Cohere
Data processing agreements, training opt-outs, enterprise model isolation, and EU AI Act timelines for Cohere Command R+ models.
Governance and contractual terms
- Training use (default)
- Trial API key: data may be used for model improvement. Paid API and Enterprise: no, customer inputs and outputs are explicitly excluded from model training.
- Retention
- Trial API: up to 30 days. Paid API & Enterprise: ephemeral processing in memory; inputs are not retained on disk unless audit logging is enabled by customer.
- Opt-out
- Default for paid API tiers. Free trial users must upgrade to a paid key or request manual opt-out.
- Data residency
- Supported across OCI EU regions (Frankfurt), AWS EU regions, and GCP EU regions via Virtual Private Cloud (VPC) or multi-cloud deployment options.
- Sub-processor list
- Published on Cohere Trust Portal — includes major cloud infrastructure providers (Oracle Cloud Infrastructure, AWS, GCP).
- DPA available
- Yes — standard GDPR Data Processing Addendum available for paid API and enterprise customers.
- Contracting entity
- Cohere Inc. (Toronto, Ontario, Canada)
- EU contracting entity
- Cohere B.V. (Amsterdam, Netherlands) for European customer engagements
- Governing law
- Ontario, Canada law for international API accounts; Dutch law for Cohere B.V. contracts
- Certifications
- SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 42001:2023, HIPAA Compliant
- AI Act Code of Practice
- yes
- Vulnerability disclosure
- Yes — public vulnerability disclosure program and dedicated security contact at security@cohere.com.
- Documented incidents
- No documented unauthorized data breaches or model leakage incidents recorded in primary trust centre releases.
Model inventory
Listed by the AI Act deadline each model falls under, which depends on when it was placed on the EU market rather than on its capability. No benchmark scores — why not.
| Model | API identifier | EU availability | AI Act deadline | Covered by DPA |
|---|---|---|---|---|
| Command R+ Optimized for enterprise RAG and multi-step agent tool use. | command-r-plus | 2024-04-04 | 2 Aug 2026 | Yes — covered under standard Cohere Paid Services Agreement / DPA |
| Command R 128k context length model designed for enterprise retrieval workloads. | command-r | 2024-03-11 | 2 Aug 2026 | Yes |
The short answer
Cohere is an enterprise-focused LLM provider headquartered in Toronto, Canada, with a dedicated European entity (Cohere B.V., Netherlands). For enterprise security teams, Cohere differentiates itself by offering multi-cloud VPC deployment (AWS, GCP, Oracle Cloud Infrastructure) and VPC-isolated API endpoints. Under Cohere’s Paid Services Agreement, customer prompts and fine-tuning data are never used to train base foundation models.
Data retention & model training mechanisms
Cohere enforces a clear contract separation between free evaluation access and paid commercial usage:
1. Free Trial API Keys
- Data submitted via free trial API keys may be retained for up to 30 days and utilized by Cohere to improve model performance and safety filters.
- Verdict: Do not submit customer PII, secret keys, or proprietary code via free trial keys.
2. Paid API & Private Cloud Deployments
- Inputs and outputs are processed ephemerally in memory and discarded immediately after response completion.
- No model training or fine-tuning occurs on customer data.
- Enterprise customers can deploy Cohere weights directly inside their own Virtual Private Cloud (VPC) on AWS, GCP, or Oracle Cloud Infrastructure (OCI Frankfurt), eliminating third-party API exposure entirely.
EU AI Act & GDPR Compliance
Because Canada holds an official EU GDPR Adequacy Decision under Article 45, commercial data transfers to Cohere Inc. benefit from pre-approved cross-border safeguards. In addition, Cohere B.V. allows EU organizations to contract directly under Dutch law with EU regional hosting options.
This record describes contractual and governance terms as read on the date shown, for the tier shown. Providers revise terms without notice — verify against the provider's own documentation before relying on any of it. Nothing here is legal advice.