# LightOn — AI Agents & Assistants

LightOn by LightOn SA holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-28. Provenance: EU-Made; sovereignty: 1 of 4 dimensions proven.

- Vendor: LightOn SA (https://www.lighton.ai)
- Category: [AI Agents & Assistants](https://whats-best.ai/software/ai-agents.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/ai-agents/lighton
- Alternatives: https://whats-best.ai/software/ai-agents/lighton/alternatives ([markdown](https://whats-best.ai/software/ai-agents/lighton/alternatives.md))
- Data as of: 2026-10-29 · evaluated 2026-10-28 · oldest source captured 2026-10-26

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: LightOn SA
- Headquarters: Not stated on the vendor’s pages as of 26 Oct 2026
- Data hosting: Default not stated; pages mention France and Europe [S1]
- Free plan: Not stated on the vendor’s pages as of 26 Oct 2026

## The panel's verdict

LightOn's Paradigm is a French AI assistant platform that puts agents on a company's own documents. The bench scored it highest on admin and access: SAML, OIDC and LDAP single sign-on, SCIM 2.0 provisioning tested with Microsoft Entra ID, group-scoped access to agents and datasources, and configurable audit-log retention. Data use and training and sovereignty follow: prompts and completions are excluded from training except on the customer's explicit written request, processing is stated to run in France or in Europe on LightOn-controlled inference nodes, and the one named non-European subprocessor, Sentry, receives masked, relay-filtered telemetry. The genuine split is processing and models: judges crediting the self-hosted option and stateless inference scored 6, while those needing named models and providers to pin the chain scored 4. Agent capabilities and integrations and knowledge show the same spread over undocumented guardrails and a connector set limited to Google Drive and ServiceNow. No prices appear on the captured pages.

**Speaks for it:**
- Prompts and completions are not used to train or improve LightOn's models except on the customer's explicit written request
- Single sign-on via SAML, OIDC and LDAP, with SCIM 2.0 provisioning tested with Microsoft Entra ID
- Group-based control over which agents and workspaces each team reaches, plus per-datasource user access control
- Audit-log retention is administrator-configurable (180 days by default) with automatic anonymisation after the period
- Processing is stated to run in France or in Europe on inference nodes under LightOn's control, with a self-hosted deployment option and a DPA offered

**Held against it:**
- Only model categories are published (large language, embedding, vision, multi-vector), with no individual model, provider or per-model inference region named
- The documented retention job neither deletes nor anonymises ML logs, task results or user chat history, and anonymisation replaces values without removing rows
- We found no public information on run logs, human approval before consequential agent actions, triggers, schedules or evaluation before release
- Only Google Drive and ServiceNow connectors are documented, with no public information on sync frequency or on answers citing their sources
- Hosting providers are unnamed and the full processor list is available only on request, so the chain cannot be verified from public pages

**Best for:**
- You need a European provider with a written no-training commitment and an Article 28 data processing agreement for a compliance-driven rollout
- Your identity stack is Microsoft Entra ID or another SAML/OIDC provider and you need group-scoped access to agents and datasources
- Your knowledge base lives in ServiceNow or Google Drive and staff should search it through chat

**Avoid if:**
- You need named models with published inference regions to pin processing to a specific EU stack
- You need documented approval gates, per-run logs and pre-release evaluation before agents act autonomously
- You must anonymise or delete chat history and model logs on a schedule — the documented retention job excludes them
- Your knowledge lives in systems beyond Google Drive and ServiceNow, such as mail, CRM or a wiki — we found no public information on such connectors

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Head of IT | The Data Protection Officer | The Automation Lead | The Customer-Service Director | The Works Council Member | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Data use, training & retention | 3/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 |
| Models & processing location | 2/5 | 3/5 | 3/5 | 2/5 | 3/5 | 2.5/5 |
| Admin, identity & access controls | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Integrations, connectors & knowledge | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 2/5 |
| Agent capabilities & guardrails | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 2/5 |
| European sovereignty | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **2.5/5** | **3.5/5** | **3/5** |

