AI Agents & Assistants
LightOn
EU-Made Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by LightOn SA · www.lighton.ai
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
LightOn at a glance
- Vendor
- LightOn SA
- Headquarters
- Not stated on the vendor’s pages as of 26 Oct 2026
- Data hosting
- Default not stated; pages mention France and Europe source, captured 26 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 26 Oct 2026
- Panel verdict
- The AI panel rates LightOn 3/5, the mean of 6 judges. LightOn's Paradigm is a French AI assistant platform that puts agents on a company's own documents. how scores are made
- As of
- Vendor pages captured 26 Oct 2026; evaluated by the panel 28 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
LightOn's Paradigm is a French AI assistant platform that puts agents on a company's own documents. The bench scored it highest on admin and access: SAML, OIDC and LDAP single sign-on, SCIM 2.0 provisioning tested with Microsoft Entra ID, group-scoped access to agents and datasources, and configurable audit-log retention. Data use and training and sovereignty follow: prompts and completions are excluded from training except on the customer's explicit written request, processing is stated to run in France or in Europe on LightOn-controlled inference nodes, and the one named non-European subprocessor, Sentry, receives masked, relay-filtered telemetry. The genuine split is processing and models: judges crediting the self-hosted option and stateless inference scored 6, while those needing named models and providers to pin the chain scored 4. Agent capabilities and integrations and knowledge show the same spread over undocumented guardrails and a connector set limited to Google Drive and ServiceNow. No prices appear on the captured pages.
Speaks for it
- Prompts and completions are not used to train or improve LightOn's models except on the customer's explicit written request
- Single sign-on via SAML, OIDC and LDAP, with SCIM 2.0 provisioning tested with Microsoft Entra ID
- Group-based control over which agents and workspaces each team reaches, plus per-datasource user access control
- Audit-log retention is administrator-configurable (180 days by default) with automatic anonymisation after the period
- Processing is stated to run in France or in Europe on inference nodes under LightOn's control, with a self-hosted deployment option and a DPA offered
Held against it
- Only model categories are published (large language, embedding, vision, multi-vector), with no individual model, provider or per-model inference region named
- The documented retention job neither deletes nor anonymises ML logs, task results or user chat history, and anonymisation replaces values without removing rows
- We found no public information on run logs, human approval before consequential agent actions, triggers, schedules or evaluation before release
- Only Google Drive and ServiceNow connectors are documented, with no public information on sync frequency or on answers citing their sources
- Hosting providers are unnamed and the full processor list is available only on request, so the chain cannot be verified from public pages
Best for
- You need a European provider with a written no-training commitment and an Article 28 data processing agreement for a compliance-driven rollout
- Your identity stack is Microsoft Entra ID or another SAML/OIDC provider and you need group-scoped access to agents and datasources
- Your knowledge base lives in ServiceNow or Google Drive and staff should search it through chat
Avoid if
- You need named models with published inference regions to pin processing to a specific EU stack
- You need documented approval gates, per-run logs and pre-release evaluation before agents act autonomously
- You must anonymise or delete chat history and model logs on a schedule — the documented retention job excludes them
- Your knowledge lives in systems beyond Google Drive and ServiceNow, such as mail, CRM or a wiki — we found no public information on such connectors
The scores
| Criterion | Panel median |
|---|---|
| Data use, training & retention | 3.5 of 5 |
| Models & processing location | 3 of 5 |
| Admin, identity & access controls | 3.5 of 5 |
| Integrations, connectors & knowledge | 3 of 5 |
| Agent capabilities & guardrails | 2.5 of 5 |
| European sovereignty | 3.5 of 5 |
Data use, training & retention
Show reasoningHide reasoning
How this is scored
What happens to prompts, uploaded files, connected data and outputs: whether any of it trains a model (the vendor's or a model provider's), how long it is kept and where logs live, whether zero-retention is available, and whether a data processing agreement covers it.
0 — No statement on training or retention; the privacy policy is a website policy that does not cover the product.
3 — A general statement that business data is "not used for training", with no word on retention, on the model providers behind the product or on logs.
5 — Business data excluded from training by contract, retention periods stated for chats and files, and a DPA offered to business customers.
8 — No-training commitments stated for the vendor and every model provider it routes to, retention configurable by the admin (including deletion of chat history), zero-data-retention terms with the model providers named, and abuse-monitoring retention described.
