GDPR check

Is Mistral AI GDPR compliant? What universities should check

Mistral AI is a Paris-based developer of large language models, and its assistant Le Chat was renamed Vibe in August 2026. European universities often look at it as an EU alternative to US assistants. This page sets out what Mistral publicly documents for each plan and what a university should check before relying on it.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Mistral AI is a French company headquartered in Paris, so it is established in the EU and its privacy policy points users to the French data protection authority, the CNIL. Its assistant, formerly Le Chat, has been called Vibe since 12 August 2026. Mistral says data is hosted in the EU by default, its main cloud and inference subprocessors are in the EEA, and it holds ISO 27001, ISO 27701 and SOC 2 Type II. Commercial customers get a public DPA. The main thing to check is training: on Free and Pro, conversations are used for training by default unless the user opts out; Team admins can switch it off; Enterprise is opted out by default. The DPA keeps a right for Mistral to train as controller unless the customer has opted out, so a university needs the opt-out set and documented.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers an AI assistant for research work with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Mistral documents publicly

All sources were read on 7 October 2026: Mistral's legal centre, help centre, trust centre and pricing page, plus EU sources. Le Chat was renamed Vibe on 12 August 2026 [4]; where older documents say "Le Chat", they refer to what is now Vibe. "Not found publicly" means we did not find it in the sources listed; it does not mean the safeguard does not exist.

TopicWhat the vendor statesSource
Company and establishmentDocumented Mistral AI, a French company registered in Paris (no. 952 418 325), 15 rue des Halles, 75001 Paris, is controller for individual users under its privacy policy (effective 3 September 2026). A DPO is reachable through a privacy request form or by post. The policy names the CNIL as the authority users can complain to. When customers use the products for their business, Mistral says it acts as processor.[1]
Where data is stored and processedDocumented "By default, your data is hosted in the European Union"; data is hosted in the US only if a customer explicitly uses the US API endpoint. Data may be transferred temporarily to subprocessor locations under SCCs. Enterprise organisations can switch off certain features that involve transfers outside the EU.[5], [1]
Data processing agreementPlan-dependent A public Data Processing Addendum (effective 27 July 2026) forms part of the Commercial Terms. The customer is controller and Mistral processor. Section 2.3 authorises Mistral to process personal data as controller to train its models "unless Customer is or has opted-out of training", and to train on thumbs up or down feedback with the related input and output. Individual Free and Pro users are covered by the privacy policy and consumer terms instead.[3], [2]
SubprocessorsDocumented A public list in the trust centre with 25 entries. Cloud and inference: Microsoft (Sweden, Norway), Google (Netherlands, Belgium; US for the US API endpoint), Mistral Compute (France) and CoreWeave (EEA). US-based entries include Stripe (payments), Twilio (phone verification), Brave (web search) and Black Forest Labs (image generation). Some Vibe Code Web infrastructure is listed as worldwide. The DPA gives ten days to object to a new subprocessor, with email alerts for subscribers.[6], [3]
International transfersDocumented The privacy policy says Mistral prioritises EU providers and attaches the most recent version of the European Commission's SCCs to contracts with providers outside the EU. The DPA allows transfers to adequate countries or under SCCs; Module 4 SCCs apply only where the customer itself is in a country outside the EEA without an adequacy decision. Mistral is an EU company, so the EU-US Data Privacy Framework does not apply to it.[1], [3]
AI model training on customer contentPlan-dependent Vibe Free and Pro: input and output "are used by default" for training; users can opt out at any time, and Vibe and API opt-outs are separate settings. Team: admins can disable training for the whole organisation. Enterprise: "opted out of training by default". The Commercial Terms exclude training on customer data except where the customer has not opted out of an opt-out product, gives feedback, or uses Labs or Preview models, where opt-outs do not apply.[7], [8], [2]
Retention and deletionPartly documented Vibe input and output are kept until the user deletes the conversation or account. API input and output are kept for 30 rolling days for abuse monitoring unless zero data retention is activated. After a commercial contract ends, personal data is no longer accessible after 30 days. Not found publicly An admin-set retention period for Team or Enterprise conversations.[1], [3]
Security certificationsDocumented The trust centre lists ISO 27001, ISO 27701 and SOC 2 Type II, with certificates and a SOC 2 attestation letter on request. It also publishes incident notices, including a May 2026 supply chain incident in which, according to Mistral, hosted services and user data were not compromised.[6]
Institution and enterprise controlsPlan-dependent Team ($24.99 per user per month, minimum $50) adds domain verification and data export. Enterprise (custom pricing) adds SAML SSO, audit logs, custom models and private deployments. The Education plan is Pro at a discount for students ($5.99 per month) and teachers, verified by institutional email.[9], [10], [11]

