Prüfen Sie Ihre KI Anbieter, Modell, Compliance, Risiken, Verarbeiter, TransparenzAnbieterModellComplianceRisikenVerarbeiterTransparenzAnbieter

Bulin 47 AI is a consumer photo-to-video app: the user uploads one portrait and Seedance 2.5 replaces the face, hair and clothing of the lead performer in a fixed third-party street-freestyle video, producing a silent, approximately 15-second, 9:16, 480p clip for 20 purchased credits. It is a face swap of a real clip, using the likeness of an identifiable person (the uploader or, as the site invites, 'a friend who wants to join'). The server forwards the photo to KIE (an API gateway that resells third-party models) or, for a legacy workflow, EvoLink, which pass it to a model provider the site does not name. Rated high on limited evidence: the operator is not identified anywhere (no legal entity, address or named person; one personal Gmail contact that is also the sole contact on zombieai.video, an existing catalog record, suggesting a common operator or template); the product swaps real people's faces into someone else's recorded performance with no stated consent verification, age limit, output ownership, watermarking or provenance labelling, and no abuse or takedown route; the rights to the original clip are not addressed beyond a statement that prompts do not establish permission to copy it; photos pass through at least two intermediaries outside any documented DPA; and the Privacy Policy and Terms are short, name no controller, give no retention period, deletion route or security measures, and use hedged wording that suggests they do not match the live service. Retention statements (no original photos stored) are the site's own; KIE's documentation gives 14 days for generated media and two months for logs, and its public privacy policy does not address uploaded images.

Coder AI Governance is a self-hosted control layer for AI coding tools. The AI Gateway authenticates model requests to a named user and logs prompts, token usage, models and tool invocations centrally, keeps LLM provider API keys in the control plane, and applies spend limits; the Agent Firewall wraps agent processes in a default-deny HTTP and HTTPS allowlist (domains, methods and paths), blocks other outbound protocols, and logs every allow and deny; audit events can be exported to a SIEM, and identity comes from OIDC and SCIM. It works with Coder Agents and with bring-your-own agents such as Claude Code and Codex. Rated medium: it is a risk-reducing control rather than an agent, but it becomes a concentrated store of every prompt, code snippet and tool call plus the organization's LLM provider keys, so its own security and retention settings matter a great deal, and it sits on the same platform whose registry was compromised on 31 Aug 2026 (advisory GHSA-vx42-ghc9-gw65). The firewall restricts HTTP and HTTPS egress and does not by itself address what an agent does inside an allowed domain. Coder says it has no access to customer workspaces or source code, and the data stays in the customer's deployment; it also collects product telemetry by default, and its Privacy Policy (free users cannot opt out) and the AI Governance FAQ (can be turned off) differ on this. No documentation of what the gateway logs, for how long, or how access to those logs is controlled was read, and the Trust Center's AI section is a one-line statement.

Coder Agents is a native AI coding agent built into the self-hosted Coder platform. The entire agent loop runs in the customer's Coder control plane: it provisions workspaces on demand, works against models the customer approves (Anthropic, OpenAI, Google, AWS Bedrock or self-hosted endpoints), can be triggered from chat or an API for CI, GitHub Actions, Slack and Jira, and uses centrally managed MCP tools and skills. Controls described by the vendor include model governance, per-user and per-group spend limits, no LLM API keys in workspaces, SSO identity on every action, workspace-template restrictions and usage analytics including pull-request and merge rates. Rated high: an agent that writes and changes code and runs commands in environments with access to source code and cloud credentials is a high-impact system, and its safety rests largely on customer configuration, since Coder's docs say self-hosting alone does not make a deployment compliant. The risk is raised by Coder's own recent incident: on 31 Aug 2026 its module registry (registry.coder.com), which provisions workspaces and installs AI coding agents, served tampered Terraform modules for about 14 hours that stole cloud, CI/CD, SSH, OIDC, AI-provider and MCP credentials (advisory GHSA-vx42-ghc9-gw65, CVSS 9.0); third-party reports say Coder cannot enumerate which deployments pulled them. Coder says it found no indication that customer data it holds was affected, and engaged Coalition Incident Response for an independent review whose summary was due 30 Sept. Because the product is self-hosted, prompts and code go to the LLM providers the customer configures, not to Coder; Coder's trust center lists SOC 2 Type 2 behind an access request but its AI section is a one-line statement with no AI policy, and no published safety or failure-rate data for the agent was found. The rating could be lowered if the independent review, SOC 2 scope and agent guardrails check out and customers mirror or pin the registry.

German hosting provider. Named by Spotler as the hosting provider for Spotler Activate (trust.spotler.com sub-processors).

Google's own data centres and production infrastructure, on which Google advertising services such as Google Ads and Performance Max run (Google Ads Data Processing Terms).

Adyen states it runs payment processing and Uplift's AI inference on its own servers in its own data centres, without public cloud (adyen.com/infrastructure; 'The AI behind Uplift').