# Black Forest Labs / FLUX ## Kurzbeschreibung **The frontier AI research lab for visual intelligence.** **Black Forest Labs** is the company behind the FLUX models for AI-based image generation and image editing. The platform includes Playground, API, open-weights/self-hosting licenses, and enterprise offerings for visual AI workflows. FLUX.2 is officially described as a production model for image generation and image editing with multi-reference control and up to 4MP output. ## Claim The frontier AI research lab for visual intelligence. ## Geeignet für - API Integration - Images - Design / Graphics - Marketing & Advertising ## Kernfunktionen - Image Editing - Image Generation - Illustrations ## Preismodell - **free:** Free or trial-based entry via the Playground; suitable for trying out FLUX.2 and image generation without your own integration. - **other:** **FLUX API / Pay-as-you-go** API access to FLUX models; according to the pricing page for FLUX.2, FLUX Kontext, and additional image models with usage-based billing. **FLUX.2 [small]** Fastest model variant for real-time use, prototyping, rapid iteration, and high speed; according to the model page also runnable locally and fine-tuning-ready. **FLUX.2 [pro]** Production-oriented image generation and image editing with high quality and scalability. **FLUX.2 [flex]** Variant for precise control, typography, small details, and finer visual control. **FLUX.2 [max]** Highest-quality variant with particularly strong prompt adherence, editing consistency, professional output, and grounding features. **Self-Hosted Commercial License** License for downloading, hosting, and using certain FLUX-[dev] models in your own applications; API resale or third-party API access is excluded without the corresponding rights. **Enterprise / Custom Deployment** Custom enterprise options with dedicated infrastructure, custom fine-tuning, and integration support. ## DSGVO und Datenschutz **Gesamteinschätzung:** Conditional **On-premises / local hosting: supported** On the Enterprise and Licensing pages, self-hosted/open weights are clearly mentioned. The website describes “Deploy in your private cloud or on-premises with complete data isolation” as well as “Run FLUX models on your own infrastructure.” **Private Cloud / Data Center: Covered** The website explicitly mentions private cloud and dedicated infrastructure: “Deploy in your private cloud” and, in the Enterprise section, “Dedicated instances with zero data retention and network isolation.” **EU SaaS / Managed: Partially** A managed SaaS/API/Playground service is clearly available. However, for EU/EEA-relevant requirements, the website lacks specific details regarding EU data residency, EU/EEA data centers, or a specific server location. **Hybrid: Partially** The website shows a possible combination of API and Weights (“API + Weights combo pricing”) as well as co-built production pipelines. However, an explicit hybrid operating model with a clearly documented division of processing is not described in detail. **T&C / DPA: unclear** No publicly linked TAA/DPA can be found on the website. There is only a general reference to “tailored contractual arrangements” in the Enterprise context. The website does not specify whether a TAA/DPA is offered as standard. **No Training: Indirect / Not Available** For the standard services, the Terms argue against a clear “no training” policy, as the Terms state that input and output may be used for development, improvement, and training. The only positive aspect, albeit indirect, is the Enterprise/Self-Hosted path with “zero data retention” and “no external calls,” but a general, publicly documented training opt-out for SaaS is not specified on the website. **Open-Source / Transparency Path: Covered** The website offers a clear transparency/sovereignty path via “Open Weights,” self-hosting, fine-tuning rights, and references to GitHub/Hugging Face. This is not a complete product described as fully open source, but it is a clearly documented open/self-hostable model path. **Data Processing** The website clearly distinguishes between standard services and customer-specific setups. For standard services, general terms apply under which input and output may be used for deployment, development, training, and improvement. For Enterprise/Self-Hosted, however, stronger control mechanisms are described: Operation on the customer’s own infrastructure, private cloud/on-premises, no external calls, dedicated instances, “zero data retention,” and network isolation. For EU/EEA users, this controlled deployment path is significantly more favorable from a data protection perspective than general SaaS usage. **Conclusion** For an EU/EEA tool directory, the overall rating is **conditional**. The website provides positive indications for