10 — Data use fully accounted for: training, retention, logging and abuse monitoring stated per model provider, customer-controlled retention and deletion with an audit trail, outputs and connected data treated as customer data in the DPA, and an independent audit (SOC 2, ISO 27001 or ISO 42001) covering the product.
The Head of IT
No-training is the default with an exception only on the customer's explicit written request, inference is stateless on nodes under LightOn's control, and retention is documented with real figures: access logs up to 90 days excluding prompts, configurable audit-log retention with automatic anonymisation after the period, and a processor role under Article 28 with a DPA available on request. Two things hold it back: the log-retention documentation states that user chat history and model request logs are not deleted or anonymised by that configuration, and we found no independent audit or certification statement covering the product. 1 2
The Data Protection Officer
The exclusion from training is explicit and near-contractual: input and output data is not used to train, fine-tune or improve models except on the customer's explicit written request, a processor role under Article 28 with a Data Processing Agreement is stated, and retention periods are spelled out for access logs, chat, connection data and billing metrics. I stop short of the top level because the documented log-retention configuration expressly does not delete or anonymize machine-learning logs, prompts and completions, or chat history, anonymization replaces values without deleting rows, and I found no public information giving the customer deletion control over conversations. 1 2
The Automation Lead
The privacy policy states LightOn does not use prompts or completions to train or fine-tune its models except on the customer's explicit written request, retention is spelled out per data type (technical logs up to 90 days for abuse detection, usage metrics up to 13 months after contract end, and so on), and a data processing agreement with LightOn as Article 28 processor is offered on request. An administrator can configure audit-log retention with automatic daily anonymization, and inference is described as stateless on LightOn's compute nodes. We found no public information on admin-configurable deletion of chat history or on independent certification, which is why I stop below the top of the scale. 1 2
The Customer-Service Director
The privacy policy commits that prompts and completions are not used to train or fine-tune models except on my explicit written request, a DPA is available on request, and inference nodes keep no persistent copies; retention is stated for chats, access and abuse logs, call recordings and billing metrics, and audit-log retention is configurable with automatic anonymisation after the period. What holds it back for a compliance review: anonymisation only replaces values without deleting rows, chat history is explicitly untouched by that retention job, and no per-provider zero-retention terms are published. 1 2
The Works Council Member
The privacy policy commits in writing that prompts and completions are not used for training except on the customer's explicit written request, states retention periods for access logs, recordings, metrics and connection data, and offers a DPA on request, with stateless inference on LightOn-controlled compute nodes. The audit-log rules are the strongest part for a works council — configurable retention, 180 days by default, with automatic anonymisation after the period — but the same documentation states that model logs, task results and user chat history are neither deleted nor anonymised, and anonymisation only replaces values without removing rows. The captured pages state no retention period for the product's own conversations, which is precisely the point a works council would need settled in writing. 1 2
The Skeptic
The privacy policy commits in writing that prompts and completions are not used to train or improve LightOn's models except on the customer's explicit written request, retention periods are stated per data type (chats two months, access logs up to ninety days for abuse detection, usage metrics thirteen months after contract end), and a DPA is available with LightOn acting as an Article 28 processor. Audit-log retention is admin-configurable and abuse-monitoring retention is described, which is more than most bother to publish. But chat history and ML logs sit outside that retention control, the anonymization job replaces values while "no data is deleted", and no independent audit statement appears. 1 2
Models & processing location
Show reasoningHide reasoning
How this is scored
Which models sit behind the product and who runs them, where inference and storage happen, whether the customer can pin processing to the EU, choose or exclude model providers, bring its own model or key, or run the product in its own cloud or on premises.
0 — The models behind the product and the processing location are not stated.
3 — The model family is named, but where inference runs and through which provider (the model maker, a hyperscaler, the vendor) is unstated.
5 — Models and their providers named, with an EU processing option stated for storage and at least the default model.
8 — Each available model listed with provider and inference region, EU-only processing selectable by the admin and enforced across models, model providers excludable, and bring-your-own-key or own-cloud deployment documented.
10 — Processing fully under the customer's control and documented: EU-only or on-premises inference for every feature including agents and connectors, open-weight or self-hosted models supported, data flows per feature published, and a residency commitment in the contract rather than on a marketing page.
