Vendors · Questionnaire · Cohere
Read Cohere’s own answers to nine buyer questions
Cohere SaaS platform. Each answer quotes Cohere’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Opt-out offered
Enterprise customers can access opt out toggle in the Cohere dashboard settings. If you are opted out, prompts and generations will not be used to train Cohere models.
Enterprise data commitments, kept 24 Oct 2026 · sha256 efc3dd381093
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for Cohere.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Deleted after 30 days, with listed exceptions
For the SaaS Platform, we automatically delete logged prompts and generations after 30 days, unless we need to retain them to comply with a legal requirement or a customer contract, or unless your usage is flagged as potentially violating our terms, including our Usage Policy (e.g. abuse or misuse of our services).
Under the FAQ “How long does Cohere retain enterprise data?”. The same answer says: “Prompts and generations that you allow Cohere to use for training purposes may be retained separately.” Enterprise data commitments, kept 24 Oct 2026 · sha256 efc3dd381093
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Zero data retention, on request, for enterprise customers who make additional usage commitments
we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services
Under the FAQ “What is zero data retention and how do I request it?”. The same answer says: “ZDR does not affect usage data, which Cohere still receives.” Enterprise data commitments, kept 24 Oct 2026 · sha256 efc3dd381093
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: Enterprise data commitments; Different Types of API Keys and Rate Limits.
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Listed on its Trust Center
You can view a list of sub-processors by visiting Cohere’s Trust Center.
Enterprise data commitments, kept 24 Oct 2026 · sha256 efc3dd381093
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
ISO 27001, ISO 42001 and a SOC 2 Type II report, on request
Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report or review our other compliance resources.
Enterprise data commitments, kept 24 Oct 2026 · sha256 efc3dd381093
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
Yes: a status history feed, with 2 incidents kept since 2026-08-05
Status history feed, kept 1 Nov 2026 · sha256 0c5b950805a1. The record.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Yes: Cohere (“Deprecations”), with 2 dated retirements kept
Cohere, “Deprecations”, kept 26 Oct 2026 · sha256 1bfa133780c0. The record.
- Cohere, Enterprise data commitments, kept 24 Oct 2026.
- Cohere, Status history feed, kept 1 Nov 2026.
- Cohere, Deprecations, kept 26 Oct 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.