data-protection-friendly enterprise and self-hosted use with a high degree of data sovereignty, but lacks sufficiently clear documentation regarding EU/EEA server locations, EU data residency, the Data Processing Agreement (DPA), and subprocessors for the standard SaaS variant. According to the website, anyone who wants to use FLUX in the EU/EEA in a manner that is as GDPR-compliant as possible should opt for self-hosted/open weights or a dedicated enterprise environment, rather than the general standard usage. **Sources** - [https://bfl.ai/](https://bfl.ai/) - [https://bfl.ai/enterprise](https://bfl.ai/enterprise) - [https://bfl.ai/licensing](https://bfl.ai/licensing) - [https://bfl.ai/legal/privacy-policy](https://bfl.ai/legal/privacy-policy) - [https://bfl.ai/legal/terms-of-service](https://bfl.ai/legal/terms-of-service) - [https://bfl.ai/legal/self-hosted-commercial-license-terms](https://bfl.ai/legal/self-hosted-commercial-license-terms) For the EU/EEA region, there is no clear evidence that the standard SaaS version complies with the GDPR. On the positive side, the provider describes on its website **self-hosting**, **private cloud/on-premises operation**, **dedicated instances with “zero data retention” and “network isolation,”** as well as **GDPR-compliant data processing** in an enterprise context. At the same time, according to the Terms of Service, general SaaS/website use allows for very extensive use of input and output data for further development and training. The simplest and best option for EU/EEA users is therefore the self-hosted or dedicated enterprise path, rather than the freely accessible standard SaaS usage. **Positive** The website lists self-hosted/open-source options, including “Deploy in your private cloud or on-premises with complete data isolation,” “No external calls: all inference runs inside your environment,” and “Full data sovereignty on your own infrastructure.” In addition, the Enterprise page mentions dedicated instances with “zero data retention and network isolation” as well as certifications/standards such as ISO 27001, SOC 2 Type II, and “GDPR-compliant data processing is standard.” **Negative** The website does not specify EU/EEA data residency or a specific server location for the standard services. A publicly linked page for the Terms of Service (TOS) or Data Processing Agreement (DPA), or a list of subprocessors, is also not available. Particularly critical: In the general terms, the user grants the provider a worldwide, perpetual, and irrevocable license to use input and output to “develop, train, and improve” technologies, products, and services. The website does not specify an explicit opt-out option from AI training for this standard use. **Server location** Not specified on the website. Although Enterprise, Self-Hosted, and Private Cloud options, as well as Azure AI Foundry, are mentioned, no specific EU/EEA data center, country, or binding EU data residency is specified for the standard SaaS version. ## Hosting und Daten - **On-Prem / lokales Hosting:** abgedeckt - **Private Cloud / Rechenzentrum:** abgedeckt - **EU SaaS / Managed:** teilweise / indirekt - **Hybrid:** teilweise / indirekt - **AVV / DPA:** unknown - **Kein Training auf Kundendaten:** unknown - **Open-Source / Transparenz-Pfad:** abgedeckt ## Standort **Land:** Germany **Taxonomie:** Germany BFL GmbH, Ingeborg-Krummer-Schroth-Straße 18, 79106 Freiburg im Breisgau, Germany. Commercial Register ## Vorteile - Very strong image generation and image editing - FLUX.2 model family for text-to-image and image editing - API and playground for a quick start - Open weights for your own infrastructure and fine-tuning - Enterprise options for private cloud, on-premise, and dedicated endpoints - Roles, organizations, projects, API keys, usage tracking, and activity logs for teams - ISO 27001 and SOC 2 Type II are listed on the enterprise side as security certifications ## Nachteile - Focus almost exclusively on visual AI, not on text, chat, meeting notes, or office workflows - Standard privacy policy permits the use of interactions, prompts, images, and outputs for the development, training, and improvement of the services - Legal structure requires explanation: the legal notice names BFL GmbH in Freiburg, while the Privacy Policy/Terms name Black Forest Labs Inc. with a US contact address - DPA/vendor documents are available upon request according to the enterprise page, but are not publicly directly accessible - Specific API/playground server regions are not clearly documented publicly - Self-hosting licenses include obligations regarding content filtering, reporting, and restrictions on API forwarding ## Quellen - Offizielle Website: https://bfl.ai/ ## Letzter Datenstand 2026-05-04 ## Originalseite https://kifox.ai/en/ki-tools/black-forest-labs-flux-en/