LightOn
- Rank
- Score
- 104/149
- 36 out of 100
LightOn is a French AI company established in Paris in 2016 by Igor Carron, Laurent Daudet, Florent Krzakala and Sylvain Gigan. It develops generative AI solutions for enterprises, is listed on Euronext Growth Paris, and publishes open models such as LightOnOCR for document understanding.
Is LightOnOCR safe?
LightOnOCR scores 36 out of 100 and ranks 104 of 149. Its strongest category is Privacy, and its weakest category is Security.
How is LightOnOCR scored?
LightOnOCR is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Did an outside organisation test the model before release?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
Not enough dataProtecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“LightOn’s services and websites are intended for professional use only and are not intended for use by minors.”
Model documentation
25Points for each confirmed yes.
- Yes
Does the model card describe what the model can do?
Company claim25/25“LightOnOCR-2 is an efficient end-to-end 1B-parameter vision-language model for converting documents (PDFs, scans, images) into clean, natura…” MoreLess
“LightOnOCR-2 is an efficient end-to-end 1B-parameter vision-language model for converting documents (PDFs, scans, images) into clean, naturally ordered text without relying on brittle pipelines.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card report test results?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card state the model's limitations?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card describe safety safeguards?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
No problems found in 1 public record. That is not proof.
Security programme and certifications
0Points for each confirmed yes.
- No
Is there a way to report security flaws, such as a bug bounty?
Company claim0/34No document found - No
Does it state it holds a SOC 2 Type II report?
Company claim0/33No document found - No
Does it state it holds ISO 27001 certification?
Company claim0/33No document found
Software vulnerabilities
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Known-exploited flaws (CISA list) in the company's official software, last 24 months. A disclosed and fixed flaw does not lower the score.
No events
Independent sourceGitHub Advisory Database (opens in a new tab) · 12 Nov 2026
Data breaches
Not enough dataClear privacy policy
100Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“In order to use LightOn’s Sites and Services, we may collect and process the following personal data: Title, last name, and first name of in…” MoreLess
“In order to use LightOn’s Sites and Services, we may collect and process the following personal data: Title, last name, and first name of individuals who have purchased a product from LightOn and those who have contacted us, job applicants, visitors to our websites, participants in one of our games or contests, etc.”
- Yes
Does the privacy policy say whether your data is used to train AI?
Company claim20/20“No use for training purposes: LightOn does not use the input and output data (prompts and completions) submitted or provided via the APIs to…” MoreLess
“No use for training purposes: LightOn does not use the input and output data (prompts and completions) submitted or provided via the APIs to train, fine-tune, or improve its AI models, except upon the Customer’s explicit written request.”
- Yes
Does the privacy policy say how long data is kept?
Company claim20/20“For technical tools such as Sentry, data is automatically deleted after 90 days.”
- Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“We do not share your personal data with anyone, except to comply with the law, assist you, or protect our rights, or if you have given us yo…” MoreLess
“We do not share your personal data with anyone, except to comply with the law, assist you, or protect our rights, or if you have given us your explicit consent to do so.”
- Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“As a customer or user of our Sites and Services, you have the right: To request that the data processed about you be deleted from our files.”
Training-data defaults
100100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- Yes
Is your data used for training only if you opt in?
Company claim100/100“We use it only to provide you with the requested service, and we do not use it to improve our models unless you have explicitly asked us to.”
- No
Can you stop your data being used for training?
Company claim0/50
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“You can request access to it or to retrieve it, request that it be deleted, or that it be used only for certain purposes and not for others,…” MoreLess
“You can request access to it or to retrieve it, request that it be deleted, or that it be used only for certain purposes and not for others, for example, that it not be used to send you information or commercial offers.”
- Yes
Can you delete your data?
Company claim50/50“As a customer or user of our Sites and Services, you have the right: To request that the data processed about you be deleted from our files.”
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
Not enough dataCourt judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“You may contact the person or department responsible for this function at the email address rgpd_rssi@lighton.ai or at LightOn’s mailing add…” MoreLess
“You may contact the person or department responsible for this function at the email address rgpd_rssi@lighton.ai or at LightOn’s mailing address, addressing your correspondence to the attention of the Data Protection Office.”
- Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“You also have the right to file a complaint with a supervisory authority and to seek judicial remedy, particularly if your requests to exerc…” MoreLess
“You also have the right to file a complaint with a supervisory authority and to seek judicial remedy, particularly if your requests to exercise your rights have not been processed within one month of being submitted.”
Score history
Newest first. Only days when the score changed are listed.
2 Nov 2026
Score 36
Method 2 Nov 2026
+2
28 Oct 2026
Score 34
Method 28 Oct 2026, update 2
-1
23 Oct 2026
Score 35
Method 21 Oct 2026
+6 · Data fix
14 Oct 2026
Score 29
Method Not recorded
-