Skip to content

Mistral AI

Mistral AI SAS (Paris, France; RCS Paris 952 418 325), the contracting party named in the DPA effective 27 July 2026

Sovereign AI · France
Founded 2023 · mistral.ai

Paris-based frontier LLM lab: Vibe agent (formerly Le Chat), Studio API and Apache 2.0 open-weight models; valued above €21B after its 2026 Series D.

Mistral AI offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.

Assessment notes

Mistral AI SAS (Paris, founded April 2023 by Arthur Mensch, Guillaume Lample and Timothée Lacroix, former DeepMind and Meta researchers who still run the company) is the leading European frontier-LLM lab, publishing Apache 2.0 open-weight models (Mistral Large 3, Mistral Small 4, Ministral 3) and selling managed services under two brands: Vibe, the assistant formerly called Le Chat (renamed on 28 May 2026), and Studio, the developer API formerly known as La Plateforme. Ownership is recorded as EU HQ, US-funded: ASML led the September 2025 Series C with an 11% stake at the time, and the €3B Series D of September 2026 was led by Samsung Electronics with EQT's EU-backed Scaleup Europe Fund and PSG Equity as co-leads, but Andreessen Horowitz, NVIDIA, General Catalyst, Lightspeed, Salesforce Ventures and new entrants Advent and BlackRock-managed funds keep a material US-weighted position on the cap table. The determining fact for the score is the hosting chain, which the Vanta trust centre now lists in readable form: inference for Vibe and Studio runs on Microsoft (Sweden and Norway), Google (Netherlands and Belgium, plus the United States for the US endpoint), CoreWeave (EEA) and Mistral Compute, the company's own infrastructure subsidiaries in France, with Cloudflare in front of every product. Three US-owned clouds in the core inference path, even in European regions, mean CLOUD Act exposure for the managed services is recorded as Material. Under the rubric that is a 3: EU-incorporated with EU hosting by default, but three or more US sub-processors in the core path; the public DPA (effective 27 July 2026), the optional EU-pinned regional endpoint (generally available since 11 August 2026) and ISO 27001, ISO 27701 and SOC 2 Type II certification support the EU-default reading. Self-hosting the open weights on EU GPU infrastructure removes Mistral and its sub-processors from the data path.

Findings

CLOUD Act
Ownership
Sub-processors
— not disclosed

Verified signals

Jurisdiction
  • EU / adequacy hosting: Yes
  • EU / adequacy operator: Yes
  • No US CLOUD Act exposure: No
Transparency
  • Public DPA: Yes
  • Sub-processors disclosed: Yes
  • Open-source clients: Yes
  • Third-party certification: Yes
CLOUD Act by deployment

Exposure depends on how you run this product.

Hosted SaaS (default)

Vendor-operated: the sub-processors below apply.

Self-hosted (open-source)

Deploy on your own EU infrastructure and you control hosting and every sub-processor.

Jump to

About Mistral AI

Mistral AI is the Paris-headquartered frontier LLM lab founded in April 2023 by Arthur Mensch (CEO), Guillaume Lample, and Timothée Lacroix, three former DeepMind and Meta AI researchers who built the company on a strategy of open-weight foundational models plus commercial frontier offerings. Since 28 May 2026 the assistant formerly called Le Chat is Vibe: one product and one subscription with three modes, Vibe Work for delegating multi-step tasks across connected apps and tools, Vibe Chat for the turn-based conversation Le Chat was known for, and Vibe Code for developers as a command-line tool, a VS Code extension and a web interface. Accounts, plans and conversations carried over, and chat.mistral.ai still opens the service. The developer API once branded La Plateforme now sits in Studio, together with agent building, fine-tuning and batch processing; Forge covers custom model development, and Applied AI Services handle tailored R&D. Customer references include Stellantis (automotive), ASML (semiconductors), CMA CGM (logistics), Airbus and HSBC. The current open-weight line-up is released under Apache 2.0: Mistral Large 3, Mistral Small 4, the Ministral 3 family and the Voxtral transcription models, alongside the earlier Mistral 7B and Mixtral. Mistral Medium 3.5 ships under a modified MIT licence, while Codestral, the OCR models and the embedding models remain API-only. Studio also serves third-party open models, starting with Z.ai's GLM.

