Le Chat safety profile

What it does with your data

Unless someone opts out, what your staff type into Le Chat can be used to train Mistral AI’s models. Enterprise plans are the exception.

Mistral AI says conversations, documents and other content users provide may be included in its model training programs. Files staff upload or attach count as input too. Mistral AI’s help pages now call the chat product “Vibe,” so you will see that name in settings and support articles.

The default depends on the account:

• Standard Vibe accounts: users are “not opted out by default.”
• Teams: an admin can turn training off for the whole organization, but the pages checked do not say what the default is.
• Enterprise: customers are “opted out of training by default.”

On how long chats are kept, Mistral AI says data is held for as long as personal data are processed. It gives no specific period for conversation content. Some account data has fixed periods. For example, the account email is kept for 1 year after account deletion. The pages checked do not mention human review of chats.

Settings to change first

Turn off training before anyone uses the tool for work. Mistral AI says that once an opt-out is confirmed, it stops using input and output data for training.

1. For the organization (admin): in the Admin panel, select Vibe under the Manage section. Then, under the Privacy section, disable the toggle “Allow your interactions to be used to train our models.”
2. On phones (each user): in the mobile app, open Settings, select Data & Account Controls under the Account section, and deselect the “Enable data sharing” checkbox.
3. If anyone uses the API: in the Admin panel, open the Privacy menu in the left-hand navigation bar, then disable the toggle under “Anonymous improvement data.”

The chat toggle and the API toggle are separate. Turning off one does not turn off the other.

Free and paid tiers

The big difference is the training default. Standard Vibe users start opted in to training. Enterprise customers start opted out. The pages checked do not name Free, Pro or Student plans, so you cannot tell from them exactly which plans count as standard accounts.

Admin features also depend on the plan. Single sign-on, user management and the Flash Answers opt-out are described for Team and Enterprise plans only. If staff sign up on their own with personal accounts, nobody in your organization can manage these settings for them.

Enterprise customers have one more option. Some features that move data outside the EU can be switched off for the organization by contacting Mistral AI. One example is the Connector feature, which sends retrieved data to the United States when it is turned on.

Admin controls

On Team and Enterprise plans, an admin can set up single sign-on, manage users and their permissions, and opt the organization out of Flash Answers. On Teams, the admin can turn off training for everyone at once. On Enterprise, the admin manages the training opt-in toggle.

By default, data is hosted in the European Union. It is hosted in the United States only if you explicitly use the US API endpoint.

Mistral AI’s Trust Center lists these documents:

• ISO/IEC 27001:2022 Certificate
• ISO/IEC 27701:2019 Certificate
• Statement of Applicability
• SOC 2 Type II letter of attestation
• Penetration Testing Report 2026, on request

The Trust Center also lists HIPAA compliance information. It says a Business Associate Agreement is offered for qualifying services.

Using it with donor and client data

Use a Team or Enterprise plan so your organization controls the settings. On Teams, turn off training for the organization before inviting staff. Do not let colleagues use personal accounts for work, because those start opted in to training.

Even with training turned off, keep these out of every chat:

• Donor names together with gift amounts or giving history
• Client case notes or anything that identifies a person you serve
• Health information, bank details or card numbers
• Exported spreadsheets from your donor database

A safer pattern is to remove names first. Ask Le Chat to help with a template thank-you letter, then add the donor details yourself in your own systems.

Before staff use it with donor data, get these in writing from Mistral AI:

• How long chats and uploaded files are kept, since the pages checked give no specific period
• Whether the Teams plan starts opted in or out of training
• Whether staff should leave features that move data outside the EU, such as Connectors, turned off

Questions people ask

Does turning off training on the website also cover the mobile app?

The help pages describe the admin toggle and a separate mobile setting, Enable data sharing. They do not say whether one covers the other. To be safe, set both, and set the API toggle separately if anyone uses the API.

Where does our data go?

By default it is hosted in the European Union. Some features can temporarily send data outside the EU to subprocessor locations. Mistral AI says it uses Standard Contractual Clauses for those transfers.

Is it safe for health information?

The Trust Center mentions HIPAA compliance information and a Business Associate Agreement for qualifying services. The pages checked do not say which plans qualify. Until Mistral AI confirms that in writing, keep health details out of chats.