The Head of IT
The models endpoint lists model types (large language, embedding, vision, multi-vector) and distinguishes self-hosted from external, but the captured pages name neither specific models nor the providers running the external ones. Processing of personal data is stated to run primarily in data centres in France or in Europe on inference nodes under LightOn's control, which is reassuring, but an admin-selectable EU-only setting and per-model inference regions are not documented. 1 3
The Data Protection Officer
Inference runs on nodes under LightOn's own control, with processing stated to be carried out in data centers in France or in Europe, and a self-hosted deployment option is documented. The captured pages list model types and a models endpoint rather than named models with their inference regions, and I found no public information on an admin-enforced EU-only switch that carries across every feature. 1 3
The Automation Lead
Model types (large language, embedding, vision, multi-vector) are documented with an API to list the models available to a key, but the captured pages do not name the individual models or their inference regions. Inference runs on nodes under LightOn's control with hosting described as "in France or in Europe", and a self-hosted deployment option is documented, giving both an EU path and an on-premises path. We found no public information on excluding specific model providers or on pinning EU processing per feature. 1 3
The Customer-Service Director
Processing is stated to run in service providers' data centres in France or Europe with stateless inference on LightOn-controlled nodes, and the documentation shows model types (language, embedding, vision, multi-vector) retrievable per API key plus self-hosted or external deployment options. No specific model or provider is named on the public pages, so I cannot pin inference to a named EU stack or exclude anyone from the chain. 1 3
The Works Council Member
LightOn states that processing, including stateless inference on its own nodes, happens primarily in data centres in France or in Europe, lists model types through its API, and documents a self-hosted deployment option. We found no public information listing each individual model with its inference region, an administrator control that pins every feature to the EU, or provider exclusion and bring-your-own-key arrangements. 1 3
The Skeptic
Inference runs on nodes under LightOn's own control in service-provider data centers "in France or in Europe", with a self-hosted deployment option and stateless inference stated — so the model maker, operator and region are at least answered in principle. However, only model categories are published (language, embedding, vision, multi-vector), no individual model is named, the hosting providers behind that statement are unnamed, and "primarily" reads as intent rather than an admin-enforceable EU pin. 1 3
Admin, identity & access controls
Show reasoningHide reasoning
How this is scored
What the IT department controls: SSO and SCIM provisioning, roles and groups, which models, agents and connectors each group may use, retrieval that respects the permissions of the source system, audit logs, usage reporting, and policies such as data-loss prevention — and whether reporting on staff use is scoped and documented.
0 — No admin features documented; accounts are individual sign-ups.
3 — A team workspace with an owner and member invitations, but no SSO, no roles and no audit log.
5 — SSO, admin and member roles, user management, and an admin view of usage.
8 — SAML/OIDC SSO with SCIM provisioning, group-based permissions for models, agents and connectors, retrieval that inherits source-system permissions, exportable audit logs, and usage analytics with documented scope.
10 — Governance a regulated company can operate: fine-grained policies (DLP, content filters, prompt and output logging rules), audit logs streamed to a SIEM, per-agent ownership and approval, usage reporting that can be aggregated or pseudonymised for works-council agreements, and every admin action logged.