What this means for a university

Validemic's analysis

EU establishment and EU hosting are real strengths. A controller and processor established in France, default EU hosting, EEA-based cloud and inference subprocessors, and ISO 27001, ISO 27701 and SOC 2 Type II mean fewer transfer questions than with most US assistants. Remaining transfers are specific and listed: payments, phone verification, web search and image generation go to US providers [6]. A university can assess those features one by one and, on Enterprise, switch some of them off [5].

Training is the point to pin down. Mistral's default differs by plan: on for Free and Pro, controllable by admins on Team, off by default on Enterprise [8]. Section 2.3 of the DPA makes Mistral a separate controller for training unless the customer has opted out [3]. For a university, that means (1) Team admins must actively switch training off for the organisation, (2) the setting should be recorded as part of the processing instructions, and (3) staff should know that feedback buttons and Labs or Preview models remain training routes [2], [7]. On Enterprise, the default is already the one most DPOs want.

The Education plan is an individual subscription. It is the Pro plan at a discount [11], so the consumer terms and the default training setting apply, and the university has no processor contract. If the university recommends it, tell students how to opt out. For institutional use, Team or Enterprise is the route that brings a DPA.

Retention needs a contractual answer. Vibe keeps conversations until users delete them [1]. We did not find an admin-controlled retention period for Team or Enterprise in public documentation, so a university should ask for one or agree deletion routines in the contract.

Students. The EU consumer terms set a minimum age of 13, with parental permission where required [12]. Most university students are well above this, but some national digital consent ages are higher.

Credit where due. Mistral publishes a readable DPA, a subprocessor list with locations and products, incident notices and certifications, and it lists the University of Groningen among its customers [13]. It is also a signatory of the EU General-Purpose AI Code of Practice [16].

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Mistral before approving Vibe

  1. Can the DPA state that Mistral will not process our data as controller for training, rather than relying on an opt-out setting?
  2. Can feedback submission and Labs or Preview models be disabled for all users in our organisation?
  3. Can we set an organisation-wide retention period for Vibe conversations and files on Team or Enterprise?
  4. Which US subprocessors receive conversation content (for example web search or image generation), and can we switch those features off on our plan?
  5. Is SAML SSO available on Team, or only on Enterprise, and what do audit logs record?
  6. What is the scope of the ISO 27001, ISO 27701 and SOC 2 Type II reports: do they cover Vibe Work and Vibe Code as well as the API?
  7. Do you offer an institutional education contract that covers students under the same DPA?
  8. How are connectors (for example email or document stores) governed, and where is connector data processed?

The EU AI Act angle

Using Vibe for writing, coding or research support is normally not a high-risk use under the AI Act, Regulation (EU) 2024/1689 [14]. Annex III, point 3 lists the education uses that are high-risk: deciding admission or access, evaluating learning outcomes, assessing the level of education a person will receive, and monitoring students during tests.

