Mistral Le Chat

Data-handling profile

Trains on input

Yes, on the consumer tier (enterprise tier excluded)

Retention

Free-tier Le Chat conversations may be used for model improvement unless user opts out; paid Le Chat and API users are opted out of training by default. Standard retention is 30 rolling days for abuse monitoring; Le Chat Enterprise offers zero data retention on request and an incognito mode.

Data region

EU

Certifications

SOC 2 Type IIISO 27001ISO 27701

DPA available

Yes

Breach history

none known

EU AI Act

French/EU-headquartered vendor processing data in France (SecNumCloud-certified infra via Outscale for enterprise); positioned for native GDPR and EU AI Act alignment, reducing cross-border transfer risk.

By plan and surface

Vendor-level answers are often wrong for a specific tier. These are the precise claims, each with the verbatim sentence we relied on.

• enterprise/web: “Please note that we do not use your Input and Output to train our artificial intelligence models when you use Le Chat Enterprise or the paid version of our APIs.”
• api/api: “Please note that we do not use your Input and Output to train our artificial intelligence models when you use Le Chat Enterprise or the paid version of our APIs.”

Sources

• https://legal.mistral.ai/terms/privacy-policy
• https://docs.mistral.ai/admin/monitor-comply/privacy-data-controls
• https://help.mistral.ai/en/articles/393497-do-you-use-my-connectors-data-for-traininglink no longer resolves
• https://help.mistral.ai/en/articles/347638-do-you-have-soc-2-or-iso-27001-certification
• https://trust.mistral.ai/

Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes. 1 of these 5 links no longer resolve. We record what we relied on rather than deleting it, so the trail stays auditable — but a struck-through source cannot be re-checked today.

Control mapping

Obligations this vendor triggers, each attributable to the fact it rests on — for your supplier register, not a compliance determination.

• EU AI Act Art. 50 — Transparency obligations for AI systemsattention

  trains_on_input = consumer_tier. Inputs may be reused for model training — users interacting with this system need to be informed accordingly.

• EU AI Act Art. 26 — Obligations of deployers of high-risk AI systemsapplies

  Applies to your organisation as deployer, independent of vendor. Assign human oversight, keep logs, and monitor operation where this tool is used in a high-risk context (Annex III duties apply from 2 Dec 2027).

• ISO/IEC 27001 A.5.19 — Information security in supplier relationshipsapplies

  Mistral Le Chat processes organisational data as a supplier. Include this vendor in the supplier register and risk assessment.

• ISO/IEC 27001 A.5.20 — Addressing information security within supplier agreementsok

  dpa_available = true. A data processing agreement is available and should be executed.

• ISO/IEC 27001 A.5.23 — Information security for use of cloud servicesattention

  Cloud AI service; trains_on_input = consumer_tier. Data submitted to this cloud service may be retained or reused — define acceptable-use rules for it.

• ISO/IEC 42001 A.10.3 — Suppliers of AI systems and servicesapplies

  certifications: SOC 2 Type II, ISO 27001, ISO 27701 No AI-management certification identified; assurance must come from your own supplier assessment.

• GDPR Art. 44–49 — International transfers of personal dataok

  data_region = EU. Processing region is within the EU/EEA.

• NIS2 Art. 21(2)(d) — Supply chain securityapplies

  AI vendor forms part of your ICT supply chain. In scope for entities covered by NIS2; include in supply-chain risk measures.

• DORA Art. 28 — General principles for ICT third-party riskapplies

  AI vendor is an ICT third-party service provider. For financial entities: register of information and contractual requirements apply.

Change history

No material changes recorded since monitoring began.