The Head of IT
This is close to what a deployment of this size needs: SAML and OpenID Connect single sign-on configured per company and assignable to user groups, LDAP, SCIM 2.0 covering the full user lifecycle and tested with Microsoft Entra ID, company and system admin roles, group-controlled access to agents and workspaces, per-datasource user access control, and audit logs whose retention the administrator configures. Two gaps keep it from a clean bill: the SCIM endpoint currently cannot manage groups, only list them, and we found no public information on exporting audit logs to a SIEM, on usage analytics, or on retrieval inheriting the source system's permissions. 2 4 5 6 7
The Data Protection Officer
SAML and OpenID Connect single sign-on with SCIM 2.0 provisioning (tested with Microsoft Entra ID) and LDAP are documented, alongside Company Admin, System Admin and group Owner roles, group-based access to agents, per-datasource access control, and configurable workspace scoping. Audit logs exist with a configurable retention period and automatic anonymization, but we found no public information on exporting audit logs to a SIEM or on documented usage analytics for staff activity. 2 4 5 6 7
The Automation Lead
SAML and OpenID Connect single sign-on with per-company configuration, SCIM 2.0 user provisioning tested with Microsoft Entra ID, LDAP, and Company Admin, System Admin and group Owner roles are all documented. Agents are linked to groups controlling who can use them and which workspaces they reach, per-datasource user access control governs what retrieval returns, and audit logs exist with configurable retention and anonymization. We found no public information on exporting audit logs to a SIEM, on data-loss-prevention policies, or on a documented usage-analytics view, and the vendor itself states that group management through the SCIM /Groups endpoint is currently not possible. 2 4 5 6 7
The Customer-Service Director
SSO via SAML and OIDC with per-company configuration and group assignment, LDAP, SCIM 2.0 user provisioning tested with Microsoft Entra ID, group-based control over which teams reach which agents, workspaces and datasources, company and system admin roles, and configurable audit-log retention with automatic anonymisation. For a regulated rollout I still found no public information on retrieval inheriting source-system permissions, on exporting audit logs, or on usage analytics scoped for reporting on staff use. 2 4 5 6 7
The Works Council Member
SSO via SAML, OIDC and LDAP plus SCIM 2.0 provisioning tested with Microsoft Entra ID, group-based control over which agents, workspaces and datasources staff may use, per-datasource access control, and audit logs whose retention is configurable with automatic anonymisation — much of what a works council needs set out in writing. We found no public information on usage analytics for administrators, on export of audit logs, or on data-loss-prevention policies, and no documented way to aggregate or pseudonymise usage reporting for a works-council agreement. 2 4 5 6 7
The Skeptic
SAML and OIDC single sign-on per company, SCIM 2.0 provisioning tested with Microsoft Entra ID, and LDAP are documented, alongside real role separation (Company Admin, System Admin, group Owner), group-based control over which agents and workspaces each team may reach, and per-datasource access control. Audit logs exist with configurable retention and anonymization. We found no public information on exportable audit logs, data-loss prevention policies, or any usage reporting on staff use. 2 4 5 6 7
Integrations, connectors & knowledge
Show reasoningHide reasoning
How this is scored
How the product reaches company knowledge and systems: connectors to file stores, wikis, mail, CRM, ticketing and ERP, how fast and how completely they sync, the API, support for open protocols such as MCP, and how the assistant cites the sources it answers from.
0 — No integrations; users paste text or upload files one at a time.
3 — File upload and one or two connectors (for example a drive), with no API and no statement on sync or citations.
5 — A connector library covering the common file stores, wikis and collaboration tools, answers citing sources, and a documented API.
8 — Connectors to file stores, wikis, mail, CRM and ticketing with incremental sync, custom connectors or MCP support, an API and webhooks for embedding assistants and agents in other tools, and source citations on every grounded answer.
10 — The product sits in the company's systems: read and write connectors with documented scopes, MCP servers and clients, contact-centre or telephony integration where relevant, a knowledge layer that can be audited and corrected, and the data, agents and configuration exportable when the customer leaves.
The Head of IT
Datasources connect Google Drive folders and ServiceNow knowledge bases with automatic synchronisation and unified search across connected sources, agents can be given native tools and MCP servers, and versioned APIs cover models, agents and tools. Only two connectors are named, and we found no public information on sync frequency, webhooks for embedding assistants elsewhere, or source citations on grounded answers. 3 6 7
The Data Protection Officer
Google Drive and ServiceNow datasources synchronize automatically into a unified search across connected sources, and a documented API together with native tools and MCP server support lets agents reach company knowledge. We found no public information on source citations for grounded answers, webhooks, or a broader connector library beyond the two documented sources. 3 6 7
The Automation Lead
Datasources sync external knowledge bases automatically, with Google Drive and ServiceNow connectors documented and unified search across connected sources; the API surface (v3 models, agents, threads) and MCP server support are documented, including an endpoint to select an agent from third-party workflows, which is exactly how I would wire this into a ticket pipeline. We found no public information on connectors for mail, CRM or wikis, on webhooks, or on how the assistant cites the sources of a grounded answer, so a buyer computing connector coverage from public pages alone gets a partial picture. 3 6 7 8
The Customer-Service Director
External knowledge syncs automatically without end-user intervention — Google Drive folders and the ServiceNow knowledge base are the documented connectors — with unified search across connected sources, MCP servers for extending tools, and a documented REST API for agents and threads. For a contact centre the ServiceNow knowledge base is a genuine asset, but I found no public information on CRM or ticketing connectors beyond knowledge-base reading, nor on answers citing their sources. 3 6 7
The Works Council Member
Datasources sync external systems automatically without end-user intervention — Google Drive and ServiceNow are documented — with unified search across connected sources, native tools and MCP server support for agents, and a documented API. We found no public information on connectors for mail, wikis, CRM or ERP beyond these two, on sync frequency or completeness, or on how answers cite the sources they draw from. 3 6 7
The Skeptic
What is published is concrete but narrow: Google Drive and ServiceNow datasources sync automatically into unified search, the v3 API is documented down to agents, tools and MCP servers, and agents can attach MCP servers. We found no public information on connectors to wikis, mail, CRM or ERP, on sync frequency or completeness, or on whether answers cite the sources they were drawn from. 3 6 7
Agent capabilities & guardrails
Show reasoningHide reasoning
How this is scored
What an agent can actually do and where it stops: multi-step tasks, tool use and actions in other systems, scheduling and triggers, human approval before consequential actions, run logs, evaluation and testing before release, and the limits the vendor states rather than hides.
