Mistral AI
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Mistral AI SAS (Paris, France; RCS Paris 952 418 325), the contracting party named in the DPA effective 27 July 2026
Paris-based frontier LLM lab: Vibe agent (formerly Le Chat), Studio API and Apache 2.0 open-weight models; valued above €21B after its 2026 Series D.
Mistral AI offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.
Assessment notes
Mistral AI SAS (Paris, founded April 2023 by Arthur Mensch, Guillaume Lample and Timothée Lacroix, former DeepMind and Meta researchers who still run the company) is the leading European frontier-LLM lab, publishing Apache 2.0 open-weight models (Mistral Large 3, Mistral Small 4, Ministral 3) and selling managed services under two brands: Vibe, the assistant formerly called Le Chat (renamed on 28 May 2026), and Studio, the developer API formerly known as La Plateforme. Ownership is recorded as EU HQ, US-funded: ASML led the September 2025 Series C with an 11% stake at the time, and the €3B Series D of September 2026 was led by Samsung Electronics with EQT's EU-backed Scaleup Europe Fund and PSG Equity as co-leads, but Andreessen Horowitz, NVIDIA, General Catalyst, Lightspeed, Salesforce Ventures and new entrants Advent and BlackRock-managed funds keep a material US-weighted position on the cap table. The determining fact for the score is the hosting chain, which the Vanta trust centre now lists in readable form: inference for Vibe and Studio runs on Microsoft (Sweden and Norway), Google (Netherlands and Belgium, plus the United States for the US endpoint), CoreWeave (EEA) and Mistral Compute, the company's own infrastructure subsidiaries in France, with Cloudflare in front of every product. Three US-owned clouds in the core inference path, even in European regions, mean CLOUD Act exposure for the managed services is recorded as Material. Under the rubric that is a 3: EU-incorporated with EU hosting by default, but three or more US sub-processors in the core path; the public DPA (effective 27 July 2026), the optional EU-pinned regional endpoint (generally available since 11 August 2026) and ISO 27001, ISO 27701 and SOC 2 Type II certification support the EU-default reading. Self-hosting the open weights on EU GPU infrastructure removes Mistral and its sub-processors from the data path.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Mistral AI
Mistral AI is the Paris-headquartered frontier LLM lab founded in April 2023 by Arthur Mensch (CEO), Guillaume Lample, and Timothée Lacroix, three former DeepMind and Meta AI researchers who built the company on a strategy of open-weight foundational models plus commercial frontier offerings. Since 28 May 2026 the assistant formerly called Le Chat is Vibe: one product and one subscription with three modes, Vibe Work for delegating multi-step tasks across connected apps and tools, Vibe Chat for the turn-based conversation Le Chat was known for, and Vibe Code for developers as a command-line tool, a VS Code extension and a web interface. Accounts, plans and conversations carried over, and chat.mistral.ai still opens the service. The developer API once branded La Plateforme now sits in Studio, together with agent building, fine-tuning and batch processing; Forge covers custom model development, and Applied AI Services handle tailored R&D. Customer references include Stellantis (automotive), ASML (semiconductors), CMA CGM (logistics), Airbus and HSBC. The current open-weight line-up is released under Apache 2.0: Mistral Large 3, Mistral Small 4, the Ministral 3 family and the Voxtral transcription models, alongside the earlier Mistral 7B and Mixtral. Mistral Medium 3.5 ships under a modified MIT licence, while Codestral, the OCR models and the embedding models remain API-only. Studio also serves third-party open models, starting with Z.ai's GLM.
Funding trajectory: seed €105M (June 2023) at €240M led by Lightspeed; Series A US$415M (Dec 2023) at US$2B led by Andreessen Horowitz; Series B US$640M (June 2024) at US$6B; Series C €1.7B (September 2025) at €11.7B valuation led by Dutch chip giant ASML with a €1.3B cheque for an 11% anchor stake; March 2026 US$830M debt financing from a consortium of seven banks; and a €3B Series D (September 2026) at a post-money valuation above €21B, led by Samsung Electronics with EQT's Scaleup Europe Fund and existing investor PSG Equity as co-leads. Advent, funds managed by BlackRock and the Grand Duchy of Luxembourg joined as new investors, and returning investors include Andreessen Horowitz, ASML, Bpifrance, BNP Paribas CIB, DST Global, General Catalyst, Index Ventures, Lightspeed, NVIDIA and Salesforce Ventures. European industrial and public backers sit next to a deep bench of US venture, growth and private-equity investors, which is why ownership is recorded as EU HQ, US-funded rather than EU-owned.
Procurement-grade picture: the contracting party is Mistral AI SAS under a versioned DPA, effective 27 July 2026 and readable without login, and the Vanta-hosted trust centre now names the sub-processors behind the managed services. Inference for Vibe and Studio runs on a mix of US-owned and Mistral-owned infrastructure: Microsoft (cloud infrastructure in Sweden and Norway), Google (Netherlands and Belgium, plus the United States for the US endpoint), CoreWeave (inference in the EEA) and Mistral Compute, the company's own infrastructure subsidiaries in France. Cloudflare sits in front of every product, and processors for web search, image generation, payments and phone verification are listed with processing in the United States. The help centre states that data is hosted in the EU by default. Since Mistral Regional Endpoints went generally available on 11 August 2026, API customers can pin inference to an EU or a US endpoint at a 10% premium, while the default global endpoint does not commit to a location and operational metadata may be handled outside the chosen region. Because three US-owned clouds sit in the core inference path even in European regions, the at-rest exposure for managed-service customers is recorded as Material under the strict CLOUD Act stance. Mistral holds ISO 27001, ISO 27701 and SOC 2 Type II, with reports available on request through the trust centre. It is also building its own European capacity, including a 10 MW inference site at Les Ulis (Essonne) announced in May 2026 for the third quarter, but Microsoft, Google and CoreWeave remain on the sub-processor list. The open-weight self-host path is the cleanest sovereign answer: Mistral Small 4, Ministral 3 or, on multi-GPU nodes, Mistral Large 3 running on Hetzner H100, OVHcloud GPU, Scaleway B300, STACKIT GPU, or IONOS sovereign cloud removes Mistral and its sub-processors from the data path. Best fit: French and EU regulated buyers, defence and public-sector procurement, large enterprises in automotive / semiconductors / logistics, and any organisation evaluating sovereign frontier LLMs, but procurement-led EU-only buyers should choose the self-host path on EU GPU infrastructure rather than the managed services.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Mistral AI
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €7.49/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
|
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
|
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
|
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€7.49/mo |