Mistral
Mistral AI SAS · FR · Last reviewed: 2026-07-27
Data Protection Contracts
83/100Mistral AI provides a Data Processing Addendum (DPA) in accordance with Art. 28 GDPR.
jaSource: Mistral AI Data Processing Addendum (Effective 12.03.2026), Gesamtdokument (Auftragsverarbeitungsvertrag) (reviewed 2026-07-24)
Mistral AI has EU Standard Contractual Clauses (SCCs) in place for international data transfers.
jaSource: Mistral AI Data Processing Addendum (Effective 12.03.2026), §8.1 (Transfer-Vorabautorisierung via SCCs) (reviewed 2026-07-24)
Mistral AI contractually notifies security incidents 'without undue delay'; no quantified deadline exists, and one can only be negotiated via an Enterprise agreement.
teilweiseSource: Mistral DPA (12.03.2026) + schriftl. Support-Bestätigung 28.07.2026, DPA §6.1; Support-Antwort Punkt 5 (reviewed 2026-07-28)
Data Residency & Sovereignty
67/100Mistral AI hosts customer data in the EU by default, but depending on the feature data may be temporarily processed outside the EU (safeguarded via SCCs). A contractual EU-only commitment for API inference is only available under an Enterprise agreement.
teilweiseSource: Mistral Privacy Policy (08.04.2026) + schriftl. Support-Bestätigung (Mistral Support, 28.07.2026), §7 Privacy Policy; Support-Antwort Punkt 1 (EU-only nur via Enterprise) (reviewed 2026-07-28)
Mistral AI publishes a complete subprocessor list (14 entries). Studio inference infrastructure sits in the EEA (Microsoft Sweden/Norway, Google Netherlands, CoreWeave EEA); US locations apply to the separate 'US API', Agents features (Blackforest, Brave, Merge) and support/billing services (Twilio, Stripe) — so the chain is not exclusively EU-based.
teilweiseSource: Mistral Trust Center Subprozessorenliste (14 Einträge), vollständig archiviert 28.07.2026 (2 PDF-Abzüge), Einträge 1–14 mit Standort- und Produktzuordnung (trust.mistral.ai/subprocessors) (reviewed 2026-07-28)
Mistral AI is a French-based company (Mistral AI SAS, Paris) subject to EU law.
jaSource: Mistral AI Commercial Terms of Service (Effective 11.12.2025), Vertragspartei- und Gerichtsstandsklausel (Mistral AI SAS, Paris, franz. Recht) (reviewed 2026-07-24)
Data Use
83/100Mistral AI offers zero data retention only on the Scale plan and only for stateless API calls (chat, embeddings, moderation, OCR, audio) subject to approval; in standard operation prompts/outputs are retained for up to 30 days for abuse monitoring. OCR runs with ZDR by default.
teilweiseSource: help.mistral.ai Artikel 'Zero Data Retention' (347612), archiviert 27.07.2026 / Privacy Policy §5 / schriftl. Support-Bestätigung 28.07.2026, ZDR nur Scale-Plan, nur stateless Endpoints (Chat, FIM, Embeddings, Moderation, Classification, OCR, Audio); stateful Produkte (Agents, Batch, Files, Conversations, Libraries, Vibe Work, Chat) ausgenommen — vom Support bestätigt (reviewed 2026-07-28)
For paid API usage, Mistral AI does not use customer data for training its models by default; exceptions apply to explicitly submitted feedback, moderation flags, and certain Labs models.
jaSource: Mistral AI Commercial Terms of Service (Effective 11.12.2025) / Privacy Policy, ToS §4.2; Privacy Policy §3 (reviewed 2026-07-24)
Mistral AI commits that paid API customer data is not used for training by default; no separate opt-out is required, as this is the contractual default.
jaSource: Mistral AI Commercial Terms of Service (Effective 11.12.2025), §4.2 (Training-Default) (reviewed 2026-07-24)
Certifications
50/100Mistral AI states on its website that it meets ISO 27001/27701 requirements; a public certificate has not yet been provided.
teilweiseSource: help.mistral.ai (Trust & Security-Seite), Abschnitt Zertifizierungen/Security (reviewed 2026-07-24)
Mistral AI states it meets SOC 2 Type II requirements; no public audit report is available, and a C5 attestation is not documented.
teilweiseSource: help.mistral.ai (Trust & Security-Seite), Abschnitt Zertifizierungen/Security (reviewed 2026-07-24)
AI Act Readiness
100/100As a GPAI provider and signatory of the EU Code of Practice, Mistral AI provides AI Act Art. 53 documentation (Model Documentation Form) via the Code mechanism.
jaSource: EU Code of Practice Signatarliste (Stand 23.04.2026, digital-strategy.ec.europa.eu) / Mistral Model Documentation Form, GPAI-Einordnung Mistral als Modellanbieter + CoP-Signatur (reviewed 2026-07-24)
Mistral AI is an official signatory of the EU Code of Practice for General-Purpose AI Models (as of 23 April 2026).
jaSource: EU Code of Practice Signatarliste (Stand 23.04.2026, digital-strategy.ec.europa.eu), Signatarliste-Eintrag Mistral AI (reviewed 2026-07-24)
Contract Quality & Transparency
50/100Mistral AI publishes its contract documents (Commercial ToS, DPA, Privacy Policy, Usage Policy) publicly and without sales contact at legal.mistral.ai.
jaSource: legal.mistral.ai (Terms-Übersicht), Öffentlich abrufbare Vertragsdokumente (reviewed 2026-07-24)
Mistral AI offers an enterprise SLA (99.5–99.9% monthly uptime depending on support tier); Studio/self-service API usage explicitly carries no SLA without an Enterprise agreement (best effort).
teilweiseSource: Mistral Enterprise Service Level and Support Schedule (23.07.2026) + schriftl. Support-Bestätigung 28.07.2026, Monthly Uptime 99,5/99,9/99,9 % (Basic/Standard/Premium); Credits 2-20 %, Cap 25 %, Claim binnen 30 Tagen; ToS §7.4 Disclaimer gilt für Standard-Nutzung fort (reviewed 2026-07-28)
Mistral AI's liability is capped at 12 months' revenue and excludes indemnification for customer offerings, while the customer's indemnification obligation is unlimited.
neinSource: Mistral AI Commercial Terms of Service (Effective 11.12.2025), §8.1-8.3 (Haftungsdeckel); §9.2 (Freistellung) (reviewed 2026-07-24)
Do you represent Mistral and think something is inaccurate? Write to legal@kontinent.ai. We check every report and correct verified errors with full transparency.
Report error