How Vannus establishes who legally controls an AI vendor, and records it
For each vendor we establish, from that vendor’s own published documents, three things: the legal entity a customer contracts with, that entity’s country, and the governing law of its terms. Where the vendor publishes what model it runs, we record that too, quoted the same way.
Each determination travels with the sentence it came from, the URL it was read at, and the date it was read. Where a vendor publishes nothing on a question, the record says not disclosed — which is never a negative finding about the vendor, and is not the same as an answer.
A quote is the vendor’s words, not our summary of them. Two strictnesses apply, and conflating them is how a paraphrase once shipped inside quotation marks:
Every row is re-read on a schedule against two instruments. Only a match advances the date a reader is shown. A page we could not read is recorded unreadable, never as confirmation; a refusal to one HTTP client is not treated as a fact about the document, so a second client asks in its own name before anything is recorded as unreadable.
The date beside a determination is the date the quote was last confirmed present, not the date we first captured it.
A page sometimes carries the vendor’s own notice that its terms have been replaced — a successor announced, its date already passed, above text dated earlier. The record reports that as a finding, above the clause, saying that what the vendor served may not be what governs.
It is named for the vendor’s admission rather than for our doubt. It is rare by design: three conditions must hold, and a leftover banner sitting above current terms does not qualify.
A vendor may contract through several entities, selected by where a customer is incorporated, where they are located, or how they bought. 30 of the 160 vendors whose contracting entity we have established contract through more than one. Those rows carry a flag telling the reader not to treat one entity as the answer, and the clause quoted beneath it states the split.
That count is over our own record. It was not drawn as a representative sample, so it is a fact about what we have read closely rather than a claim about the market.
Vannus does not publish a composite score, a letter grade, or a tier name, and does not rank vendors against one another. Those were removed in September 2026. A single character cannot carry a finding like a four-branch contracting clause, and a band derived from weights we do not publish is an adjudication of a named company that no reader can check.
What replaced it is the thing a buyer can act on: the document, the sentence, the date, and an honest statement of what we could not establish.
A Caution Flag is the one adverse marker Vannus places against a vendor. Because it is a claim about a named company, the criteria are published here and it may be raised on nothing else:
A fourth criterion, “predatory pricing patterns”, was published here until 9 September 2026 and has been withdrawn. The three above each rest on a document — a disclosure, a sanctions listing, a regulator’s order. Predatory is an adjudication this house would be making about a lawful commercial practice, and no document says a price is predatory. It was never raised against any company. It is named here rather than quietly deleted because a criterion that was published is a claim this house made about how it judges vendors, and withdrawing it silently would leave a reader of the earlier page with no way to know.
Every vendor card states a determination: the contracting entity, quoted from the vendor’s own published terms with a source and a date, and — where it follows — one consequence. The consequence is derived from the fact by this rule, and the rule is published here so that anyone can reproduce it:
A provider subject to US jurisdiction must produce data in its possession, custody or control wherever that data is located (CLOUD Act, 18 U.S.C. § 2713). A US-incorporated contracting entity is such a provider. A non-US contracting entity is within reach where a US parent has control of the data, and is not thereby beyond reach where that control has not been established.
That reproducibility is the whole difference between this and the letter grade it replaced. A grade came from weights we did not publish, so a reader could not check it and an auditor could not use it. A determination is a quoted fact plus a stated rule: both halves are in front of you, and if you think the rule is wrong you can say so with something specific.
The test is control, not incorporation, and that is why the record carries two facts and not one. Who you contract with, and who controls that entity. A US parent that can instruct its Irish subsidiary to produce data has control of that data even though the data never leaves the EU — so knowing the contracting entity does not, on its own, settle whether the US can compel it.
Where the contracting entity is US-incorporated, contract and control coincide and the card says so. Where it is not, the card states the entity, its governing law, and what we have established about the parent: either that the entity is under US corporate control — and therefore within reach through that control — or that we have not established whether a US parent controls it, in which case US reach is not established either way.
The rule still runs one way. We never publish that a vendor is beyond US reach. Absence of an established parent is absence of a finding, not a finding of absence.
The sentence ends at what you can cite, not at what you should do. The same determination is unremarkable to a US buyer and a problem for an EU one; which it is for you depends on your obligations, and that is yours to decide. Vannus is not your lawyer and this is not legal advice.
Where the entity depends on your region or your order form — 30 of the 163 vendors determined so far — the card says so and points at the clause, because there is no single answer to give you.
Each of those is an event with a source. A flag is never raised from a country of incorporation, a company’s size, or an inference about its architecture. An earlier version of this framework did exactly that — a badge reading “High-Risk Supply Chain Detected” was reached from a country code alone, on vendors where nothing had been detected — and the rule above exists so it cannot recur.
Vendors who believe a flag is wrong can use the right of reply: we correct the entry within five business days where you are right, and publish your response beside the record where we disagree.
Affiliate partnerships live in a separate layer. A build test fails if any module on the published neutrality list imports it, and no vendor can pay for what its entry says.
This page says what counts as a quote and what a date means, and the rule that derives US legal reach from a finding is published here, so anyone can reproduce it. No weighting goes into a determination, so there is none to reverse-engineer.
Our fetcher has honored robots.txt since 7 September 2026.
Before that date it did not check one, so on 8 September we audited every source
path we hold: none of the 338 we could resolve was disallowed to us. On ten, the
site’s own robots.txt could not be read (403 or server error) and the
path is therefore undetermined rather than permitted — those pages are now
recorded unreadable and are not fetched until the file answers. We read with two
HTTP clients under their own default user-agents and do not present
ourselves as a browser.
We record open-source and proprietary tools to the same evidence standard.
The date beside a determination is the date its quote was last confirmed present, not the date we first captured it.
We run our own entry through the same pipeline as every vendor’s and publish what comes out.
A catalog that competes on raw count answers the wrong question. The question this record exists for is narrower and checkable: for a vendor you already run, which legal entity do you contract with, and whose law reaches the data it holds?
Vannus is built around that question. The catalog is curated — not encyclopedic — because curation requires editorial judgment that a longer list cannot provide. The methodology is published, because readers checking our work is part of how trust gets earned. The Caution Flag is named accordingly: it warrants buyer caution based on uniformly applied criteria, not blanket verdicts on individual vendors.
Independence is structural, not aspirational. Vannus does not run paid placements, sponsored rankings, or vendor advertising. We charge buyers (reports and audits) instead of vendors (placements). What a Vannus entry says rests on the documents it cites — not on what a vendor paid.
Vannus maintains affiliate partnerships with some tools in our database. These partnerships are kept apart from the modules on the published neutrality list by a test, not by a policy.
The wall: The affiliate registry and the monetization layer sit in praxis.affiliates and praxis.monetise. A test in the build follows the imports of every module on the neutrality list, directly and through any other module, and fails if any of them reaches either one. The list, and the live result, are published on that page.
Verification: Vannus publishes no score, so there is no weighting to recompute. If you question whether a partner vendor received favorable treatment, check its entry against the documents it cites.
Full disclosure: See our Partners & Transparency page for the commercial relationships Vannus discloses.