IBM Granite

United States0 models on Stav

Granite is built by IBM, a US-incorporated and US-headquartered company, so CLOUD Act and FISA 702 exposure applies to IBM-operated services. That exposure largely falls away if customers self-host the Apache 2.0 weights inside the EU. The trust signals are strong: an ISO/IEC 42001 certified AI management system for the Granite language models, cryptographically signed checkpoints, a bug bounty programme, and IBM's signatory status on the EU GPAI Code of Practice. The main caveats are US jurisdiction, no named DPO found, and a hosted-endpoint retention policy that Stav cannot audit.