LightOn
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris-based enterprise GenAI (Paradigm platform), Europe's first publicly-listed GenAI company on Euronext Growth Paris, on-premise-first.
LightOn is a European service hosted in France, with at most minor, transient US exposure under the CLOUD Act. It is listed under Sovereign AI.
Assessment notes
LightOn (Paris, founded 2016 by Igor Carron, Laurent Daudet, Florent Krzakala, Sylvain Gigan, all French engineers and academics) is Europe's first publicly-traded GenAI company, listed on Euronext Growth Paris since November 2024 (IPO €10.35/share, €62M market cap day 1). Founder-team still active, no US-VC majority, no PE concentration. The Paradigm platform is sold on-premise-first so customer data never leaves the buyer's firewall, with hybrid (sovereign European cloud GPU) and SaaS as secondary options; GDPR + SOC 2 Type 1 certified; flagship customers include Safran, Groupama, Région Île-de-France, Direction Générale des Finances Publiques, CNES, and French Space Command. EU-owned and EU-hosted (the privacy policy states hosting "in France or in a country listed as having adequate safeguards"), but LightOn does not publish a publicly accessible DPA — one exists per the privacy policy and is available on request only, now via compliance@lighton.ai, as is the processor list. Re-verified 2026-08-26: the privacy policy names Sentry Inc. (San Francisco, US) as an error-monitoring processor, so the exposure flag moves from none to minor — a transient US processor with no data-at-rest exposure — while on-premise and hybrid deployments remain effectively clean.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About LightOn
LightOn is a Paris-headquartered enterprise generative-AI company founded in 2016 by Igor Carron, Laurent Daudet, Florent Krzakala, and Sylvain Gigan, all French engineers and academics, with the original ambition "to push the boundaries of extreme-scale AI." The current product surface is centred on Paradigm, an on-premise-first generative-AI platform for enterprise business units that runs entirely within the customer's security perimeter, with hybrid (sovereign European cloud GPU) and managed-SaaS deployment options. Historical research output includes more than 12 large language models, including 100+ billion parameter open-source foundation models and the flagship Alfred line.
For an EU-sovereignty audit LightOn is a structurally clean listing. In November 2024 LightOn became Europe's first publicly-traded GenAI company, listing on Euronext Growth Paris at €10.35 per share with a €62M market cap on day one and raising €11.9M. The founder team remains active and there is no US-PE or US-VC controlling stake; the company is structurally French-owned and EU-public-market accountable. The product architecture itself eliminates the standard EU-vendor sovereignty trade-off: with on-premise as the default deployment model, customer data never leaves the buyer's firewall, and even the hybrid option uses sovereign European cloud GPUs rather than US hyperscalers. GDPR-compliant and SOC 2 Type 1 certified. One US processor does sit in the chain: the privacy policy names Sentry Inc. (San Francisco) for error monitoring, which is why CLOUD Act exposure is recorded as Minor rather than none. No cloud or hosting provider is named at all, and no third-party model provider appears anywhere in the policy; on-premise and hybrid deployments remain effectively clean.
Customer references read like a who's-who of French regulated / public-sector / defence procurement: Safran, Groupama, Région Île-de-France, Direction Générale des Finances Publiques, CNES (French space agency), Verlingue, French Space Command, plus indirect-channel partnerships with Orange Business and Hewlett Packard Enterprise. LightOn targets positive EBITDA by 2026 per its IPO prospectus. Best fit: French and EU regulated buyers (defence, public sector, finance, healthcare) needing on-premise sovereign GenAI without any US-cloud dependency; enterprise teams replacing OpenAI / Anthropic / Cohere with a Paradigm-class platform that runs inside the firewall. Pricing is no longer enterprise-only: LightOn now publishes a self-serve table with a free Starter plan on pure pay-as-you-go, Business at €149 per month on an annual licence including 100 GB of document storage, and a custom Enterprise tier with volume discounts. The metered rates are per page, per query and per GB rather than per seat or per token.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of LightOn
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €7.49/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aleph Alpha
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Black Forest Labs
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
DeepL
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€7.49/mo |