Mistral AI - GDPR & Data Privacy Overview (EU)

Version: June 2026 - prepared by WAIMAKERS B.V.

Executive Summary

Mistral AI is a French AI company (Paris-based, ~€11.7 billion post-money valuation following its September 2025 Series C led by ASML, up from ~€6 billion in June 2024) offering frontier large language models through La Plateforme (API) and a hosted chat product Mistral now presents as Vibe (formerly Le Chat); some legal/help materials may still use Le Chat, so procurement should map both names to the exact route.

Key GDPR considerations for European clients:

• ✅ EU company: French startup, Paris headquarters; data hosted in EU by default (Sweden)
• ⚠️ US endpoint is opt-in: Data is hosted in the EU by default; US hosting applies only if you explicitly use Mistral's US API endpoint. Depending on the feature, data may also be temporarily transferred outside the EU to subprocessors under GDPR Art. 46 Standard Contractual Clauses
• ✅ API (La Plateforme): Data NOT used for training; 30-day audit log retention
• ⚠️ Vibe / Le Chat: Current Mistral docs say Vibe Free conversations may be used to improve models unless users opt out, while Vibe Pro, Team, and Enterprise conversations are not used for model training by default. Mistral now presents Vibe as formerly Le Chat, while some legal/help materials still use Le Chat terminology, so verify the selected plan and contract. NO Zero Data Retention (ZDR) is available on the hosted chat route.
• ⚠️ Recent GDPR compliance: Complaint filed with French CNIL in Feb 2025 by a French lawyer alleging that the Le Chat opt-out process was harder for free users than for Pro subscribers; CNIL has NOT yet issued a decision. Mistral added email-based opt-out for free users post-complaint, but the process remains more cumbersome than the button for paid users.
• ✅ SOC 2 / ISO 27001/27701 frameworks: Mistral states it complies with SOC 2 Type II and ISO 27001/27701 frameworks; compliance reports are available through the Trust Center on request
• ✅ Self-deployment option: Full control via open-weight models (Mistral 7B, Mixtral, Mistral Large) on your own infrastructure
• ⚠️ CLOUD Act / transfer risk: Mistral is a French company, but its use of Google Cloud and USA processing means CLOUD Act and subprocessor-access risk should still be assessed for the selected route.
• ✅ Le Chat / Vibe privacy recognition (Feb 2026 independent ranking, under the older Le Chat name)
• ✅ Mistral Compute launched (June 2025): 18,000 NVIDIA chips in France - expanding own EU infrastructure
• ✅ Koyeb acquired (Feb 2026): First acquisition for cloud deployment capabilities
• ✅ €1.2B committed to Swedish AI data centers
• ✅ 1.4GW Paris AI campus planned (with MGX/Bpifrance/NVIDIA)

Recommendation: For GDPR-sensitive workloads, use La Plateforme API or consider self-deployment for maximum control. Treat the hosted chat route (Vibe / Le Chat) as plan- and contract-dependent because it has no ZDR and public docs have changed terminology and plan-default wording.

---

Comparison of Mistral AI Offerings (EU focus)

Notes for Europe

⚠️ Critical Feb 2025 Changes:

• US endpoint available: Data is hosted in the EU by default; data is hosted in the USA only if you explicitly use Mistral's US API endpoint. Other transfers outside the EU are temporary and covered by GDPR Art. 46 SCCs.[1]
• GDPR complaint (CNIL, pending): A French lawyer filed a complaint with CNIL alleging that only Le Chat Pro subscribers (EUR 14.99/month) had a one-click opt-out button, while free users had to email privacy@mistral.ai, and that this was contrary to GDPR Article 12. CNIL has NOT yet issued a decision. Post-complaint, Mistral updated privacy policy Feb 6, 2025 to add email-based opt-out for free users, but the process remains more cumbersome than the button for paid subscribers.[2][3][4]
• Notification policy change: Mistral no longer notifies customers of subprocessor modifications (only additions/replacements), which allowed the USA expansion without notification.[1]

