Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Black Forest Labs

VERIFIED
Sovereign AI · Germany
Founded 2024 · bfl.ai ↗

Freiburg-based German image-generation lab (FLUX models, Stable Diffusion creators), but heavily US-VC-funded; open-weight FLUX [schnell] under Apache 2.0.

In short

Black Forest Labs, in the Sovereign AI category, offers EU hosting with Germany as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Black Forest Labs (Freiburg, Germany, with an additional SF lab) is the FLUX-model company founded in 2024 by the Stable Diffusion core team (Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, Bjorn Ommer), ISO 27001 certified and produces open-weight image-generation models (FLUX.2 max/pro/flex/klein, plus historical FLUX [schnell] Apache 2.0 and FLUX [dev] non-commercial), but the cap table is dominated by US capital (Andreessen Horowitz, Salesforce Ventures, General Catalyst, NVIDIA, Anjney Midha AMP) after a US$31M seed (Aug 2024) and US$300M Series B at US$3.25B valuation (Dec 2025); Temasek (SG) is the only non-US institutional. EU-HQ, ISO 27001 certified, but eu_hq_us_funded with material CLOUD Act exposure for the managed API; no public DPA or sub-processors list found at audit. Self-hosted FLUX [schnell] on EU GPU infrastructure eliminates CLOUD Act exposure.

CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
CLOUD Act by deployment

Exposure depends on how you run this product.

Hosted SaaS (default)

Vendor-operated: the sub-processors below apply.

Self-hosted (open-source)

Deploy on your own EU infrastructure and you control hosting and every sub-processor.

Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Black Forest Labs

Black Forest Labs is the German image-generation research lab founded in 2024 by the core team behind Stable Diffusion (Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer) whose 2022 paper "High-Resolution Image Synthesis with Latent Diffusion Models" (originating from Ludwig-Maximilians-Universität München and Heidelberg University) underpinned the entire current diffusion-models wave. The company is headquartered in Freiburg, Germany (with an additional research lab in San Francisco). The product surface is the FLUX family of image-generation models: the current generation includes FLUX.2 [max], [pro], [flex], and [klein]; previous-generation FLUX [schnell] is published under Apache 2.0 and is freely usable commercially; FLUX [dev] is non-commercial-research-licensed; and FLUX [pro/max] are commercial-API-only.

For an EU-sovereignty audit Black Forest Labs is structurally a Mistral-AI-like case: German legal-entity HQ + DE-origin founders + ISO 27001 certification + open-weight model strategy + a research-and-licence model that supports self-hosting on EU GPU infrastructure, versus a cap table that is dominated by US capital. The seed round in August 2024 raised US$31M led by Andreessen Horowitz with General Catalyst, Mätch.vc, Garry Tan, Brendan Iribe, Michael Ovitz, and NVIDIA's Timo Aila. The December 2025 Series B raised US$300M at a US$3.25B post-money valuation co-led by Salesforce Ventures and Anjney Midha (AMP), with a16z, NVIDIA, General Catalyst, and Temasek participating; total raised US$450M. The single non-US-non-DE investor of any size is Temasek (Singapore sovereign wealth fund). Per the directory's strict-ownership stance this US-funded weighting is eu_hq_us_funded with material CLOUD Act exposure for the managed API; the underlying API hosting is not publicly disclosed but standard for an a16z portfolio is AWS / GCP.

The procurement-grade answer is the self-host path. FLUX [schnell] under Apache 2.0 runs on any EU GPU host (Hetzner H100, OVHcloud GPU, Scaleway B300, STACKIT GPU, IONOS Cloud) with no CLOUD Act exposure for buyers who can operate inference themselves. FLUX [dev] can be used for research and self-hosting subject to its non-commercial licence. ISO 27001 is attested on the Trust and Security page. Best fit: AI / ML engineering teams who want best-in-class diffusion models, EU regulated buyers who self-host on EU GPU infrastructure for sovereignty, and any procurement-grade buyer evaluating sovereign-AI image generation alongside Mistral AI for text.

SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications

ISO/IEC 27001
ACTIVE
FEATURES

Capability matrix

Self-hostable Yes
API access Yes
Open-weight models Yes
Fine-tuning Yes
Multimodal Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option Yes
PRICING

Pricing & tiers

PAID
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    bfl.ai/terms-of-service…
    Open ↗
ALTERNATIVES

Alternatives in this category

Aleph Alpha
Germany · Founded 2019
EU-HOSTED

Heidelberg-based sovereign-AI lab (Pharia platform); merger with Canadian Cohere announced April 2026: Aleph Alpha shareholders to receive ~10% of combined ~$20B entity.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Freepik
Spain · Founded 2010
EU-BASED

Spanish AI image generation platform (Pikaso, F Lite model) by the Freepik Group; majority-owned by Swedish PE firm EQT; 200M+ users.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR
Infomaniak AI Tools
Switzerland · Founded 1994
EU-SOVEREIGN

Swiss sovereign-AI API + Euria assistant (Infomaniak, Geneva, since 1994); open-source LLMs served on own Swiss DCs, no training on user data, no CLOUD Act.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE