GDPR
The trust center says the DPA uses the 4 June 2021 SCCs and is designed to help customers comply with the GDPR. A copy requires an NDA.
Checked 21 Oct 2026https://trustcenter.cohere.com/
Model API
Cohere's enterprise data commitments say private and third-party deployments do not give Cohere access to prompts or generations. On the SaaS platform, prompts and generations are logged and deleted after 30 days, with stated exceptions, and a Data Controls toggle set to Off opts out of training. The trust center says a SOC 2 Type II report is available under mNDA, and that a BAA covers custom model development rather than hosted SaaS. The SLO page states an objective of at least 99.5% for api.cohere.ai and dashboard.cohere.ai. It does not publish a credit SLA.
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
The trust center says the DPA uses the 4 June 2021 SCCs and is designed to help customers comply with the GDPR. A copy requires an NDA.
Checked 21 Oct 2026https://trustcenter.cohere.com/
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
Not published
Checked 21 Oct 2026https://cohere.com/slo
Not published
Checked 21 Oct 2026https://cohere.com/slo
SOC 2 Type II report. Request from the Trust Center under mNDA.
Checked 21 Oct 2026https://trustcenter.cohere.com/
BAA only for custom model development, not hosted SaaS. Enterprise customers should not submit Personal Health Information through the SaaS services.
Checked 21 Oct 2026https://trustcenter.cohere.com/
Not published
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
For private and third-party partner deployments, Cohere does not have access to customer prompts or generations. On the SaaS platform, prompts and generations are logged and automatically deleted after 30 days, with stated exceptions, unless the customer allows them to be used for training. The Data Controls toggle set to Off opts out, and the change applies to data created after the change.
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
Varies by tier
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
Private deployments are not accessed. SaaS training depends on the Data Controls opt-out.
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
The trust center says hosting is on Google Cloud Platform servers in US-Central, and that Cohere does not use servers outside the US.
Checked 21 Oct 2026https://trustcenter.cohere.com/
Not published
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
Checked 21 Oct 2026https://docs.cohere.com/docs/models
Not published as a credit SLA. The SLO page states an objective of >=99.5% for api.cohere.ai and dashboard.cohere.ai. The page description says commercially reasonable efforts, 24 x 7 x 365.
Checked 21 Oct 2026https://cohere.com/slo
No on private deployments. SaaS training follows the Data Controls toggle.
Checked 21 Oct 2026https://cohere.com/enterprise-data-commitments
Entities visible on the trust center before View all: Google Cloud, infrastructure service provider, USA; Fullstory, software delivery platform, USA; LaunchDarkly, feature flagging, USA; New Relic, platform monitoring, USA; Retool, software delivery platform, USA; Sentry IO, software delivery platform, USA; Segment, event and error handling, USA; Sendgrid, email communications, USA; Vercel, web application hosting, USA.|Hosting FAQ on the same page: Google Cloud Platform servers in US-Central.|Entities behind View all: Not published.
Checked 21 Oct 2026https://trustcenter.cohere.com/
Notice period: Not published. The trust center says a DPA is available under NDA from privacy@cohere.com. No day count was on the page checked on 21 Oct 2026.|This snapshot stores only the rows rendered before View all.
Checked 21 Oct 2026https://trustcenter.cohere.com/
Not published
Checked 21 Oct 2026https://trustcenter.cohere.com/
https://trustcenter.cohere.com/
Checked 21 Oct 2026https://trustcenter.cohere.com/