Black Forest Labs
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Freiburg-based German image-generation lab (FLUX models, Stable Diffusion creators), but heavily US-VC-funded; open-weight FLUX [schnell] under Apache 2.0.
Black Forest Labs offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.
Assessment notes
Black Forest Labs (Freiburg, Germany, with an additional SF lab) is the FLUX-model company founded in 2024 by the Stable Diffusion core team (Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, Bjorn Ommer), ISO 27001 certified and produces open-weight image-generation models (FLUX.2 max/pro/flex/klein, plus historical FLUX [schnell] Apache 2.0 and FLUX [dev] non-commercial), but the cap table is dominated by US capital (Andreessen Horowitz, Salesforce Ventures, General Catalyst, NVIDIA, Anjney Midha AMP) after a US$31M seed (Aug 2024) and US$300M Series B at US$3.25B valuation (Dec 2025); Temasek (SG) is the only non-US institutional. EU-HQ, ISO 27001:2022 and SOC 2 Type II certified, but eu_hq_us_funded with material CLOUD Act exposure for the managed API; no public DPA URL and no sub-processors list, although a DPA and vendor-assessment materials are available on request. Self-hosted FLUX [schnell] on EU GPU infrastructure eliminates CLOUD Act exposure.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Black Forest Labs
Black Forest Labs is the German image-generation research lab founded in 2024 by the core team behind Stable Diffusion (Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer) whose 2022 paper "High-Resolution Image Synthesis with Latent Diffusion Models" (originating from Ludwig-Maximilians-Universität München and Heidelberg University) underpinned the entire current diffusion-models wave. The company is headquartered in Freiburg, Germany (with an additional research lab in San Francisco). The product surface is the FLUX family of image-generation models: the current generation includes FLUX.2 [max], [pro], [flex], and [klein]; previous-generation FLUX [schnell] is published under Apache 2.0 and is freely usable commercially; FLUX [dev] is non-commercial-research-licensed; and FLUX [pro/max] are commercial-API-only.
For an EU-sovereignty audit Black Forest Labs is structurally a Mistral-AI-like case: German legal-entity HQ + DE-origin founders + ISO 27001 certification + open-weight model strategy + a research-and-licence model that supports self-hosting on EU GPU infrastructure, versus a cap table that is dominated by US capital. The seed round in August 2024 raised US$31M led by Andreessen Horowitz with General Catalyst, Mätch.vc, Garry Tan, Brendan Iribe, Michael Ovitz, and NVIDIA's Timo Aila. The December 2025 Series B raised US$300M at a US$3.25B post-money valuation co-led by Salesforce Ventures and Anjney Midha (AMP), with a16z, NVIDIA, General Catalyst, and Temasek participating; total raised US$450M. The single non-US-non-DE investor of any size is Temasek (Singapore sovereign wealth fund). Per the directory's strict-ownership stance this US-funded weighting is eu_hq_us_funded, and CLOUD Act exposure for the managed API is recorded as Material. The API hosting itself is still not publicly disclosed: no region, country, cloud provider or sub-processor is named anywhere public, and the managed API states only zero data retention on inputs and outputs processed on "certified infrastructure". What is disclosed is a US legal entity. The privacy policy names Black Forest Labs Inc (2261 Market Street, San Francisco) as the controller for users outside the EEA, UK and Switzerland, with BFL GmbH (Freiburg; Amtsgericht München HRB 291820) as the controller for EEA, Swiss and UK users. The imprint does not name BFL Inc as a parent or shareholder of the GmbH, so the group structure is unresolved and is the question to put to the vendor.
The procurement-grade answer is the self-host path. FLUX [schnell] under Apache 2.0 runs on any EU GPU host (Hetzner H100, OVHcloud GPU, Scaleway B300, STACKIT GPU, IONOS Cloud) with no CLOUD Act exposure for buyers who can operate inference themselves. FLUX [dev] can be used for research and self-hosting subject to its non-commercial licence. ISO 27001:2022 and SOC 2 Type II are both attested on the enterprise page and verifiable through the vendor's Vanta trust centre. Best fit: AI / ML engineering teams who want best-in-class diffusion models, EU regulated buyers who self-host on EU GPU infrastructure for sovereignty, and any procurement-grade buyer evaluating sovereign-AI image generation alongside Mistral AI for text.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Black Forest Labs
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicebfl.ai/legal…
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Germany · €7.49/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
-
Spain · €12/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aleph Alpha
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
DeepL
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€7.49/mo |
| Freepik Spain | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€12/mo |