legal conclusion, and not a representation that any government has taken or will take any action. This report is not a substitute for advice from your own qualified counsel. Vendors not found in the Vannus catalog are marked not assessed, which is never a negative finding.

Vannus is operated by PRAXIS AI LLC. No vendor can pay for a finding, a ranking, or inclusion. Full terms: vannus.co/terms