Does Mistral AI API train on your data?
Mistral AI API by Mistral AIModel APIs and platformsVendor's pages read on
It depends on the plan and on a setting.
The vendor states that inputs are used for training by default on Mistral Studio, free mode. The vendor states that an opt-out is available. On Mistral Studio, pay-as-you-go, a setting controls whether inputs are used for training; the pages read do not state its default in a sentence that could be quoted. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
A summary of what the vendor publishes, not legal advice, not an assessment of the vendor and not an endorsement. How this page was made.
What the vendor states, plan by plan
| Plan | Trains on your data | Default retention | Human review of inputs | Single sign-on |
|---|---|---|---|---|
| Mistral Studio, free modeConsumer / free | Yes by default; opt-out available | Unknown | Unknown | Unknown |
| Mistral Studio, pay-as-you-goAPI | Depends on a setting | 30 rolling days (abuse monitoring) | Unknown | Unknown |
“Unknown” means the vendor's page that would answer this was not read, or could not be opened. It does not mean “no”.
Mistral Studio, free mode
On Mistral Studio, free mode, the vendor states that inputs are used for training by default and that an opt-out is available. Not verified: default retention and human review of inputs.
- Trains on customer data
- Yes by default; opt-out available
The article states the right to opt out at any time.
“we may use your data (input and output) to train our artificial intelligence models”
The vendor states this on help.mistral.ai, read on 12 Nov 2026
Unknown for this plan: Default retention; Zero-retention option; Deletion on request; Human review of inputs; Single sign-on (SSO); SCIM provisioning; Audit logs; Admin console; Data residency options; Customer-managed keys.
Mistral Studio, pay-as-you-go
On Mistral Studio, pay-as-you-go, the vendor states that a setting controls whether inputs are used for training. Retention: 30 rolling days (abuse monitoring). A zero-retention option is stated. Not verified: human review of inputs.
- Trains on customer data
- Depends on a setting
“Customers retain full control over this processing and have the right to opt out at any time.”
The vendor states this on help.mistral.ai, read on 12 Nov 2026
- Default retention
- 30 rolling days (abuse monitoring)
“for thirty (30) rolling days to monitor abuse (unless zero data retention is activated)”
The vendor states this on legal.mistral.ai, read on 12 Nov 2026
- Zero-retention option
- Yes
The conditions for activating zero data retention are described in a separate help article.
“for thirty (30) rolling days to monitor abuse (unless zero data retention is activated)”
The vendor states this on legal.mistral.ai, read on 12 Nov 2026
Unknown for this plan: Deletion on request; Human review of inputs; Single sign-on (SSO); SCIM provisioning; Audit logs; Admin console; Data residency options; Customer-managed keys.
Attestations and company facts the vendor states
- SOC 2 Type II
- Yes
Listed in the vendor's trust centre.
“Compliance ISO 27001 ISO 27701 SOC 2 Type II”
The vendor states this on trust.mistral.ai, read on 12 Nov 2026
- ISO/IEC 27001
- Yes
Listed as a document in the vendor's trust centre.
“ISO/IEC 27001:2022 Certificate (Mistral AI)”
The vendor states this on trust.mistral.ai, read on 12 Nov 2026
- GDPR DPA available
- Yes
The vendor publishes its Data Processing Addendum at this address. Note that it reserves some processing, including model training under the privacy policy, to Mistral as controller.
“Mistral AI is authorized to process the Personal Data as Controller for the purposes of”
The vendor states this on legal.mistral.ai, read on 12 Nov 2026
- Data processing location
- European Union by default; United States when the US API endpoint is used
The article states data can be temporarily transferred outside the EU depending on the feature used.
“By default, your data is hosted in the European Union.”
The vendor states this on help.mistral.ai, read on 12 Nov 2026
“Yes” means the vendor's page says so, with the page linked. GhostAudit has not audited the vendor. Scope by product is on the vendor's page.
What remains unknown
- Default retention
- Zero-retention option
- Deletion on request
- Human review of inputs
- Single sign-on (SSO)
- SCIM provisioning
- Audit logs
- Admin console
- Data residency options
- Customer-managed keys
- ISO/IEC 42001
- HIPAA BAA available
- FedRAMP
- Company headquarters
- Model providers used
None of these was guessed, inferred from another vendor or filled from memory. Ask the vendor, using the list below.
- Trains by default on the consumer plan. Applies to: Mistral Studio, free mode. Employees using personal accounts are on these terms.
