Where do you stand? › Route 3 · Vendors & stack
I know which systems I need — who supplies them?
Pick the components you have to put in place. For each one you get the build-vs-buy reading and the market layer that supplies it, with the same scored recommendations and confidence the full analysis uses. Nothing is stored; the selection lives in the URL.
Target market(s)European UnionUnited States (federal)change
Legally-driven components are flagged when their requiring regulation sits outside your selected markets.
density
Step 1 of 2 — pick your components1 selected
Data Lineage & Versioning
Step 2 of 2 — the vendor & stack view
1 of 1 selected components are covered by 2 market layers.
Named vendors are community-maintained, disputable examples — not an endorsement. The stable object is the market layer. Compare with the reference stack for your regulatory profile →
Build or buy, per component (1)
Data Lineage & Versioning buy (products exist) DEthinCNEU
A Secure Data Infrastructure & Vector Storage / Grounding, Retrieval & Agent Memory product can carry this; the buyer's duties stay with you.
Required by: BaFin MaRisk (Mindestanforderungen an das Risikomanagement), Data Security Law (CN), Interim Measures for Generative AI Services (CN), Unfair Commercial Practices Directive in forcein forcein forcein force
Legally required in EU (your selected markets); also required in DE, CN, which you have not selected. Help verify coverage →
Secure Data Infrastructure & Vector Storage — covers 1 of your components
Covers: Data Lineage & Versioning. This layer supplies 5 components in the graph.
Confidence: moderate (66/100)
Community-maintained examples
Snowflake Cortex · Databricks Unity Catalog · Azure AI Search · Relyance AI
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Azure AI Search | managed retrieval | Managed hybrid search with security trimming against tenant identities. Typical: ACL-aware RAG, enterprise search. | not checked | ISO 27001 (claimed)SOC 2 (claimed) |
| Databricks Unity Catalog | governed lakehouse | Catalog and lineage spanning tables, features and RAG chunks. Typical: lineage evidence, governed RAG. | not checked | SOC 2 (claimed)lineage/Art. 10 support (claimed) |
| Relyance AI | code-level data & AI lineage | Parses source repositories to map data and inference flows at code level, with CI checks on changes to those flows. Typical: data lineage, shift-left privacy review. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | GDPR programme tooling (claimed)EU AI Act readiness positioning |
| Snowflake Cortex | governed lakehouse | Model calls inside the warehouse boundary with masking and clean rooms. Typical: in-warehouse inference, governed analytics. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Select on
namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability
Why this confidence
- 1 in-scope component of this use case is supplied by this layer (Data Lineage & Versioning) — a direct supplied_by path in the graph.
- The catalog use-case match is strong, so the component set this layer was derived from is reliable.
- High-risk tier: this layer carries mandatory Chapter III duties, so some tooling in it is non-optional.
- 4 community-maintained example vendors recorded on the layer node.
- Selection metrics for this layer are documented, so the shortlist can be compared objectively.
- Only 1 of 5 components this layer supplies are in your scope — evaluate a narrow subset of its capabilities.
Alternatives
- Grounding, Retrieval & Agent Memory — confidence moderate (66/100, +0 vs. this layer); overlapping coverage, no additional selected component
Grounding, Retrieval & Agent Memory — covers 1 of your components
Covers: Data Lineage & Versioning. This layer supplies 8 components in the graph.
Confidence: moderate (66/100)
Community-maintained examples
Docling · LlamaParse · Amazon Textract · Diffbot · Firecrawl · Voyage AI · Nomic · Pinecone · Weaviate · Qdrant · Milvus · pgvector · Letta (MemGPT) · Mem0 · Zep · Cognee
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Docling | document parser | Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines. | self-hostable | EU sovereignty positioning |
| LlamaParse | document parser | Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction. | not checked | SOC 2 (claimed) |
| Amazon Textract | document parser | OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing. | not checked | SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed) |
| Diffbot | web/knowledge extraction | Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution. | not checked | vendor-stated security posture |
| Firecrawl | web/knowledge extraction | Crawling and clean markdown extraction for grounding on public sources. Typical: regulatory monitoring, public-source grounding. | not checked | vendor-stated security posture |
| Voyage AI | embeddings | Domain-tuned embedding models including legal and finance variants. Typical: retrieval quality, domain RAG. | not checked | vendor-stated security posture |
| Nomic | embeddings | Open embedding models with local inference and dataset visualisation. Typical: on-prem retrieval, dataset inspection. | self-hostable | |
| Pinecone | vector database | Managed serverless vector search with namespace isolation. Typical: tenant-isolated RAG, semantic search. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed) |
| Weaviate | vector database | Vector database available managed or self-hosted with hybrid search. Typical: hybrid retrieval, self-hosted RAG. | open source | SOC 2 (claimed) |
| Qdrant | vector database | Open-source vector store with payload filtering and on-prem deployment. Typical: air-gapped RAG, filtered retrieval. | open source | GDPR-positioned |
| Milvus | vector database | Open-source vector database for very large collections. Typical: large-scale retrieval. | open source | |
| pgvector | vector database | Postgres extension keeping vectors under the same RBAC, backup and retention regime as records. Typical: record-bound retrieval, small-scale RAG. | self-hostable | record-retention alignment (claimed) |
| Letta (MemGPT) | agent memory store | Persistent agent memory with explicit memory blocks and editing. Typical: long-running agents, personalisation. | self-hostable | |
| Mem0 | agent memory store | Memory layer extracting durable facts from agent conversations. Typical: personalised agents, support copilots. | not checked | vendor-stated security posture |
| Zep | agent memory store | Temporal knowledge-graph memory with fact validity intervals. Typical: auditable memory, long-running agents. | not checked | GDPR-positionedbitemporal record positioning |
| Cognee | agent memory store | Open-source memory/knowledge pipeline building graphs from agent interactions. Typical: knowledge accumulation, research agents. | self-hostable |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Select on
Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.
Why this confidence
- 1 in-scope component of this use case is supplied by this layer (Data Lineage & Versioning) — a direct supplied_by path in the graph.
- The catalog use-case match is strong, so the component set this layer was derived from is reliable.
- High-risk tier: this layer carries mandatory Chapter III duties, so some tooling in it is non-optional.
- 16 community-maintained example vendors recorded on the layer node.
- Selection metrics for this layer are documented, so the shortlist can be compared objectively.
- Only 1 of 8 components this layer supplies are in your scope — evaluate a narrow subset of its capabilities.
Alternatives
- Secure Data Infrastructure & Vector Storage — confidence moderate (66/100, +0 vs. this layer); overlapping coverage, no additional selected component