- Deployment
- on-prem
- Hq Country
- Canada
- Hq City
- Toronto
- Ownership
- private
- Founded
- 2019
- Trust Center Url
- https://trustcenter.cohere.com/
- Training Default
- never
- Residency Options
- your-infrastructure (on-prem), VPC, air-gapped, any cloud
- Gov Access Exposure
- mixed
- Eu Ai Act Role
- gpai
- Certs
- ISO 27001, ISO 42001, SOC 2 Type II, UK Cyber Essentials
- Dpa Available
- Yes
- Zero Retention Available
- Yes
- Self Host Option
- Yes
- Retention Default
- On-prem/VPC/air-gapped: customer-controlled — Cohere never receives prompts or generations.
- Retention Exceptions
- Managed SaaS (a different deployment) is opt-OUT (training default in) via dashboard, 30-day retention, ZDR enterprise-only. HIPAA BAA is narrow (custom-model dev only, not SaaS).
- Subprocessor Count
- 0
- Transfer Mechanism
- intra-eu
- Eu Procurement Ready
- pass
- Eu Procurement Reason
- North deploys fully inside the customer environment (on-prem/VPC/air-gapped) so the vendor never touches data; strong cert stack incl. ISO 42001. Note: this row is the self-hosted deployment — Cohere's managed SaaS is weaker (training opt-out by default). Canadian vendor = EU adequacy basis if any managed component is used.
- Last Policy Change
- 2025-06-27T00:00:00.000Z
- Change Summary
- Cohere achieved ISO 42001 (AI management system) and ISO 27001 certifications; North reached general availability (Aug 2025).
- Prior Value
- Held SOC 2 Type II only; no AI-management-system certification.
- Training Evidence Url
- https://cohere.com/enterprise-data-commitments
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Evidence Url
- https://cohere.com/deployment-options
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Evidence Url
- https://cohere.com/enterprise-data-commitments
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Evidence Url
- https://trustcenter.cohere.com/
- Subprocessors Claim Basis
- inferred
- Subprocessors Confidence
- high