Infrastructure: Google Cloud Platform (Sweden primary, Ireland backup; US endpoint available on opt-in). Mistral Compute launched June 2025 (18,000 NVIDIA chips in France). Koyeb acquired February 2026 for cloud deployment. €1.2B committed to Swedish AI data centers. 1.4GW Paris AI campus planned (with MGX/Bpifrance/NVIDIA).[5][6]

Data retention:

• API: 30-day audit logs for operational/abuse monitoring (not used for training)[7]
• Vibe / Le Chat: No ZDR available on the hosted chat route (architectural requirement for conversation history); data deleted only upon manual user action[8]

Pricing: All prices in EUR. Free: €0; Pro: €14.99/month; Team: €24.99/user/month; Enterprise: custom pricing.[9]

Training controls: Mistral's current privacy docs say Vibe Free conversations may be used to improve models unless users opt out, while Vibe Pro, Team, and Enterprise conversations are not used for model training by default; API data is not used for model training. Because current materials use Vibe/formerly Le Chat terminology and some legal pages may still use Le Chat, confirm the selected plan and contract before relying on a no-training position. User feedback remains a special case and may be used if submitted with thumbs up/down comments.[10]

---

Is Mistral AI GDPR-Compliant?

Short answer: Potentially, but only route-by-route and with documented controls. Vibe / Le Chat is NOT recommended for sensitive data due to (1) no ZDR option, (2) plan-dependent training controls that should be verified in the current admin settings and contract, and (3) USA processing. La Plateforme API or self-deployment are safer options for GDPR-sensitive workloads.

What applies to all plans

• EU company - French startup (Paris) subject to GDPR, French DPA (CNIL)[11]
• EU data hosting - EU by default (Sweden primary, Ireland backup); USA only if you explicitly use Mistral's US API endpoint[6][1]
• DPA available - Standard Data Processing Agreement; subprocessor list at trust.mistral.ai[12]
• Training by route - Current Mistral docs say Vibe Free may be used for model improvement unless opted out, Vibe Pro/Team/Enterprise conversations are not used for model training by default, and API data is not used for model training.[10]
• Encryption - Data encrypted in transit and at rest, replicated across multiple EU zones[13]
• SOC 2 - Available to clients on request[13]

What's plan-dependent

Free, Pro, Team:

• Hosted chat route (Vibe / Le Chat; no API access on Free/Pro; Team includes limited API)
• Free requires opt-out to prevent model-improvement use; Pro/Team no-training default should still be verified in admin settings and contract
• No ZDR (data stored until manual deletion)
• Data may be processed in USA

Enterprise:

• API access with contractual no-training guarantee
• Hosted chat Enterprise no-training by default per current docs; confirm in contract
• Deployment options: on-premises, private cloud, or serverless hybrid
• API ZDR is available on the Scale plan for stateless API calls and is requested via the Help Center/support (approved at Mistral's discretion); confirm covered endpoints and any pricing for your plan
• SOC 2 report access
• Custom retention policies negotiable
• Mistral states it complies with SOC 2 Type II and ISO 27001/27701 frameworks; request current report scope and dates through the Trust Center[14]

---

Vibe / Le Chat (Hosted Chat Interface)

What it is: ChatGPT-style conversational interface accessible through Mistral's hosted chat product. Current Mistral product and privacy materials present this route as Vibe and describe Le Chat as the former name; some legal/help pages may still call it Le Chat.

Training policy: Current Mistral docs say Vibe Free conversations may be used to improve models unless users opt out. Vibe Pro, Team, and Enterprise conversations are not used for model training by default. Feedback submitted with ratings/comments may still be used for model improvement; verify the selected route and contract before relying on this position.[10]

⚠️ Important limitation: Zero Data Retention (ZDR) is NOT available on Vibe / Le Chat for any plan. This is an architectural requirement - Mistral must store conversation data to provide conversation history functionality.[8]

Data deletion: Conversations are stored until:

• User manually deletes conversation, OR
• User deletes entire account

Opt-out / verification process: In the Admin Panel, verify data-sharing/training settings for the selected organization. Free users should disable data sharing if using the hosted chat route; Pro, Team, and Enterprise users should still confirm no-training defaults in admin settings and the executed contract.[10]

Pricing:

• Free: €0/month
• Pro: €14.99/month
• Team: €24.99/user/month
• Enterprise: Custom

When to use: Personal experimentation, non-confidential brainstorming, research with public information.

