The Cohere platform and API

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AVD-2026-0027

Kind

API and platform

Jurisdiction

Global

Last verified

15 September 2026

Added

15 September 2026

• Cohere automatically deletes logged prompts and generations after 30 days.
• Customers can opt out of prompts and generations being used to train Cohere models in dashboard settings at any time.
• Retention of inputs and outputs on the platform is described as generally 30 days for enterprise users.
• Cohere is a Canadian company and names Canada, the United States and the United Kingdom among the countries it transfers personal information to.

Used for training by default, Retention period, Deletion on request, Storage region and residency, Subprocessor list published, Human review of content, Opt out available, DPA available, Persistent memory across sessions, Last change to the terms. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

Used for training by defaultStated

Trial and research input and output may be used for research and development, while enterprise customers control training on their data and can opt out.Cohere privacy policy, primary source, 1 May 2026.

Retention periodStated

Logged prompts and generations are automatically deleted after 30 days, and platform retention for enterprise users is described as generally 30 days.Cohere enterprise data commitments, primary source, 5 December 2025.

Deletion on requestStated

Self serve account deletion in the dashboard or by email, and deletion on request within 30 days of termination, with API data and fine tuning data carved out.Cohere software as a service agreement, primary source, 8 April 2025.

Storage region and residencyStated

No residency commitment. Transfers are disclosed by example, naming Canada, the United States and the United Kingdom among others, and deployment choice is offered instead.Cohere privacy policy, primary source, 1 May 2026.

Subprocessor list publishedStated

Yes. The privacy policy directs platform and API users to a published subprocessor list on the trust centre.Cohere privacy policy, primary source, 1 May 2026.

Human review of contentStated

Safety and security teams may review user prompts, generations and logs to enforce the customer agreements where misuse is suspected.Cohere enterprise data commitments, primary source, 5 December 2025.

Opt out availableStated

Yes, a dashboard setting that can be changed at any time, covering prompts and generations being used to train Cohere models.Cohere enterprise data commitments, primary source, 5 December 2025.

DPA availableStated

Available on request to platform customers by contacting the privacy address. The software agreement itself does not incorporate one.Cohere enterprise data commitments, primary source, 5 December 2025.

Persistent memory across sessionsSilent

No memory or persistent personalisation feature is described in any of the governing documents read.Cohere privacy policy, primary source, 1 May 2026.

Last change to the termsStated

The privacy policy prints Last Updated 1 May 2026, the enterprise data commitments 5 December 2025, the software agreement 8 April 2025 and the terms of use 7 September 2022.Cohere privacy policy, primary source, 1 May 2026.

1. 30 days

   Automatic deletion of logged prompts and generations

   Cohere enterprise data commitments, primary source, as of 5 December 2025.

2. 30 days

   Post termination deletion window on request

   Cohere software as a service agreement, primary source, as of 8 April 2025.

Four documents govern this vendor and they do not agree with each other. The oldest, from 2022, grants a broad training and sharing licence in capitals, while the newer ones describe a thirty day deletion and a dashboard opt out. A buyer should establish in writing which instrument governs their account, because citing the newest page while signing under the oldest terms is how a commitment evaporates during an audit.

1. Cohere privacy policyPrimary · 1 May 2026
2. Cohere enterprise data commitmentsPrimary · 5 December 2025
3. Cohere software as a service agreementPrimary · 8 April 2025
4. Cohere terms of usePrimary · 7 September 2022

• VerifiedAPI and platformAVD-2026-0026

  Amazon Bedrock

  United States · verified 15 September 2026

  Amazon Bedrock uses a zero data retention security model, so by default it does not store model inputs or outputs.

• VerifiedAPI and platformAVD-2026-0004

  The OpenAI API and platform

  United States · verified 15 September 2026

  The platform guide states that as of 1 March 2023, data sent to the OpenAI API is not used to train or improve OpenAI models.

• Open questionOpen questionAVD-2026-0029

  Is a subprocessor change notice period actually enforceable?

  European Union · verified 15 September 2026

  Article 28 of the General Data Protection Regulation states that the processor shall not engage another processor without prior specific or general written authorisation of the controller.

• Open questionOpen questionAVD-2026-0031

  Who owns the memory record an assistant builds about you?

  Global · verified 15 September 2026

  OpenAI states that even if you delete a chat, any saved memories from it can still be used in future conversations.

• Open questionOpen questionAVD-2026-0030

  Does zero data retention survive an abuse investigation?

  Global · verified 15 September 2026

  OpenAI states a flagged image is retained for manual review even where zero data retention, modified abuse monitoring or eyes off is enabled.

• Open questionOpen questionAVD-2026-0028

  Does a promise not to train on your data cover the safety classifiers?

  Global · verified 15 September 2026

  OpenAI's enterprise page says business data may be run through automated content classifiers and safety tools, with the classification kept as metadata rather than content.