Mistral AI
What Mistral AI commits to on training use, retention, residency and DPA terms, with a model inventory keyed to AI Act deadlines.
Governance and contractual terms
- Training use (default)
- Le Chat / Vibe (Free, Vibe Pro, Vibe Student): yes, by default, unless the user opts out — 'we do not use Your Data to train our...models except when you use Mistral AI Products under a free subscription, or are subscribed to Vibe Pro or Vibe Student, and you have not opted out of training.' La Plateforme (API): no by default for standard paid use; training does apply to free-tier API use and to explicitly opt-in 'Labs Models' unless zero data retention is active.
- Retention
- Le Chat / Vibe: inputs and outputs kept until the user deletes the conversation or the account. La Plateforme (standard API): 30 rolling days for abuse monitoring, unless zero data retention is activated. Account/identity data tied to KYC-type checks: retained 5 years after account termination.
- Opt-out
- Yes, for Le Chat / Vibe — an account-settings control to object to input/output data being used for training, covering Free, Vibe Pro and Vibe Student. For La Plateforme, the equivalent is a zero-data-retention contract addendum, which also stops any Labs Models training use.
- Data residency
- EU providers are prioritized but not absolute or guaranteed across every data flow — Mistral's Privacy Policy states it prefers EU-based, GDPR-compliant providers but reserves the right to use non-EU providers 'in exceptional cases,' and its DPA permits transfers under EU-adequacy decisions or standard contractual clauses. Primary inference/compute is EU-based (CoreWeave EEA, Mistral Compute France) for all products, but some ancillary sub-processors (a Google US API endpoint, Blackforest Labs, Brave, Stripe) are US-based. Applies broadly to storage and processing; no separate inference-only residency claim was found.
- Sub-processor list
- Published and self-serve at trust.mistral.ai/subprocessors, 25 entries at the time of reading, including Microsoft (cloud infrastructure, Sweden/Norway), Google (cloud infrastructure, Netherlands/Belgium, plus a separate US API endpoint), CoreWeave (inference, EEA), Mistral's own 'Mistral Compute' infrastructure (France), and several US-based ancillary vendors (Blackforest Labs for image generation, Brave for web search, Stripe for billing). The DPA commits Mistral to keeping this list current.
- DPA available
- Yes, published and self-serve with no login gate, incorporated by reference into the Commercial Terms of Service. Applies to commercial/API customers acting as controllers; not clearly applicable to individual Le Chat / Vibe consumer use, where Mistral itself is the controller.
- Contracting entity
- Mistral AI, a French limited joint-stock corporation incorporated in Paris (SIREN 952 418 325, VAT FR95952418325), registered at 15 rue des Halles, 75001 Paris, France. The precise French legal form (SA vs SAS) wasn't confirmed against a company registry — the terms use the English phrase 'limited joint-stock corporation.'
- EU contracting entity
- Mistral AI's sole contracting entity is already French/EU-incorporated — unlike the four US-headquartered providers in this series, there is no separate 'EU subsidiary' distinct from the main contracting party.
- Governing law
- EU consumers: courts of the consumer's own country of residence, or the competent courts of Paris; French law applies. Commercial/Americas customers: California law, Santa Clara County courts. Commercial/APAC customers: Singapore law and courts. Commercial customers elsewhere, including the EU: French law, Paris courts.
- Certifications
- ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2 Type II, SOC 2 Type I
- AI Act Code of Practice
- yes
- Vulnerability disclosure
- Not found in primary sources. No public bug bounty program (HackerOne, Bugcrowd) or security.txt file was located; the closest primary-source channel is Mistral's own security-advisories page and a trust@mistral.ai contact address.
- Documented incidents
- One confirmed, publicly disclosed incident: a supply-chain attack ('Mini Shai-Hulud') that temporarily compromised one of Mistral's codebase management systems, disclosed 14 May 2026 (incident dated 12 May 2026). Mistral states attackers could not access anything beyond certain non-core code repositories, and that hosted services, managed user data, and research/testing environments were not compromised. Several compromised npm and PyPI package versions were named and patched. More severe claims circulating in secondary press (e.g. source code offered for sale) were not confirmed by any primary source and are not included here.