Funding trajectory: seed €105M (June 2023) at €240M led by Lightspeed; Series A US$415M (Dec 2023) at US$2B led by Andreessen Horowitz; Series B US$640M (June 2024) at US$6B; Series C €1.7B (September 2025) at €11.7B valuation led by Dutch chip giant ASML with a €1.3B cheque for an 11% anchor stake; March 2026 US$830M debt financing from a consortium of seven banks; and a €3B Series D (September 2026) at a post-money valuation above €21B, led by Samsung Electronics with EQT's Scaleup Europe Fund and existing investor PSG Equity as co-leads. Advent, funds managed by BlackRock and the Grand Duchy of Luxembourg joined as new investors, and returning investors include Andreessen Horowitz, ASML, Bpifrance, BNP Paribas CIB, DST Global, General Catalyst, Index Ventures, Lightspeed, NVIDIA and Salesforce Ventures. European industrial and public backers sit next to a deep bench of US venture, growth and private-equity investors, which is why ownership is recorded as EU HQ, US-funded rather than EU-owned.

Procurement-grade picture: the contracting party is Mistral AI SAS under a versioned DPA, effective 27 July 2026 and readable without login, and the Vanta-hosted trust centre now names the sub-processors behind the managed services. Inference for Vibe and Studio runs on a mix of US-owned and Mistral-owned infrastructure: Microsoft (cloud infrastructure in Sweden and Norway), Google (Netherlands and Belgium, plus the United States for the US endpoint), CoreWeave (inference in the EEA) and Mistral Compute, the company's own infrastructure subsidiaries in France. Cloudflare sits in front of every product, and processors for web search, image generation, payments and phone verification are listed with processing in the United States. The help centre states that data is hosted in the EU by default. Since Mistral Regional Endpoints went generally available on 11 August 2026, API customers can pin inference to an EU or a US endpoint at a 10% premium, while the default global endpoint does not commit to a location and operational metadata may be handled outside the chosen region. Because three US-owned clouds sit in the core inference path even in European regions, the at-rest exposure for managed-service customers is recorded as Material under the strict CLOUD Act stance. Mistral holds ISO 27001, ISO 27701 and SOC 2 Type II, with reports available on request through the trust centre. It is also building its own European capacity, including a 10 MW inference site at Les Ulis (Essonne) announced in May 2026 for the third quarter, but Microsoft, Google and CoreWeave remain on the sub-processor list. The open-weight self-host path is the cleanest sovereign answer: Mistral Small 4, Ministral 3 or, on multi-GPU nodes, Mistral Large 3 running on Hetzner H100, OVHcloud GPU, Scaleway B300, STACKIT GPU, or IONOS sovereign cloud removes Mistral and its sub-processors from the data path. Best fit: French and EU regulated buyers, defence and public-sector procurement, large enterprises in automotive / semiconductors / logistics, and any organisation evaluating sovereign frontier LLMs, but procurement-led EU-only buyers should choose the self-host path on EU GPU infrastructure rather than the managed services.

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.

Frameworks & certifications

ISO/IEC 27001
Active
ISO/IEC 27701
Active
SOC 2
Active
Informational · US framework

Capability matrix

Table 1Capabilities of Mistral AI

Self-hostable Yes
API access Yes
Chat assistant Yes
Open-weight models Yes
Fine-tuning Yes
Multimodal Yes
Function calling Yes
RAG Yes

Integration & access

REST API Yes
SSO (SAML / OIDC) Yes

Compliance & governance

Audit log Yes
Self-host / on-prem option Yes

Pricing & tiers

from €14.99/mo
Freemium
View pricing page

Public documents

  • Data Processing Addendum (DPA)
    legal.mistral.ai/terms…
    Open
  • Sub-processors list
    trust.mistral.ai/subprocessors…
    Open
  • Terms of Service
    legal.mistral.ai
    Open

Alternatives in this category

  • Germany
    EU-Hosted
    Public DPA: No Sub-processors: No Open source: No
  • EU-Hosted
    Public DPA: No Sub-processors: No Open source: Yes
  • Germany · €7.49/mo
    EU-Hosted
    Public DPA: Not assessed Sub-processors: No Open source: No