Mistral trains on user input by default for non-enterprise tiers with opt-out available

Mistral has shifted its default data usage policy to include user input and output in model training for non-enterprise tiers. This change means developers and individual users must actively opt out if they wish to exclude their conversations, documents, or other content from being used to improve Mistral’s models. The opt-out process is not uniform across services, requiring separate configurations for Vibe, mobile applications, and API services. This fragmentation could lead to oversight if users assume a single opt-out applies universally.

For enterprise customers, the policy is reversed: they are opted out of training by default, and opt-in is managed at the administrative level. This distinction creates a tiered privacy model, where larger organizations retain control over their data by default, while smaller users or individuals must navigate additional steps to achieve the same protection. The separation of opt-out controls for different services may complicate compliance efforts, particularly for organizations using multiple Mistral platforms.

The policy highlights a trade-off between data privacy and model improvement. By defaulting to opt-in for non-enterprise users, Mistral likely aims to accelerate model refinement through broader data access. However, this approach places the burden on users to understand and manage their data-sharing preferences. The explicit retention of control, where users can opt out at any time, mitigates some concerns, but the initial default setting may still raise questions about transparency and user consent.

Operational implications include the need for users to audit their settings across all Mistral services they interact with. For example, opting out of Vibe does not automatically opt out API data, and vice versa. This could lead to unintended data sharing if users assume a single setting applies globally. Organizations using Mistral’s API or Vibe for sensitive workflows may need to implement additional checks to ensure compliance with internal data policies or regulatory requirements.