The Vannus record — who legally controls your AI vendors.

Each assessed entry records the entity you actually contract with, the country that entity is incorporated in, and the law that governs the agreement — facts that bear on which jurisdictions may have legal reach over the vendor and the data it controls. Hosting is where the data sits; control is a separate question, and legal reach can follow control rather than location. Built to be quoted into a DPA, a security questionnaire or a Transfer Impact Assessment.

A second, separate verdict: whether the vendor runs its own foundation model or resells another company's. It is a recorded field, not the point of the record, and the two are never conflated. For 252 tools that determination traces to the vendor's own published documentation — so you can check the claim at the source. A further 69 were established to run no foundation model at all, so there is nothing to cite — that is an answer, not a gap. For 14 the product uses AI and the vendor does not name the provider, and the entry says exactly that rather than a guess. For the remaining 41 we have not established it: 39 of those findings rested on a page from a site whose terms we read as forbidding a scripted read, and 2 on pages the record does not hold, so none is published. We do not claim to know which without having looked.