Cohere API procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you have unresolved concerns, you can complain to the relevant data protection authority in your jurisdiction. In the UK, this will be the Information Commissioner. A list of authorities in the EEA can be found here .” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Object to our processing of your personal information where we are relying on a legitimate interest as our legal basis.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Cohere is a Canadian company subject to Canadian federal privacy laws, and so personal information transferred from the UK or the EEA to Cohere in Canada is made pursuant to adequacy regulations (for the UK, see here ; for the EEA, see here ). To the extent Cohere further transfers personal information to sub-processors or affiliates for the purpose of providing the Website, Cohere Products, or in the process of developing its models, such transfers are subject to and protected by appropriate security measures in accordance with Canadian privacy laws. We also ensure our sub-processors are subject to appropriate transfer mechanisms recognized under UK and EU laws. Our cloud infrastructure provided by GCP in the United States, for instance, is protected under the EU-US Data Privacy Framework , including its UK extension. Controller-to-processor Standard Contractual Clause agreements are used as an alternative mechanism where the transfer is not otherwise subject to an adequacy determination or derogation under applicable laws. Users of the Platform or Cohere APIs can consult our list of sub-processors , which includes data processing locations.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you reside in the UK: to make a formal complaint to us by using the contact information provided under the Contact Us section above.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Enterprise customers should consult our Enterprise Data Commitments for information about data handling associated with the Cohere’s enterprise products and SaaS platform.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Request that we transmit (or “port”) your personal information to a third party, or provide you with a copy so you can transmit it, where technically feasible.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ To Customer Data: This Policy does not apply to Customer Data (i.e. inputs and outputs) associated with the use of Cohere Products by Enterprise Users under an enterprise agreement. Cohere’s use of Customer Data is governed by the terms and conditions of the enterprise agreement and, where applicable, the Data Processing Addendum entered into between the parties. ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Request that we restrict or suspend the processing of your personal information in certain circumstances.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ Cohere is a global organization with affiliates, partners, and service providers located in many countries around the world. For that reason, Cohere may transfer, store, and/or receive certain personal information outside of your jurisdiction of residence (including, for residents of Quebec, outside of Quebec) and across geographical borders to and/or from Cohere affiliates, partners or service providers in other countries working on our behalf in accordance with applicable law. Examples of countries we transfer personal information to include, but are not limited to, Canada, the United States, and the United Kingdom. As a result, in certain circumstances, other foreign governments, courts, law enforcement agencies, or regulatory agencies may be entitled to access the personal information collected and held by Cohere, its affiliates, partners, and service providers.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For Enterprise Users: Enterprise Users can control how we train on their data and can request a DPA if personal information will be processed in the course of using Cohere Products. Review our Enterprise Data Commitments to learn more or request a DPA at privacy@cohere.com . ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you reside in France: to instruct us on the processing (retention, deletion, and disclosure) of your personal information after your death. You can change or revoke such instructions at any time.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ the model cards, available at https://docs.cohere.ai/generation-card/ ;” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We normally respond within one month, or up to three months if your request is complex. If your request is not associated with an account, then it's likely we will need to request further information to attempt to locate your personal information, if any, and verify you as the data subject.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Where required by applicable law, we utilize appropriate legal mechanisms (such as Adequacy Decisions or Standard Contractual Clauses) to protect your data during these transfers.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Depending on your location, and subject to certain limitations, you may have the right to access, update, correct, or delete your personal information in our control, or the right to obtain a copy of your personal information or to receive certain personal information in a structured, commonly-used technological format.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ These rights may be limited, for example if fulfilling your request would reveal personal information about another person.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you would like to exercise any of these rights, please use the contact details set out above.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ In addition to the right to access, update, correct, or delete your personal information and the right to withdraw your consent described in the Your Rights and Choices section of this Policy above, you may also have the right to:” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to meet business or legal requirements, and as otherwise permitted or required by applicable law, including litigation holds. We may collect and use the same category of personal information for different purposes and in different contexts, and because rules differ by jurisdiction, there is not typically a fixed retention period that will always apply to a particular category of personal information.