### The judges

- **The Head of IT** (v1.0): Has to roll an AI assistant out to eight hundred staff without a second shadow-IT wave. Wants SSO and SCIM, groups that decide who gets which model, agent and connector, answers that respect SharePoint permissions, audit logs for the SIEM, and a deployment option that is not "trust us".
- **The Data Protection Officer** (v1.0): Signs the DPA and gets asked where a prompt goes. Wants every model provider named as a subprocessor with its region, training excluded for all of them, retention the company controls, and an EU-only switch that also covers agents and connectors — not just the chat window.
- **The Automation Lead** (v1.0): Builds the agents that file tickets, draft offers and chase approvals across the ERP, CRM and wiki. Wants tools and actions with scoped permissions, MCP and an API, approval steps before anything is sent, run logs, and a way to test an agent before the whole company uses it.
- **The Customer-Service Director** (v1.0): Runs a contact centre with forty agents and wants half the routine calls and chats answered by an AI agent. Wants handover to a human with the full context, actions in the order and ticket systems, evaluation before go-live, and a price per conversation the CFO can forecast.
- **The Works Council Member** (v1.0): Has a co-determination right the moment a tool can monitor staff, and an AI assistant logs every prompt. Wants usage reports that can be aggregated or pseudonymised, prompt logging rules set out in writing, a human approving what agents do to colleagues, and no training on staff input.
- **The Skeptic** (v1.0): Has read "European AI" on a wrapper that sends every prompt to a US model, "agents" that are saved prompts, and "we never train on your data" with no word on the model provider behind it. Asks which model answers, where it runs, what it may do unsupervised, and what a thousand seats cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: 1 of 4 dimensions proven.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | US CLOUD Act reach | 0/2 | [S1] |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Breach notification: 72 [S1]
- DPA available: compliance@lighton.ai · yes [S1]
- Frameworks: yes · yes [S1]
- Processor role: Customer instructions and DPA · yes [S1]
- Scc transfers: yes [S1]

**Data**
- Anonymization no deletion: no · yes · no [S2]
- Anonymization process: all companies · daily · scheduled job anonymizes old LogEntry objects [S2]
- Anonymization reliability fix: Rapid Rabbit release improved reliability of anonymization scheduled tasks [S2]
- Call recording: retained for duration of dispute · 30 [S1]
- Chat retention: 2 [S1]
- Credit card not stored: no [S1]
- Log retention anonymization: GDPR compliance · automatic anonymization of audit logs after retention period [S2]
- Log retention config key: audit logs (LogEntry objects) · LOG_RETENTION_PERIOD_DAYS [S2]
- Retention access logs: 90 [S1]
- Retention billing metrics: 13 [S1]
- Retention connection: 6 [S1]
- Retention contract data: 10 · 3 [S1]
- Retention default days: 180 [S2]
- Retention impacted data: audit logs with personal information such as user identifiers and action metadata [S2]
- Retention not impacted: ML logs (requests, completions, responses) · Pipeline events · Task results · User chat history or conversations · no [S2]
- Retention recruitment: 2 [S1]
- SCIM anonymized user requests: 404 [S5]
- SCIM deactivation: set_active_false [S5]
- SCIM deletion anonymization: anonymization · yes [S5]

**Hosting**
- Location: France · Europe [S1]
- Saas domain: paradigm.lighton.ai [S4]

**Integrations**
- SCIM API key scope: same_company_as_api_key_owner_only [S5]
- SCIM authentication: bearer_token_api_key [S5]
- SCIM base URL: https://[paradigm-domain]/scim/v2/ [S5]
- SCIM endpoints: GET · POST · GET_by_id · PUT · PATCH · DELETE · GET [S5]
- SCIM error handling: standard HTTP codes, SCIM error schema [S5]
- SCIM group attributes: members · displayName [S5]
- SCIM group endpoint: no [S5]
- SCIM supported: 7642 · 7643 · 7644 · 2.0 [S5]
- SCIM tested idps: Microsoft Entra ID [S5]
- SCIM user attributes: name.givenName · name.familyName · title · preferredLanguage · active · password · userName · emails · yes [S5]