When NOT to use: Client data, personal data under GDPR, trade secrets, regulated information, any data requiring ZDR.

EU AI Act: Mistral's AI-governance documentation classifies its hosted chat product (Vibe Work/Vibe Code, formerly Le Chat) as not high-risk under the EU AI Act. Broader GPAI transparency obligations and Commission enforcement powers apply from August 2, 2026.[23]

---

La Plateforme (API)

What it is: API access to Mistral's models (Mistral Large 2, Mixtral 8x22B, Mistral Small, etc.) for developers and applications.

Training policy: Data submitted via API is NOT used to train models (contractual guarantee).[15]

Retention: API logs stored 30 days for auditing and abuse monitoring, then automatically deleted.[7]

Enterprise zero-retention check: Public documentation supports 30-day default API log retention, and Zero Data Retention is documented as available on the Scale plan for stateless API calls (requested via the Help Center/support). Confirm covered endpoints and any pricing for your plan.

Data processing: EU by default (Google Cloud, Sweden primary, Ireland backup); USA only if you explicitly use Mistral's US API endpoint. Other non-EU transfers are temporary and covered by SCCs.[6][1]

Compliance: Mistral states it complies with SOC 2 Type II and ISO 27001/27701 frameworks, with compliance reports available on request; final GDPR compliance depends on route, contract, use case, transfer assessment, and configuration.[13][14]

Pricing: Pay-as-you-go or subscription; see mistral.ai/pricing for current rates.

When to use: Production applications, API integrations, automated workflows where contractual no-training guarantee is required.

When NOT to use: If USA processing is unacceptable (consider self-deployment instead).

---

Self-Deployment (Full Control)

What it is: Deploy Mistral's open-weight models (Mistral 7B, Mixtral 8x7B, Mixtral 8x22B, Mistral Large) on your own infrastructure using vLLM, TensorRT-LLM, or TGI.[16]

Training: Your control - no Mistral cloud involvement.

Retention: Your control.

Data residency: Your infrastructure (EU, on-premises, etc.).

Compliance: Your responsibility.

Pricing: No Mistral fees; only your hosting/compute costs.

Recommended engines:

• vLLM (Python-only, OpenAI-compatible API)[17]
• TensorRT-LLM (NVIDIA optimized)[18]
• TGI (Hugging Face)[19]

Infrastructure management tools: SkyPilot, Cerebrium[16]

When to use: Highly regulated industries, air-gapped environments, complete data sovereignty required, USA processing unacceptable.

When NOT to use: Lack of ML/DevOps expertise, small-scale use cases where API is more cost-effective.

---

Data Processing Flow

Vibe / Le Chat (hosted chat interface)

User submits prompt
  ↓
Mistral servers (EU by default; US only via explicit US endpoint) via Google Cloud Platform
  ├─ Processed by selected model
  ├─ Response generated
  └─ Conversation stored (no ZDR option)
      ├─ Free: MAY be used for model improvement unless opted out
      ├─ Pro/Team/Enterprise: NOT used for model training by default per current docs
      └─ Feedback with ratings/comments: may still be used for improvement

Data persists until:
  - User manually deletes conversation, OR
  - User deletes account

Note: Feb 2025 GDPR complaint (CNIL decision pending) led to privacy policy updates around opt-out for free users. Current Mistral docs and product pages use Vibe/formerly Le Chat terminology, so verify the current in-product setting and executed contract before rollout.[2][4]

La Plateforme (API)

