Discover the shadow AI already running in your organisation, continuously red-team it, and export auditor-ready EU AI Act, NIS2 and DORA evidence — with your data resident in Frankfurt, free for 6 months, installed in 10 minutes.
The EU AI Act entered into force in 2024 and is being phased in. Prohibited-practice rules and AI-literacy duties already apply, and full applicability lands in August 2026. You don't need a countdown to act — you need an inventory.
Most tools do one part of the job. ThreatVec combines four — and runs on EU-resident infrastructure with a free self-serve tier. We lead with the combination; we won't make false claims about anyone else.
| Capability | ThreatVec | Governance / discovery tools e.g. Holistic AI, Zenity, Credo AI | AI red-team tools e.g. Giskard (EU-native), Lakera, Mindgard |
|---|---|---|---|
| Shadow-AI discovery (endpoint + host) | ✓ Built in | ~ Governance/registry focus | ✗ Not the focus |
| Continuous autonomous red-team | ✓ Always-on 7-stage loop | ~ Some add testing (e.g. Holistic AI) | ✓ Core strength |
| Per-framework compliance evidence export | ✓ Scorecards + evidence packs | ✓ Core strength | ~ Testing reports |
| Live EU data residency (at rest) | ✓ Frankfurt, per-tenant | — Varies by vendor | ~ Some EU-native (e.g. Giskard) |
| Free self-serve tier | ✓ 180-day hosted, no card | — Often sales-led | ~ Some free OSS (e.g. Giskard) |
Vendors are grouped by their primary advertised focus, and some cross over — Holistic AI adds red-team testing; Giskard is a strong EU-sovereign red-team vendor with a free open-source tier. Where public material doesn't confirm a capability, we mark it "— varies" rather than guess. Our edge isn't any single row — it's the full combination: endpoint shadow-AI discovery + continuous autonomous red-team + per-framework evidence + live managed EU residency + a free hosted self-serve tier, in one product. No vendor here does all five.
Choose the EU region at signup and your tenant's data at rest is routed to infrastructure in Frankfurt, Germany. Routing is per-tenant and fail-closed — if the EU region cannot be confirmed, the request does not silently fall back to another region.
Processing vs. storage — an honest note. EU-region customer data is stored at rest in Frankfurt. Some processing still runs through US sub-processors under EU Standard Contractual Clauses and the EU-US Data Privacy Framework — LLM analysis (Anthropic, DeepSeek), authentication (Clerk) and transactional email (Resend). Customer-submitted content is never routed to DeepSeek. The full sub-processor list is in our privacy policy, and the same disclosure is shown as consent at signup.
ThreatVec maps your AI security controls to the frameworks EU teams answer to, with live per-control scorecards and one-click, PII- and secret-redacted evidence-pack export.
No infrastructure changes on day one. Free for 180 days, no credit card, EU-resident, self-install.
Your first shadow-AI inventory and compliance scorecards in 10 minutes. Free for 180 days — no credit card, no sales call, data resident in Frankfurt.
No credit card · 180-day free beta · Data resident in Frankfurt · Self-install · Chrome extension live