0 — No agents; the product is a chat window, whatever the marketing says.
3 — Saved prompts or custom assistants with instructions and files, but no actions in other systems and no run history.
5 — Agents that call tools or APIs and run multi-step tasks, built without code, with a log of each run.
8 — Agents that act in connected systems with scoped permissions, human approval configurable per action, triggers and schedules, test and evaluation tooling before release, and documented limits and failure handling.
10 — Agents a business can put in production and account for: versioning and staged rollout, evaluation against test sets, monitoring of quality and cost per agent, handover to a human with full context, every action attributable to the agent and the person who deployed it, and the vendor's own statement of what agents must not be trusted with.
The Head of IT
Agents combine instruction, model, tools, MCP servers, documents and scoped workspaces, can autonomously chain one to five consecutive tools, and are governed by ownership levels — personal, team, company — with company and team agents restricted to administrators, which is exactly the group-based entitlement model I would use for departments. We found no public information on run logs per execution, human approval before consequential actions, triggers or schedules, or evaluation tooling before release. 7 8
The Data Protection Officer
Agents combine instructions, a model, tools and MCP servers with scoped workspaces, run one to five consecutive tools autonomously, and carry an ownership model (personal, team, company) with administrator control over shared agents and a stated limit on tool chains. We found no public information on run logs, human approval before consequential actions, or evaluation and testing before release. 6 7 8
The Automation Lead
Agents combine instructions, a model, native tools and MCP servers with scoped workspaces; ownership is personal, team or company, workspace scoping applies regardless of which user calls the agent, and the vendor states real limits such as one to five consecutive tools per run and the agent being locked for the whole session once the first message is sent. We found no public information on human approval before an agent's actions, per-run logs, schedules or triggers, or any way to evaluate an agent before the wider company uses it — those are the guardrails I build around, so this lands mid-scale for me. 7 8
The Customer-Service Director
Agents combine instructions, a chosen model, native tools and MCP servers in scoped workspaces, chain one to five tools autonomously, are tied to groups with personal, team and company ownership, and can be selected per call through the API. But before I put an agent in front of customers I would need approval gates before consequential actions, triggers and schedules, evaluation and testing before go-live, and handover to a human with the full context — on all of which the documentation is silent. 7 8
The Works Council Member
Agents combine instructions, a chosen model, tools and MCP servers, run multi-step tasks of one to five consecutive tools, and are scoped to teams and workspaces, with team and company agents created only by administrators and ownership fixed at creation. My red line — a human approving an agent's consequential actions before they land on a colleague — is not addressed anywhere we looked: we found no public information on human approval, per-run logs, triggers, schedules, or evaluation and testing before an agent is released to staff. 7 8
The Skeptic
These are not saved prompts: an agent combines instructions, a model, native tools and MCP servers, scoped workspaces and team access, and can autonomously chain one to five consecutive tools, with stated limits such as no switching mid-conversation and admin-only creation of company-wide agents. We found no public information on run logs for each execution, human approval before consequential actions, triggers or schedules, or evaluation before release — so nothing on these pages shows where an agent's actions are recorded or where they can be stopped. 7 8
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where customer data is hosted, and who the subprocessors are — model providers above all, then hosting, search, telephony and email. Independently sourced by the sovereignty pipeline; for an AI product the model provider is a subprocessor, so a European interface over a non-European model counts as such.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors (including model providers) unnamed.