API request
  ↓
Mistral servers (EU by default; US only via explicit US endpoint) via Google Cloud Platform
  ├─ Processed by selected model
  ├─ Response returned to client
  └─ Logs stored 30 days (audit/abuse monitoring)
      ├─ NOT used for training (contractual)
      └─ Automatically deleted after 30 days

Enterprise:
  - Tokens stored 30 days by default; confirm any zero-retention option contractually
  - On-premises, private cloud, or serverless hybrid deployment options
  - Custom retention policies negotiable

Self-Deployment

API request
  ↓
Your infrastructure (your control)
  ├─ Processed by self-hosted model
  ├─ Response returned
  └─ No Mistral cloud involvement

Data handling: Your responsibility

---

Recommendations (GDPR-first)

✅ Safe for production (with caveats)

• La Plateforme API for applications where 30-day audit retention is acceptable and USA processing is acceptable
• Self-deployment for air-gapped, highly regulated, or EU-sovereignty-required environments

⚠️ Use with caution

• Vibe / Le Chat Team/Enterprise only for internal collaboration on non-sensitive data (no ZDR available)
• API without custom contract if USA processing is a concern (request EU-only processing if available)

❌ Do not use

• Vibe / Le Chat (any tier) for client personal data, trade secrets, regulated data, or anything requiring ZDR
• Any Mistral offering if USA processing is unacceptable and self-deployment is not feasible

DPIA required for

• Processing personal data via Vibe / Le Chat (any tier)
• High-risk processing via API without custom DPA
• Any use case involving special category data

---

EU Rollout Checklist (Practical)

1. Choose the right product

• ✅ API (La Plateforme) for production apps with no-training requirement
• ✅ Self-deployment for full sovereignty and EU-only processing
• ❌ Vibe / Le Chat for sensitive/confidential data (no ZDR; verify plan-specific training settings and contract)

2. Review DPA and subprocessors

• Request DPA from Mistral (standard available)
• Review subprocessor list at trust.mistral.ai[12]
• Note: Google Cloud Platform is primary subprocessor (EU + USA as of Feb 2025)[1]

3. Configure training opt-out

• Vibe / Le Chat Free: disable data sharing in admin/user settings if used. Pro/Team/Enterprise: verify the no-training default in admin settings and the executed contract.[10]
• API: No-training guarantee is contractual (verify in agreement)[15]

4. Document data flows

• Where data is processed: EU (Sweden/Ireland) + USA
• Retention periods: API 30 days, hosted chat until manual deletion
• Training policies: API no training; hosted chat route depends on plan and verified settings

5. Request compliance documentation

• SOC 2 report (available to clients on request)[13]
• SOC 2 Type II and ISO 27001/27701 report scope and dates[14]
• DPA and Standard Contractual Clauses (if USA transfer concerns)

6. Assess USA transfer impact

• Feb 2025 change allows USA processing without notification
• If unacceptable: negotiate EU-only processing or use self-deployment

7. Implement data minimisation

• Only submit necessary data to API or hosted chat
• Strip PII before submission where possible
• Use pseudonymisation for identifiers

8. User rights management

• Hosted chat: Users can delete conversations manually
• API: Request deletion procedures from Mistral for 30-day logs
• Document how to handle GDPR subject access requests

---

Procurement Q&A

Q: Is Mistral AI a European company?

A: Yes. Mistral AI is a French startup headquartered in Paris (15 rue des Halles, 75001 Paris), founded April 2023, valued at ~€11.7 billion post-money following its September 2025 Series C (led by ASML), up from ~€6 billion in June 2024.[11][20]

Q: Where is data stored and processed?

A: Primary hosting in Sweden via Google Cloud Platform, with backup in Ireland. Data is hosted in the EU by default; it is hosted in the USA only if you explicitly use Mistral's US API endpoint, and other non-EU transfers are temporary and covered by SCCs.[6][1] Mistral is also building a data center near Paris (Bruyères-le-Châtel), backed by an ~€750 million ($830M) raise, separate from its ~€1.2 billion committed to AI data centers in Sweden.[5]

Q: Does Mistral use my data to train models?