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Retention will depend on the context and purpose for which the information was collected. For example, we may retain information you use to register for the Platform for as long as you maintain an account with us. We may also retain your email address for as long as you are subscribed to our marketing emails, or, if you unsubscribe, to ensure that we comply with your unsubscribe request. Enterprise Users of the Platform can consult retention practices for inputs and outputs on the Platform here . Retention of inputs and outputs on the Platform is generally 30 days for Enterprise Users. For Trial Users and Researchers, the Platform is not intended to process personal information. If personal information is inadvertently included in an input, deletion can be requested by emailing privacy@cohere.com as set out below.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ A framework for the retention and destruction of personal information consistent with applicable laws.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “It is our policy not to retain California personal information after we determine it is no longer necessary for the purposes set out in this Policy or as otherwise required to meet legal or business requirements. Retention will depend on the context and purpose for which the information was collected. For example, (i) we retain records of email opt-outs indefinitely; and (ii) we may retain server logs reflecting California traffic to our website for several months or years for security purposes.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Platform Account Deletion: You can delete your account at any time by selecting “Your Profile” in the Platform, navigating to the “Danger Zone” tab, and clicking on “Delete my Account”. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To pay for a Subscription Order as described in an accepted Subscription Agreement, you will need to provide Cohere or, if applicable, a third-party payment processor (the “ Payment Processor ”) with the information necessary to process payment from you, including the billing information requested on the Cohere Solution or the applicable Payment Processor’s platform. The processing of payments will be subject to the terms, conditions and privacy policies of the Payment Processor, if any, in addition to these Terms of Use. We are not responsible for any error by, or other acts or omissions of, any Payment Processor. You may pay for your Subscription Order via credit card or any other manner then available on the Cohere Solution or applicable Payment Processor’s platform. By submitting your payment information to us or the Payment Processor, you authorize us or the Payment Processor to charge the applicable payment method at our or their convenience (but within thirty (30) days of credit card authorization). You represent and warrant that you will not use any credit card or other form of payment unless you have all necessary authorization to do so. We assume that because Subscription Order payments require a valid credit card, only persons age 18 or over are placing Subscription Orders and providing us and/or the Payment Processor with the information requested during the payment process. We and/or the Payment Processor are not liable in the event your children or others acting with or without your permission use your credit card or other means of payment to make purchases on the Cohere Solution or the Payment Processor’s platform (and to the extent your minor children make any such purchases, you hereby represent and warrant that they are authorized to do so); however,” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Affiliates: We may transfer (or otherwise make available) your personal information to our affiliates who help us to meet our legal and compliance requirements and operational needs. Vendors and Service Providers: We may transfer (or otherwise make available) all categories of personal information we collect to third-party companies that provide services to us or on our behalf. We use vendors and service providers for services such as cloud computing and data storage, advertising and analytics; communications; and customer support and management. Our vendors and service providers may be located in the U.S., Canada, or other foreign jurisdictions. Please refer to International Transfers to learn more. Users of the Platform or Cohere APIs can also consult our list of sub-processors .” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We disclose your personal information to the parties and entities described below with your consent or as required or permitted by law. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ To our knowledge, we do not “sell” or “share” the personal information of individuals under 16 years of age.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ COHERE DOES NOT REPRESENT, WARRANT, OR COVENANT THAT IT HAS REVIEWED ANY THIRD PARTY TERMS AND CONDITIONS AND IS NOT RESPONSIBLE FOR ANY API DATA OR FINETUNING DATA SHARED WITH THIRD PARTIES. COHERE DOES NOT ENDORSE ANY THIRD PARTY SERVICE AND YOU ACKNOWLEDGE THAT IF YOU CHOOSE TO SUBMIT ANY API DATA OR FINETUNING DATA TO THE COHERE SOLUTION, YOU DO SO ENTIRELY AT YOUR OWN RISK. YOU FURTHER ACKNOWLEDGE THAT ANY THIRD PARTY TERMS AND CONDITIONS MAY NOT HAVE THE SAME OR SIMILAR COMMITMENTS OR PROTECTIONS AS THOSE CONTAINED IN THESE TERMS OF USE AND ANY FINETUNING DATA OR API DATA SHARED BY COHERE WITH THIRD PARTIES WILL BE ACCESSED, USED, AND OTHERWISE HANDLED BY SUCH THIRD PARTIES IN ACCORDANCE WITH THEIR TERMS AND CONDITIONS, WHICH MAY PERMIT SUCH THIRD PARTY TO USE FINETUNING DATA OR API DATA FOR ITS OWN PURPOSES.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Cohere is a Canadian company subject to Canadian federal privacy laws, and so personal information transferred from the UK or the EEA to Cohere in Canada is made pursuant to adequacy regulations (for the UK, see here ; for the EEA, see here ). To the extent Cohere further transfers personal information to sub-processors or affiliates for the purpose of providing the Website, Cohere Products, or in the process of developing its models, such transfers are subject to and protected by appropriate security measures in accordance with Canadian privacy laws. We also ensure our sub-processors are subject to appropriate transfer mechanisms recognized under UK and EU laws. Our cloud infrastructure provided by GCP in the United States, for instance, is protected under the EU-US Data Privacy Framework , including its UK extension. Controller-to-processor Standard Contractual Clause agreements are used as an alternative mechanism where the transfer is not otherwise subject to an adequacy determination or derogation under applicable laws. Users of the Platform or Cohere APIs can consult our list of sub-processors , which includes data processing locations.