3 — A privacy policy exists, but hosting location is unstated or non-EU and the model providers behind the product are not named as subprocessors.
5 — EU hosting stated and an EU contracting entity, but prompts reach non-EU model providers or other subprocessors without a stated safeguard or EU region.
8 — EU hosting on named infrastructure, EU contracting entity, every subprocessor listed with its location including model providers, EU inference available, and a DPA offered.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and model processing, every subprocessor European or optional, data export and deletion documented, and a security or certification statement published rather than implied.
The Head of IT
LightOn is a Paris-registered French company acting as GDPR processor, processing primarily in France or in Europe, with a DPA available and standard contractual clauses signed; the one named non-European subprocessor, Sentry, is telemetry-only for the web interfaces and is covered by contractual clauses, a DPA and a relay that masks and filters data before transmission. The hosting and storage providers themselves stay unnamed, so I cannot verify the infrastructure behind the France-or-Europe statement, and we found no certification or security audit statement. 1 3
The Data Protection Officer
The contracting entity is headquartered in Paris, processing is stated to run in data centers in France or in Europe, and inference nodes sit under LightOn's own control, so prompts need not leave a European model provider. The hosting and storage providers behind the France-or-Europe statement go unnamed, the full processor list is only available on request rather than published, and Sentry Inc., a US company, receives masked and filtered interface telemetry under standard contractual clauses and a data processing agreement. 1 3
The Automation Lead
LightOn SA states a Paris headquarters and SIREN number on its own privacy policy, processing is described as carried out in data centers "in France or in Europe" on LightOn-controlled inference nodes, and a data processing agreement with standard contractual clauses and 72-hour breach notification to the CNIL is offered. The one named non-EU subprocessor, Sentry, is confined to masked, relay-filtered error telemetry of the web interfaces. The full processor list is available only in the data processing agreement on request, the hosting infrastructure is not named on the captured pages, and we found no public information on the company's ownership, so I stop short of the top band. 1 3
The Customer-Service Director
LightOn is a French company with Paris headquarters and a SIREN registration, processing primarily in France or Europe, acting as GDPR processor under a DPA, and the one non-European subprocessor — Sentry — is limited to masked error telemetry under standard contractual clauses with a relay filtering data before transmission. The hosting providers are described only as being "in France or in Europe" and the full processor list is available only on request, and no certification or security-audit statement is published, so the chain is asserted rather than fully evidenced. 1
The Works Council Member
The contracting entity is LightOn SA of Paris, processing is stated to run primarily in France or in Europe on LightOn-controlled inference nodes, and the one named non-European subprocessor, Sentry, is wrapped in SCCs, a DPA, a relay filtering personal data before transmission, and masking of all text and media. The hosting providers themselves are described only as being in France or in Europe, and the full list of processors is available only on request through the DPA, so the chain cannot be verified from the public pages. 1
The Skeptic
The contracting entity is LightOn SA at 2 rue de la Bourse, Paris (SIREN 821 100 690), processing is stated to run in service-provider data centers "in France or in Europe" with inference on LightOn's own nodes, and a DPA is offered — a European provider running its own models, not a wrapper. The one disclosed non-European subprocessor, Sentry Inc., touches only masked error telemetry under SCCs with a relay filtering personal data before transmission. But the hosting providers themselves are unnamed and the full processor list is only available on request, so the chain cannot be verified end to end from public pages. 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a company can compute the real annual cost from public pages alone: price per seat, per agent, per conversation or per usage unit, what is included in each tier, usage limits and overage, which models, connectors or agents cost extra, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or "from" figure exists, but usage limits, included models and what scales the cost are unclear.
5 — Prices per tier are public with the main inclusions, but usage limits, overage, agent runs or enterprise features (SSO, audit logs, EU processing) are unpriced or "on request".
8 — Every tier priced publicly with seat or usage units, usage limits and overage rates, add-ons listed, minimum seats and term stated.