A university using Vibe is a deployer. Article 4 on AI literacy has applied since 2 February 2025, and Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since 27 July 2026, turned it into a duty to take measures to support AI literacy and moved the Annex III high-risk rules to 2 December 2027 [15]. General-purpose AI model obligations, applying since 2 August 2025, fall on Mistral as model provider. The European Commission lists Mistral AI as a signatory of the General-Purpose AI Code of Practice [16].

Sources

  1. Mistral AI, Privacy Policy (effective 3 September 2026), retrieved 7 October 2026
  2. Mistral AI, Commercial Terms of Service, sections 4.1 and 4.2, retrieved 7 October 2026
  3. Mistral AI, Data Processing Addendum (effective 27 July 2026), retrieved 7 October 2026
  4. Mistral Help Center, "Le Chat is now Vibe", retrieved 7 October 2026
  5. Mistral Help Center, "Where do you store my data or my Organization's data?", retrieved 7 October 2026
  6. Mistral AI Trust Center (compliance, subprocessors and updates), retrieved 7 October 2026
  7. Mistral Help Center, "Do you use my user data to train your Artificial Intelligence models?", retrieved 7 October 2026
  8. Mistral Help Center, "Can I opt out of my input or output data being used for training?", retrieved 7 October 2026
  9. Mistral AI, Pricing, retrieved 7 October 2026
  10. Mistral Help Center, "As an admin on Team plan or Enterprise, do I have company-wide controls?", retrieved 7 October 2026
  11. Mistral Help Center, "I'm a student or a teacher. Am I eligible for a discount?", retrieved 7 October 2026
  12. Mistral AI, Terms of Service for EU consumers, retrieved 7 October 2026
  13. Mistral AI, customer story: University of Groningen, retrieved 7 October 2026
  14. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 4 and 113 and Annex III, Official Journal text read via the Publications Office, retrieved 7 October 2026
  15. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text read via the Publications Office, retrieved 7 October 2026
  16. European Commission, The General-Purpose AI Code of Practice (signatories), retrieved 7 October 2026

About this page

We read Mistral AI's privacy policy, consumer and commercial terms, DPA, trust centre (including the subprocessor list), help centre articles and pricing page, and the EU legal texts, on 7 October 2026. The trust centre was read in a browser because it does not load for automated fetching. We did not test the product or review any non-public contract. This page is not legal advice and not a verdict on whether Mistral AI or any university's use of Vibe complies with the GDPR; that depends on your plan, your settings, your contract and your use.

If you work at Mistral AI and something here is out of date or incomplete, please contact us and we will review it promptly.

Frequently asked questions

Is Le Chat the same as Mistral Vibe?

Yes. Mistral's help centre says Le Chat was renamed Vibe on 12 August 2026, with accounts, plans and conversations carried over and the same address, chat.mistral.ai. Vibe now has Chat, Work and Code modes.

Does Mistral train on my Vibe conversations?

It depends on the plan. Mistral's help centre says input and output on Vibe are used for training by default for Free and Pro users, who can opt out in settings. Team admins can switch training off for the whole organisation, and Enterprise customers are opted out by default. Thumbs up or down feedback can be used for training on every plan (checked 7 October 2026).

Where does Mistral store data?

Mistral's help centre says data is hosted in the European Union by default, and in the United States only if a customer explicitly uses the US API endpoint. Some subprocessors, for example for payments, web search and image generation, are located in the US, and Mistral says such transfers rely on Standard Contractual Clauses.

Does Mistral sign a DPA?

Yes, for commercial customers. Mistral publishes a Data Processing Addendum (effective 27 July 2026) that forms part of its Commercial Terms. Note that the DPA lets Mistral use customer data as a separate controller for model training unless the customer has opted out, so the opt-out setting matters.

Is there a Mistral plan for universities?

Mistral offers an Education plan, which is the Pro plan at a discount for students and teachers verified with an institutional email address. That is an individual subscription. For institution-wide use with central controls, Mistral sells Team and Enterprise plans.

Related reading