- Deployment
- on-prem
- Hq Country
- Canada
- Hq City
- Toronto
- Ownership
- private
- Founded
- 2019
- Training Default
- never
- Residency Options
- your-infrastructure (on-prem), VPC, air-gapped, any cloud
- Gov Access Exposure
- none-eu
- Eu Ai Act Role
- gpai
- Certs
- ISO 27001, ISO 42001, SOC 2 Type II, UK Cyber Essentials
- DPA available
- yes
- Zero Retention Available
- Yes
- Self Host Option
- Yes
- Retention Default
- On-prem/VPC/air-gapped: customer-controlled — Cohere never receives prompts or generations.
- Retention Exceptions
- Managed SaaS (a different deployment) is opt-OUT (training default in) via dashboard, 30-day retention, ZDR enterprise-only. HIPAA BAA is narrow (custom-model dev only, not SaaS).
- Subprocessor Count
- 0
- Transfer Mechanism
- intra-eu
- Eu Procurement Ready
- pass
- Eu Procurement Reason
- On-prem deployment: no vendor-side data flow, zero subprocessors, customer-controlled retention. Vendor jurisdiction (Canada/US) is not in the data path.
- Last Policy Change
- 2025-06-27T00:00:00.000Z
- Change Summary
- Cohere achieved ISO 42001 (AI management system) and ISO 27001 certifications; North reached general availability (Aug 2025).
- Prior Value
- Held SOC 2 Type II only; no AI-management-system certification.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Subprocessors Claim Basis
- inferred
- Subprocessors Confidence
- high
- Residency Class
- customer-controlled
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- structurally-none