10 — Complete price computability: annual cost derivable for a given number of seats, agents or conversations, with every usage rate, model surcharge, add-on and support tier and the cancellation and data-return terms published.
The Head of IT not rated — no public information
We found no public information on pricing: no seat prices, tiers, usage limits, per-model surcharges or enterprise add-ons appear on the captured pages, which cover the privacy policy and the API documentation. Computing a real annual cost for eight hundred staff is not possible from this evidence. 1 3
The Data Protection Officer not rated — no public information
We found no public information on pricing transparency: the captured privacy policy and documentation pages state retention periods, identity management, connectors and agent features, but contain no prices per seat, per usage unit or per tier, and no statement of what each tier includes. 1 2 3 4 5 6 7 8
The Automation Lead
The captured pages contain no price figures — no per-seat, per-tier or per-usage rates — so a company cannot compute a cost from what we read. The privacy policy shows that cost would be metered on API call volumes, processed tokens and storage space, retained for billing up to 13 months after contract end, but we found no public information on what any of that costs or on minimum terms. 1
The Customer-Service Director not rated — no public information
We found no public information on pricing in the pages read — no per-seat, per-conversation or per-usage figure, no tiers and no starting price appear in the privacy policy, API documentation or datasource documentation. My CFO cannot forecast an annual cost, let alone a price per conversation, from what is public. 1 3 6
The Works Council Member not rated — no public information
We found no public information on pricing in the legal, API, product and user-guide pages we read — no seat prices, tiers, usage limits, agent or connector charges, minimums or terms. A company cannot compute an annual cost from these pages. 1 3 6 8
The Skeptic not rated — no public information
We found no public information on pricing in the captured pages: no per-seat or per-usage price, tier, limit, minimum term or surcharge appears anywhere. The privacy policy confirms card data goes to a payment provider, but states no figure a buyer could use. 1
European sovereignty — proven facts
1 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | US CLOUD Act reach ⚠ unverified | 0/2 pts | 1 Report an error |
Questions about LightOn
Is LightOn European?
Yes. whats-best.ai classifies LightOn as EU-Made.
Where does LightOn store data?
The default storage location for customer data is not stated on the vendor’s pages as of 26 Oct 2026. The vendor’s pages mention France and Europe as hosting locations, per the vendor’s page captured 26 Oct 2026.
Does LightOn have a free plan?
Not stated on the vendor’s pages as of 26 Oct 2026.
What are the best alternatives to LightOn?
As of 28 Oct 2026, the panel rates Langdock (4/5), Dust (3.5/5) and Unique AI (3.5/5) highest among the other 15 AI Agents & Assistants products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Langdock (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: LightOn alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 26 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Legal entity. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Subprocessors. Sentry Inc. is used only for error-reporting and session-replay telemetry of the Console and Paradigm web interfaces (covered by SCCs and a DPA, with a Sentry Relay filtering personal data before transmission), while the hosting/storage providers themselves are unnamed and described only as being "in France or in Europe".
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (developers.lighton.ai/legal/privacy-policy, docs.lighton.ai/en/administration/system-configuration/log-retention-system, docs.lighton.ai/api-reference-v2/models/list-available-models, docs.lighton.ai/en/administration/iam/authentication/sso-activation, docs.lighton.ai/en/administration/iam/user-management/scim-user-provisioning, docs.lighton.ai/en/administration/knowledge-management/data-sources/datasources and 2 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (8)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Privacy policy developers.lighton.ai Checked 26 Oct 2026 Details →
- 2 Data use, training & retention — found from sitemap docs.lighton.ai Checked 26 Oct 2026 Details →
- 3 Models & processing location — found from sitemap docs.lighton.ai Checked 26 Oct 2026 Details →
- 4 Admin, identity & access controls — found from sitemap docs.lighton.ai Checked 26 Oct 2026 Details →
- 5 Admin, identity & access controls — found from sitemap docs.lighton.ai Checked 26 Oct 2026 Details →
- 6 Integrations, connectors & knowledge — found from sitemap docs.lighton.ai Checked 26 Oct 2026 Details →
- 7 Agent capabilities & guardrails — found from sitemap docs.lighton.ai Checked 26 Oct 2026 Details →
- 8 Agent capabilities & guardrails — found from sitemap docs.lighton.ai Checked 26 Oct 2026 Details →