Mistral AI: DPA, subprocessors and data location

Where to find the Mistral AI DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: llm api. The table is the short version; the sections below add detail.

Mistral AI at a glance

Notes on Mistral AI

Mistral's DPA (effective July 27, 2026) is incorporated into the Agreement. Section 2.3 lets Mistral process some personal data as a controller: model training unless you have opted out (feedback given with the in-app thumbs up or down is used for training regardless), moderation and abuse monitoring on its APIs unless zero data retention is on, and aggregated usage data.

Notice of a new subprocessor is "reasonable notice" with no day count, you are emailed only if you subscribe, and you have 10 days to object (section 7.2). If nothing is agreed it is Mistral that may terminate, not you.

Mistral's help center says data is hosted in the EU by default and in the US if you explicitly use the US endpoint. Its regional endpoints do not support Agents, Batch or the Files API. The DPA's Module 4 SCCs apply only if you are located outside the EEA without an adequacy decision.

Mistral AI DPA: where to find it and how it is accepted

Read the DPA on legal.mistral.ai. The DPA forms part of the Agreement and is incorporated by reference. It starts on the earlier of the Agreement's effective date and the date Mistral first processes Personal Data for you. The page shows Effective: July 27, 2026..

Not stated in the source we checked (2026-10-17).

The DPA supplements the Agreement for the Mistral AI Products and does not list plans.

Mistral AI subprocessors: the list and how change notices reach you

Mistral AI's subprocessor list.

How changes are announced: Email, for customers who subscribe on the Trust Center subprocessor page (section 7.1).

Not stated in the source we checked (2026-10-17).

Section 7.2: Mistral gives "reasonable notice" of changes to the list before engaging a subprocessor, with no day count. Section 7.1 says you are emailed automatically only if you subscribe to updates on the Trust Center subprocessor page.

You can object within 10 days. The parties consult in good faith. If nothing is agreed, Mistral AI reserves the right to terminate the Agreement or just the affected Mistral AI Products (section 7.2). The clause gives you no termination right.

Section 7.2: object in writing to privacy@mistral.ai within ten (10) days of the notice, on reasonable grounds relating to data protection law. Otherwise the new subprocessor is deemed approved.

Where Mistral AI stores data

• European Union (default)
• United States (if you explicitly use the US endpoint)

You can choose the region.

Mistral's help center (August 12, 2026) says data is hosted in the EU by default and in the United States if you explicitly use the US endpoint. It adds that data can be temporarily transferred outside the EU depending on the feature, with destinations listed in the Trust Center. The docs describe api.eu.mistral.ai (data centers in EU and EFTA countries) and api.us.mistral.ai. The global endpoint makes no commitment to a location, and Agents, Batch and the Files API are not available on regional endpoints.

How Mistral AI moves data outside the EU and UK

• SCCs and other adequate safeguards
• SCCs Module 4 (only if you are in a country outside the EEA without an adequacy decision)

Section 8.1 authorizes transfers to countries with a Commission adequacy decision, on the basis of adequate safeguards, or under the SCCs. Section 8.2 concludes Module 4 (processor to controller) only if you are located in a Restricted Country, with French law and courts. The text we read does not mention the Data Privacy Framework, a UK Addendum or Swiss terms.

Is Mistral AI a processor or a controller?

Both: processor for some data, controller for other data.

Section 2.1: you are the controller and Mistral AI the processor. Section 2.3: Mistral AI may also process Personal Data as a controller for model training (unless you have opted out; in-app thumbs up or down feedback and its associated input and output are used for training as well), automated moderation including abuse monitoring on its APIs (except when zero data retention is on), and aggregated usage statistics.

Is Mistral AI GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Mistral AI's own documents say:

• A DPA is published: The DPA forms part of the Agreement and is incorporated by reference. It starts on the earlier of the Agreement's effective date and the date Mistral first processes Personal Data for you. The page shows Effective: July 27, 2026.
• A subprocessor list is published.
• Transfer mechanisms named: SCCs and other adequate safeguards, SCCs Module 4 (only if you are in a country outside the EEA without an adequacy decision).
• Data locations named: European Union (default), United States (if you explicitly use the US endpoint).

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Mistral AI to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Mistral AI, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Mistral AI | LLM API | European Union (default); United States (if you explicitly use the US endpoint) | SCCs and other adequate safeguards; SCCs Module 4 (only if you are in a country outside the EEA without an adequacy decision) | [DPA](https://legal.mistral.ai/terms/data-processing-addendum) | [Subprocessors](https://trust.mistral.ai/) |

Add to my list

If you add or replace Mistral AI: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

In the source we checked, Mistral AI doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from Mistral's own DPA (effective July 27, 2026), help center article (August 12, 2026) and regional inference docs. The Trust Center subprocessor list could not be read as text.

2026-10-17

Re-checked sections 2.3, 7.1, 7.2 and 8.1 to 8.2 against the raw DPA text. The subscription clause is 7.1 (confirmed). 7.2 notice, 10-day objection and Mistral-only termination right confirmed. 2.3 sharpened: in-app thumbs up or down feedback, with its input and output, is used by Mistral as controller to train its models, in addition to the opt-out-able training.

Related vendors

• AI and LLM APIs
• OpenAI LLM API
• Anthropic LLM API (Claude)
• ElevenLabs Voice and speech AI
• Gemini API LLM API (Google)
• Groq LLM inference API (GroqCloud)
• OpenRouter LLM routing API
• All vendors

Sources and method

• https://legal.mistral.ai/terms/data-processing-addendum checked 2026-10-17
• https://trust.mistral.ai/ checked 2026-10-17
• https://help.mistral.ai/en/articles/347629-where-do-you-store-my-data-or-my-organization-s-data checked 2026-10-17

Headquarters country: France. Annex I.A names Mistral AI as a French limited joint-stock corporation with registered offices at 15 rue des Halles, 75001 Paris, France.

Facts come from Mistral AI's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: mistral.ai.