**Legal**
- Controller: yes [S1]
- Document drafting source: Materials provided by SysStreaming [S1]
- Entity: 2 rue de la Bourse, 75002 Paris, France · 821100690 [S1]

**Product**
- Access control: Per-datasource user access control [S6]
- Agent API selection: yes [S8]
- Agent definition: An Agent is an AI assistant configured for a specific need/use case, combining instruction, model, tools/MCP, documents and workspaces, and team access [S8]
- Agent detail modal: name · description · available tools · accessible documents · model used · associated team [S8]
- Agent lock mid conversation: yes [S8]
- Agent mode v2 tools: 5 · 1 [S8]
- Agent scoped resources: GET /api/v3/agents/:id · GET /api/v3/agents/:id/files · GET /api/v3/agents/:id/tags [S7]
- Agent v1 archived: yes · yes [S8]
- Agents availability: Wise Wolf (February 2026) [S7]
- Agents create endpoint: POST /api/v3/agents [S7]
- Agents description: Agents support specialized prompts, native tools, MCP servers and scoped workspaces [S7]
- Agents group link: Agent access and workspace access are controlled via Groups [S7]
- Automatic sync: Automated synchronization from external systems [S6]
- Company admin SSO permissions: DEFAULT_SSO_PERMISSIONS_FOR_COMPANY_ADMINS · yes [S4]
- Datasources sync: Datasources sync external knowledge bases within Paradigm without end-user interaction [S6]
- Default agent: Default agent used implicitly when no agent_id specified [S7]
- Deployment types: Self-Hosted · External [S3]
- Dropdown agent limit: 5 [S8]
- Error reporting consent: disabled on interfaces · technically necessary tracker · no [S1]
- Favorites no limit: none [S8]
- Google drive datasource: yes [S6]
- Ldap authentication: yes [S4]
- Legacy scope workspaces by group: scope_workspaces_by_group · yes · yes [S7]
- Model types: Large Language Model · Embedding Model · Vision Language Model · Multi-Vector Model [S3]
- Models endpoint: /api/v2/models · GET · list available models for your API key [S3]
- Models endpoint auth: bearer_token · yes [S3]
- Models endpoint deprecated: yes · GET /api/v3/models [S3]
- Multi agent wise wolf: Wise Wolf · yes [S8]
- No advertising: no [S1]
- No data sale: yes [S1]
- No training on customer data: Customer’s explicit written request · yes [S1]
- Oidc redirect uri: https://<domain_name>/auth/oidc/<provider_id>/login/callback/ [S4]
- Ownership company admin required: Company Admin · System Admin [S7]
- Ownership values: personal · company · team · yes [S7]
- Personal agent creation: creator only · yes [S8]
- SAML acs URL: https://<domain_name>/auth/saml/<client_id>/acs/ [S4]
- SAML attribute mapping: yes [S4]
- SAML debugging: SAML-tracer [S4]
- SAML default email attributes: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress · urn:oid:0.9.2342.19200300.100.1.3 [S4]
- SAML metadata URL: https://<domain_name>/auth/saml/<client_id>/metadata/ [S4]
- SAML nameid: Primary Email [S4]
- SCIM admin panel edits: yes [S5]
- Scoped workspace ids release: Xenial Xerus (March 2026) [S7]
- Servicenow datasource: yes [S6]
- Session replay consent: disabled · yes [S1]
- Session replay masking: yes · yes [S1]
- Session replay retention: 90 [S1]
- SSO instance toggle: yes [S4]
- SSO per company: per-company [S4]
- SSO protocols: SAML · OpenID Connect (OIDC) [S4]
- SSO provider guides: Google · Microsoft [S4]
- SSO user group assignment: yes [S4]
- Stateless inference: only when Customer explicitly activates · yes [S1]
- Team company agents admin created: administrators [S8]
- Team ownership roles: Company Admin · System Admin · group Owner [S7]
- Tools list endpoint: GET /api/v3/tools · GET /api/v3/mcp [S7]
- Unified search: Unified search across all connected data sources [S6]
- Workspace scoping default: all group workspaces · scoped_workspace_ids [S7]
- Workspace scoping effect: yes [S7]