- Training depends on a setting. Applies to: Mistral Studio, pay-as-you-go. Check how the setting is configured for your accounts.
- Enterprise controls not verified. SSO, SCIM and audit logs have not been checked for this tool yet.
How to check Mistral AI API in your own company
- 01Find out which plan each account is on. The vendor's terms differ between Mistral Studio, free mode and Mistral Studio, pay-as-you-go. People who signed up with a personal address are on the personal terms, whatever the company bought.
- 02Open the account or administrator settings and look for the data-controls or model-training setting the vendor's page describes. Note what it is set to today and who is able to change it.
- 03Read the vendor's own page, linked under each fact below, and check that the sentence quoted here is still there. Pages change; the date shows when this one was read.
- 04Compare with your contract or order form. Where a data processing agreement or negotiated terms exist, they take precedence over the public pages.
- 05Record the plan, the setting and the date in your AI inventory, so that the answer exists the next time a customer or auditor asks.
What to ask the vendor
Neutral questions for the points the vendor's public pages left open. Ask for the answer in writing.
- 01How long are prompts, files and outputs kept by default, and can an administrator shorten that period?
- 02Is a zero-retention option available on our plan, and what does it exclude (for example abuse monitoring logs)?
- 03How do we request deletion of our data, and within how many days is it completed, including backups?
- 04Can your staff or contractors read our inputs? In which cases, and is that access logged?
- 05Is single sign-on available on our plan, and can sign-in with personal accounts be blocked for our domain?
- 06Is SCIM provisioning available, so that leavers lose access automatically?
- 07Are audit logs available to administrators, and can they be exported to our security tooling?
- 08Is there an administrator console where data controls can be set for every account in our organisation?
- 09Where is our data processed and stored, and can a region be chosen?
- 10Do the statements on your public pages apply to our contract as written, or do negotiated terms override them?
Questions about Mistral AI API
- Does Mistral AI API train on your data?
- It depends on the plan and on a setting. The vendor states that inputs are used for training by default on Mistral Studio, free mode. The vendor states that an opt-out is available. On Mistral Studio, pay-as-you-go, a setting controls whether inputs are used for training; the pages read do not state its default in a sentence that could be quoted. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
- Is Mistral AI API safe to use at work?
- GhostAudit does not rate tools. Whether Mistral AI API is acceptable for your company depends on the plan you hold, the data people put into it and your own policy. This page records what the vendor states, with the wording and the source, so that decision can be made on facts: Mistral Studio, free mode: yes by default; opt-out available and Mistral Studio, pay-as-you-go: depends on a setting (training on customer data).
- How long does Mistral AI API keep data?
- The vendor states: 30 rolling days (abuse monitoring). This is the default the vendor's page describes for one plan; other plans may differ, and the table on this page shows each.
- Which attestations does the vendor of Mistral AI API state?
- The vendor's pages state: SOC 2 Type II, ISO/IEC 27001 and GDPR DPA available. This is the vendor's statement, with the page linked; GhostAudit has not audited the vendor, and the scope by product is on the vendor's page.
- When were these facts checked, and how do I report an error?
- The vendor's pages were read on 12 Nov 2026. Every quotation was checked against the stored text of its source page on that date. To report an inaccuracy, email [email protected] with the page that shows the current wording.
How this page was made, and how to correct it
Every fact above is a statement found on a page Mistral AI itself publishes. The page was fetched and reduced to text, the statement was recorded with its exact wording, and the quotation was checked against the stored text of the page. Quotations are at most 25 words. Search results, blogs and third-party summaries were not used.
These are summaries of statements the vendor publishes, as read on the date shown. They are not legal advice, not an assessment of the vendor and not an endorsement. Vendors change their terms: open the linked source and check your own contract before you rely on a statement.
Found an error, or are you the vendor? Report an inaccuracy with the page that shows the current wording. The page is re-read; the fact, its quotation and its date are corrected, or the fact is set to unknown if the page cannot be opened. The full method.
The vendor's official pages
- Privacy policylegal.mistral.ai
- Data processing agreementlegal.mistral.ai
- Trust centretrust.mistral.ai
Mistral AI API is a product of Mistral AI. GhostAudit is not affiliated with, endorsed by or sponsored by Mistral AI.
Is Mistral AI API in use at your company, and on which plan?
GhostAudit shows which AI tools your people use, from Google Workspace or Microsoft 365 and from the browser, and sets each one beside the terms on this page. It records tool names and time, never prompts.