A: Depends on product:

• La Plateforme API: NO. Contractual guarantee that API data is not used for training.[15]
• Vibe / Le Chat: Current Mistral docs say Free conversations may be used for model improvement unless opted out; Pro, Team, and Enterprise conversations are not used for model training by default. Verify in admin settings and contract.[10]

Q: Is Zero Data Retention (ZDR) available?

A: Vibe / Le Chat: NO ZDR on any plan (architectural limitation for conversation history).[8]

API: 30-day audit log retention by default. Zero Data Retention is documented as available on the Scale plan for stateless API calls, requested via the Help Center/support and approved at Mistral's discretion; confirm covered endpoints and any pricing for your plan.

Self-deployment: Full control over retention.

Q: What was the Feb 2025 GDPR complaint about?

A: A French lawyer filed a complaint with the CNIL (French data protection authority) alleging that only Le Chat Pro subscribers (EUR 14.99/month) had a one-click opt-out button to disable training on their data, while free users were required to email privacy@mistral.ai, and that this made data-subject-rights exercise harder for free users. CNIL has NOT yet issued a decision. Post-complaint, Mistral updated its privacy policy on Feb 6, 2025, adding email-based opt-out for free users, but the disparity in ease of opt-out between free and paid users persists.[2][3][21][4]

Q: What compliance certifications does Mistral have?

A:

• ✅ SOC 2: Available to clients on request[13]
• ✅ SOC 2 / ISO 27001/27701 frameworks: Mistral states it complies with SOC 2 Type II and ISO 27001/27701 frameworks; request current compliance reports through the Trust Center[14]
• ✅ GDPR framework: French company subject to GDPR, with route-specific controls still requiring review
• ❌ HIPAA: Not mentioned in public documentation

Q: Can I restrict data processing to EU only?

A: EU hosting is the default; data is hosted in the USA only if you explicitly use Mistral's US API endpoint, and other non-EU transfers are temporary and covered by SCCs.[1] Options:

• Use the EU (default) API endpoint and avoid the US endpoint; for the strictest needs contact Mistral Enterprise sales
• Use self-deployment for full control over data location

Q: How long is data retained?

A:

• API: 30 days (audit logs only, then automatic deletion)[7]
• Vibe / Le Chat: Until user manually deletes conversation or account[8]

Q: What models are available for self-deployment?

A: Mistral 7B, Mixtral 8x7B, Mixtral 8x22B, Mistral Large (123B parameters). All available under permissive open-weight licenses.[20][16]

Q: What is Mistral's relationship with Microsoft Azure?

A: Strategic partnership launched 2024. Mistral models (Large 2, Mixtral, Nemo, etc.) available via Azure AI Foundry as Model-as-a-Service (MaaS) or real-time endpoints. Azure deployment is governed by Microsoft's DPA and compliance framework (separate from Mistral's own cloud).[20][22]

---

Notes & Caveats

⚠️ Feb 2025 subprocessor/notification change: In Feb 2025 Mistral updated its subprocessor terms and notification policy (now notifying only of subprocessor additions/replacements, not modifications). Under Mistral's current data-storage documentation, EU hosting is the default and US hosting applies only when you explicitly use the US API endpoint; assess US-transfer risk for your selected route.[1]

⚠️ No Vibe / Le Chat ZDR: Zero Data Retention is not available on the hosted chat route because conversation history requires persistent storage. This applies to all plans including Enterprise.[8]

⚠️ Verify compliance-report scope: Mistral currently states it complies with SOC 2 Type II and ISO 27001/27701 frameworks. Request the current reports through the Trust Center and verify scope, dates, and covered services before relying on them for procurement.[14]

⚠️ Hosted chat training settings require verification: Current Mistral docs say Vibe Free may be used for model improvement unless opted out, while Vibe Pro/Team/Enterprise conversations are not used for model training by default. Verify the current admin setting and contract before relying on this.[10]

✅ EU company advantage: As a French company, Mistral is directly subject to GDPR and French DPA (CNIL) oversight, which may provide stronger enforcement compared to non-EU vendors.