**Subprocessors**
- Sentry: Sentry Inc. · technical monitoring of Console and Paradigm web interfaces · SCCs · DPA · Sentry Relay filtering [S1]

**Support**
- Datasource contact: LightOn support team available for datasource configuration and troubleshooting [S6]

## Questions

### Is LightOn European?

Yes. whats-best.ai classifies LightOn as EU-Made.

### Where does LightOn store data?

The default storage location for customer data is not stated on the vendor’s pages as of 26 Oct 2026. The vendor’s pages mention France and Europe as hosting locations, per [the vendor’s page captured 26 Oct 2026](https://whats-best.ai/evidence/10883).

### Does LightOn have a free plan?

Not stated on the vendor’s pages as of 26 Oct 2026.

### What are the best alternatives to LightOn?

As of 28 Oct 2026, the panel rates [Langdock (4/5)](https://whats-best.ai/software/ai-agents/langdock), [Dust (3.5/5)](https://whats-best.ai/software/ai-agents/dust) and [Unique AI (3.5/5)](https://whats-best.ai/software/ai-agents/unique-ai) highest among the other 15 AI Agents & Assistants products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Langdock](https://whats-best.ai/software/ai-agents/langdock) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [LightOn alternatives](https://whats-best.ai/software/ai-agents/lighton/alternatives).

## What this page leaves out

- We found no public information on pricing on the pages we read (developers.lighton.ai/legal/privacy-policy, docs.lighton.ai/en/administration/system-configuration/log-retention-system, docs.lighton.ai/api-reference-v2/models/list-available-models, docs.lighton.ai/en/administration/iam/authentication/sso-activation, docs.lighton.ai/en/administration/iam/user-management/scim-user-provisioning, docs.lighton.ai/en/administration/knowledge-management/data-sources/datasources and 2 more). If the vendor publishes it somewhere else, send us the page.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Privacy policy: https://developers.lighton.ai/legal/privacy-policy (checked 2026-10-26)
- [S2] Data use, training & retention — found from sitemap: https://docs.lighton.ai/en/administration/system-configuration/log-retention-system (checked 2026-10-26)
- [S3] Models & processing location — found from sitemap: https://docs.lighton.ai/api-reference-v2/models/list-available-models (checked 2026-10-26)
- [S4] Admin, identity & access controls — found from sitemap: https://docs.lighton.ai/en/administration/iam/authentication/sso-activation (checked 2026-10-26)
- [S5] Admin, identity & access controls — found from sitemap: https://docs.lighton.ai/en/administration/iam/user-management/scim-user-provisioning (checked 2026-10-26)
- [S6] Integrations, connectors & knowledge — found from sitemap: https://docs.lighton.ai/en/administration/knowledge-management/data-sources/datasources (checked 2026-10-26)
- [S7] Agent capabilities & guardrails — found from sitemap: https://docs.lighton.ai/en/developer-resources/agents-and-threads/agents (checked 2026-10-26)
- [S8] Agent capabilities & guardrails — found from sitemap: https://docs.lighton.ai/en/user-guides/chat-features/agents (checked 2026-10-26)

---

Cite as: whats-best.ai, "LightOn — AI Agents & Assistants", AI panel analysis, as of 2026-10-29. https://whats-best.ai/software/ai-agents/lighton

Corrections: https://whats-best.ai/correct/1032?target=page