Mistral Now Trains on User Data by Default — Opt-Out Requires an Enterprise Contract
Mistral has changed its default data handling: inputs and outputs from conversations on la Plateforme API, Le Chat (free and Pro tiers), and the open-source API now feed model training by default. Opting out requires an enterprise contract.
The change was documented on Mistral’s help center under data usage policy. It surfaced on Hacker News on September 2, where it drew significant engagement from developers running workloads on the API.
Tier Breakdown
| Tier | Default | Can Opt Out |
|---|---|---|
| Le Chat Free | Training on | No |
| Le Chat Pro | Training on | No |
| la Plateforme API | Training on | Enterprise only |
| Enterprise | Training on | Yes |
The enterprise tier is the only path to exclusion. No per-request header, no account toggle, no API flag exists for non-enterprise customers.
Industry Context
This default-on stance is not unusual among smaller AI providers but diverges from OpenAI’s API policy, which has maintained default-off training for paid API customers since the GPT-4 era. Anthropic does not train on API inputs by default. Google’s Gemini API defaults to opt-out for paid enterprise customers but has used aggregate usage data for safety research in some configurations.
Mistral’s position is closer to consumer AI products (ChatGPT free tier, Copilot free tier) than to API developer tooling norms. The company is explicitly choosing to use its commercial API as a training data source.
Regulated Industry Impact
Legal, financial, and healthcare firms operating on Mistral’s API are the most directly affected. Any conversation containing client information, privileged legal analysis, or health data now flows into Mistral’s training pipeline unless the customer holds an enterprise agreement. GDPR obligations do not disappear because a vendor defaults to training — processors are still bound by controller instructions.
Enterprise pricing is not publicly listed. For organizations discovering this change retroactively, the exposure window depends on when Mistral’s policy was updated relative to their first API call.
Mistral’s help center lists contact options for enterprise inquiries. The policy change has no stated effective date — the help center page reflects current policy without a changelog.