Model inventory
Listed by the AI Act deadline each model falls under, which depends on when it was placed on the EU market rather than on its capability. No benchmark scores — why not.
| Model | API identifier | EU availability | AI Act deadline | Covered by DPA |
|---|---|---|---|---|
| Mistral Large 3 | — | 2 December 2025 | 2 Aug 2026 | Yes |
| Mistral Medium 3.0 | — | 7 May 2025 (a later 'Medium 3.5' point release, dated April 2026, is tracked under the same governance entry) | 2 Aug 2027 | Yes |
| Mistral Small 4 | — | 16 March 2026 | 2 Aug 2026 | Yes for API use; open-weight downloads are governed by the model license, not the DPA |
| Codestral | — | 13 January 2025 (registry entry covers Codestral and subsequent versions) | 2 Aug 2027 | Yes |
| Mistral OCR 4 | — | 23 June 2026 | 2 Aug 2026 | Yes |
Who you are contracting with
Mistral AI is the one provider in this series that doesn’t need a “which entity applies to EU customers” section, because it’s already French: the sole contracting party is Mistral AI, incorporated in Paris (SIREN 952 418 325), for both consumer and commercial terms. Governing law still splits by customer region — French law and Paris courts for EU consumers and most commercial customers, California law for Americas commercial customers, and Singapore law for APAC commercial customers, per the Commercial Terms of Service.
Training use and retention
Le Chat (rebranded Vibe during 2026) trains on conversations by default across its Free, Vibe Pro and Vibe Student tiers — Mistral’s EU Consumer Terms state training happens unless the user has opted out, which puts its consumer default in the same camp as ChatGPT, Claude.ai and Gemini Apps rather than being an exception. La Plateforme, Mistral’s API, runs the opposite default for standard paid usage, with two carve-outs: free-tier API calls, and explicitly opt-in “Labs Models” (Mistral’s label for experimental releases), both of which do train unless zero data retention is active.
Retention differs sharply by product: Le Chat/Vibe keeps conversations until the user deletes them, while the API’s standard window is 30 rolling days for abuse monitoring — shorter than most of the other providers in this series, and disabled entirely under a zero-data-retention agreement.
Residency and sub-processors
Mistral states a preference for EU-based providers but not an absolute guarantee — its Privacy Policy reserves the right to use non-EU providers “in exceptional cases,” and several named sub-processors (a Google API endpoint routed through the US, an image-generation vendor, a web-search vendor, and its billing processor) sit outside the EU. The core inference and compute layer, however — including Mistral’s own “Mistral Compute” infrastructure in France — is EU-based across all products. The sub-processor list itself is unusually transparent for this industry: 25 named entities, each with its function and processing location stated, at trust.mistral.ai/subprocessors.
Certifications
Mistral’s Trust Center lists official certificates for ISO/IEC 27001:2022 and ISO/IEC 27701:2019, plus a SOC 2 Type II letter of attestation (and a Type I attestation alongside it). The full audit reports sit behind a request-access form and weren’t read in full during this pass — the claims above reflect the certificate titles Mistral itself publishes.
AI Act posture
The European Commission’s own list of GPAI Code of Practice signatories names Mistral AI directly, which makes this the most independently corroborated “yes” among the five providers in this series — the other four rely more heavily on the provider’s own self-reported statement. See the framework for why the distinction matters from 2 August 2026.
Model inventory notes
Mistral publishes its own model release dates on an AI-governance registry page (legal.mistral.ai/ai-governance) rather than scattering them across individual announcement posts — that’s the source for the dates above, and it’s a notably more organized primary source than what the other four providers offer for this specific fact. No public bug-bounty program was found for Mistral, which is a genuine gap worth naming rather than papering over — the company is smaller and newer than the other four, and it may simply not have stood one up yet.
This record describes contractual and governance terms as read on the date shown, for the tier shown. Providers revise terms without notice — verify against the provider's own documentation before relying on any of it. Nothing here is legal advice.