Cohere security review: SOC 2, AI training & subprocessors

What Cohere publishes about its security, privacy and use of your data, with a link to the page each fact came from. Checked October 10, 2026.

"Not found" means our reader didn't find it on the public pages it could read; the vendor may still publish it.

Does Cohere train AI on your data?

Statements differ between pages

Cohere's own words (cohere.com/security):

Opt out of model training at any time — your data stays yours.

Vendors often have different rules for consumer or free plans and for business or enterprise plans. Check the terms for the plan you would use.

Other statements we found

Section 2.3 (Research and Model Improvement): Analyzing usage patterns and using Trial or Research User Inputs/Outputs to improve the performance and safety of our AI models.
cohere.com/privacy

Different pages say different things. This is often a split between business plans and free or consumer plans. Read each quote for the plan you would use.

Certifications Cohere claims

Privacy laws and frameworks mentioned: GDPR, CCPA/CPRA, EU-U.S. Data Privacy Framework. These are laws the vendor says it follows, not certifications.

A certification on a website is a claim. For anything sensitive, ask Cohere for the SOC 2 report or ISO certificate.

Cohere subprocessors

Cohere lists 25 subprocessors on trustcenter.cohere.com/subprocessors:

• Production Data Use is Restricted
• Change Management Policy
• Configuration and Asset Management Policy
• Backup Restoration Testing
• Automated Backup Process
• Uptime and Availability Monitoring
• Acceptable Use Policy
• Performance Review Policy
• Internal Control Policy
• Data Classification Policy
• Data Retention and Disposal Policy
• Disposal of Customer Data
• Vulnerability and Patch Management Policy
• Third-Party Penetration Test
• Incident Response Plan Testing
• Incident Response Plan
• Vendor Risk Assessment
• Risk Assessment
• Vendor Risk Management Policy
• Automated Alerting for Security Events
• Network Security Policy
• Unique Access IDs
• Access Control and Termination Policy
• Encryption-in-Transit
• Physical Security Policy

Security features mentioned

Key documents

How this score is worked out

The score measures how much of a standard security review our reader could answer from Cohere's public pages. It is not a rating of how secure Cohere is, and a "No" can mean the document exists where our reader couldn't see it.

Other AI vendors

Anthropic · Copy.ai · Cursor · Descript · ElevenLabs · Glean · Harvey · Hugging Face · Jasper · Mistral AI · Pinecone · Replit

Source: Cohere's own public website (5 pages read on October 10, 2026). Stormap is not affiliated with Cohere. Facts are what the vendor publishes about itself; certifications are claims, not verified audit reports. Something wrong or out of date? Pages are re-checked every two weeks.