Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Black Forest Labs

VERIFIED
Sovereign AI · Germany
Founded 2024 · bfl.ai ↗

Freiburg-based German image-generation lab (FLUX models, Stable Diffusion creators), but heavily US-VC-funded; open-weight FLUX [schnell] under Apache 2.0.

Why this score?

Black Forest Labs (Freiburg, Germany, with an additional SF lab) is the FLUX-model company founded in 2024 by the Stable Diffusion core team (Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, Bjorn Ommer) — ISO 27001 certified and produces open-weight image-generation models (FLUX.2 max/pro/flex/klein, plus historical FLUX [schnell] Apache 2.0 and FLUX [dev] non-commercial) — but the cap table is dominated by US capital (Andreessen Horowitz, Salesforce Ventures, General Catalyst, NVIDIA, Anjney Midha AMP) after a US$31M seed (Aug 2024) and US$300M Series B at US$3.25B valuation (Dec 2025); Temasek (SG) is the only non-US institutional. Per strict CLOUD Act stance — US-VC majority funding caps the API-product score at 3/5; self-hosted FLUX [schnell] on EU GPU infrastructure gives an effective 5/5 posture.

SCORE
3.0/5
CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
JUMP TO
OVERVIEW

About Black Forest Labs

Black Forest Labs is the German image-generation research lab founded in 2024 by the **core team behind Stable Diffusion** — Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer — whose 2022 paper "High-Resolution Image Synthesis with Latent Diffusion Models" (originating from Ludwig-Maximilians-Universität München and Heidelberg University) underpinned the entire current diffusion-models wave. The company is headquartered in **Freiburg, Germany** (with an additional research lab in San Francisco). The product surface is the FLUX family of image-generation models: the current generation includes FLUX.2 [max], [pro], [flex], and [klein]; previous-generation **FLUX [schnell] is published under Apache 2.0** and is freely usable commercially; **FLUX [dev]** is non-commercial-research-licensed; and **FLUX [pro/max]** are commercial-API-only. For an EU-sovereignty audit Black Forest Labs is structurally a Mistral-AI-like case: German legal-entity HQ + DE-origin founders + ISO 27001 certification + open-weight model strategy + a research-and-licence model that supports self-hosting on EU GPU infrastructure — versus a cap table that is dominated by US capital. The seed round in August 2024 raised US$31M led by **Andreessen Horowitz** with **General Catalyst**, Mätch.vc, Garry Tan, Brendan Iribe, Michael Ovitz, and NVIDIA's Timo Aila. The December 2025 Series B raised US$300M at a US$3.25B post-money valuation co-led by **Salesforce Ventures** and **Anjney Midha (AMP)**, with **a16z, NVIDIA, General Catalyst, and Temasek** participating — total raised US$450M. The single non-US-non-DE investor of any size is Temasek (Singapore sovereign wealth fund). Per the directory's strict-ownership stance this US-funded weighting is `eu_hq_us_funded` and caps the API-product score at 3/5; the underlying API hosting is not publicly disclosed but standard for an a16z portfolio is AWS / GCP. The procurement-grade answer is the self-host path. **FLUX [schnell] under Apache 2.0** runs on any EU GPU host (Hetzner H100, OVHcloud GPU, Scaleway B300, STACKIT GPU, IONOS Cloud), giving an effective 5/5 / none posture with no CLOUD Act exposure for buyers who can operate inference themselves. **FLUX [dev]** can be used for research and self-hosting subject to its non-commercial licence. ISO 27001 is attested on the Trust and Security page. Best fit: AI / ML engineering teams who want best-in-class diffusion models, EU regulated buyers who self-host on EU GPU infrastructure for sovereignty, and any procurement-grade buyer evaluating sovereign-AI image generation alongside Mistral AI for text.
SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications

ISO/IEC 27001
ACTIVE
FEATURES

Capability matrix

INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option Yes
PRICING

Pricing & tiers

PAID
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement — this caps the compliance score (see How we score).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    bfl.ai/terms-of-service…
    Open ↗
ALTERNATIVES

Alternatives in this category