✅ Open-weight models: Mistral's commitment to open-weight models (Mistral 7B, Mixtral) enables self-deployment, giving enterprises full control over data and eliminating cloud vendor risk.

⚠️ GDPR complaint history: A French lawyer filed a complaint with CNIL in Feb 2025, alleging that only Le Chat Pro subscribers had a one-click opt-out button while free users had to email privacy@mistral.ai, and that this was contrary to GDPR Article 12. CNIL has NOT yet issued a decision. Post-complaint, Mistral added email-based opt-out for free users (Feb 6, 2025 policy update), but the opt-out remains more cumbersome for free users than for paid subscribers. CNIL issued guidance on GDPR legal bases for AI training in June 2025.

⚠️ CLOUD Act / transfer risk: Mistral is incorporated in France, but Mistral's Google Cloud subprocessor footprint includes USA processing. Assess CLOUD Act, subprocessor-access, and transfer risks for the exact deployment route rather than treating Mistral as EU-only.

✅ Mistral Compute (June 2025): Launched own compute infrastructure with 18,000 NVIDIA chips in France, reducing dependence on Google Cloud Platform.

✅ Koyeb acquisition (Feb 2026): Mistral's first acquisition adds cloud deployment capabilities for European customers.

✅ Le Chat / Vibe privacy ranking: The hosted chat product topped an independent AI privacy ranking in February 2026 under the older Le Chat name, recognising its training controls and EU hosting.

---

Disclaimer

This overview is intended solely as an informative tool. We strongly advise customers to thoroughly review all Data Processing Agreements (DPAs) and privacy documentation before deploying Mistral AI in production environments - especially when personal data, trade secrets, or regulated information are processed.

WAIMAKERS applies this same principle internally; all tools we use have been thoroughly assessed and included in our own privacy and security documentation.

Customers should always carefully evaluate the official documentation, terms, and DPAs of each AI provider they use. WAIMAKERS cannot be held legally liable for any mistakes, errors, inaccuracies, or for the accuracy, currency, or completeness of the information in this document; the ultimate responsibility for GDPR compliance rests with the customer.

Key areas requiring direct verification with Mistral:

• Enterprise Zero Data Retention availability and pricing
• EU-only processing options and pricing
• Current SOC 2 / ISO 27001/27701 report scope, dates, and covered services
• Custom DPA terms for highly regulated industries

Prepared and issued by WAIMAKERS B.V. - June 2026.

---

References

• https://mistral.ai/static/doc/fr-politique-de-confidentialite.pdf - Mistral AI Privacy Policy (February 6, 2025)
• https://www.lefigaro.fr/secteur/high-tech/rgpd-mistral-ai-accuse-d-exploiter-illegalement-les-donnees-personnelles-de-ses-utilisateurs-20250212 - Le Figaro: Mistral AI GDPR Complaint
• https://help.mistral.ai/en/collections/789666-trust-security-compliance - Mistral AI Trust, Security & Compliance
• https://help.mistral.ai/en/articles/347638-do-you-have-soc-2-or-iso-27001-certification - Mistral AI: SOC 2 and ISO 27001/27701 framework statement
• https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models - Mistral AI: Training on User Data Policy
• https://docs.mistral.ai/admin/security-access/privacy - Mistral docs: Vibe/API data usage and training controls
• https://help.mistral.ai/en/articles/156194-does-mistral-ai-exploit-users-data-to-train-its-models - Mistral AI API Training Policy
• https://trust.mistral.ai/ - Mistral AI Trust Center and Subprocessors
• https://docs.mistral.ai/deployment/self-deployment/overview - Mistral AI Self-Deployment Documentation
• https://sifted.eu/articles/mistral-privacy-policy-gdpr-news - Sifted: Mistral privacy policy update and GDPR complaint coverage
• https://legal.mistral.ai/ai-governance/ai-systems/le-chat - Mistral AI: Le Chat EU AI Act classification and governance