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Affiliates: We may transfer (or otherwise make available) your personal information to our affiliates who help us to meet our legal and compliance requirements and operational needs.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not sell personal information for monetary compensation. However, our disclosures of business contact information, device and online information, professional information and geolocation information (as described above) to our advertising, marketing, and related analytics providers or partners (via cookies and tracking technologies) may qualify a “sale” or “sharing” of personal information under the CCPA. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may also receive information about you or your company from third-party sources to support the marketing and sale of our products. This includes using data enrichment services, marketing vendors, and publicly available sources to identify business prospects who may be interested in our products. The information we receive may include your name, business email, job title, company, and types of products you may be interested in.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Cohere is a global organization with affiliates, partners, and service providers located in many countries around the world. For that reason, Cohere may transfer, store, and/or receive certain personal information outside of your jurisdiction of residence (including, for residents of Quebec, outside of Quebec) and across geographical borders to and/or from Cohere affiliates, partners or service providers in other countries working on our behalf in accordance with applicable law. Examples of countries we transfer personal information to include, but are not limited to, Canada, the United States, and the United Kingdom. As a result, in certain circumstances, other foreign governments, courts, law enforcement agencies, or regulatory agencies may be entitled to access the personal information collected and held by Cohere, its affiliates, partners, and service providers.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Legal and Compliance Obligations: We and our service providers may disclose your personal information in response to a search warrant, court order, or other legally valid inquiry or order. We may also disclose information to government authorities or other organizations for the purposes of investigating a breach of an agreement or contravention of law; detecting, suppressing, or preventing fraud; establishing, exercising, or defending legal claims; or investigating or preventing actual or suspected loss or harm to persons or property.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We work with third parties such as ad networks and other advertising companies that use their own tracking technologies (including cookies) on our Website in order to provide you with tailored advertisements across the Internet. This is a common marketing practice referred to as Interest-Based Advertising. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Where required by applicable law, we utilize appropriate legal mechanisms (such as Adequacy Decisions or Standard Contractual Clauses) to protect your data during these transfers.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Business Transactions: We may transfer any information we have about you as an asset in connection with a proposed or completed merger, acquisition, or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Cohere or as part of a corporate reorganization or other change in corporate control.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Analytical or Performance Cookies are used mainly to understand how Visitors and Platform users arrive at and interact with the Website or Platform. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc. They help us understand and analyze the performance and usability of the Website/Platform and of advertisements that refer visitors to the Website or Platform. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Any use of third-party software provided in connection with the Cohere Solution will be governed by such third parties’ licences and not by these Terms of Use;” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Cohere may engage third parties, including cloud service providers, to provide the Cohere Solution or the Services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Google is one of the services we use for analytics purposes. You can find more information about Google Analytics privacy and security practices at the following links: https://policies.google.com/technologies/partner-sites and https://support.google.com/analytics/topic/2919631 . To prevent Google Analytics’ javascripts from sharing information with Google Analytics about website visit activity, you can download and install the plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Vendors and Service Providers: We may transfer (or otherwise make available) all categories of personal information we collect to third-party companies that provide services to us or on our behalf. We use vendors and service providers for services such as cloud computing and data storage, advertising and analytics; communications; and customer support and management. Our vendors and service providers may be located in the U.S., Canada, or other foreign jurisdictions. Please refer to International Transfers to learn more. Users of the Platform or Cohere APIs can also consult our list of sub-processors .” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ These Terms of Use will govern the placement of any order you make through the Cohere Solution for a subscription to the Services (each such order, a “ Subscription Order ”). We will confirm your request by sending an email to the email address you have provided. Your placement of a Subscription Order through the Cohere Solution is an offer to purchase the Services ordered, and we may accept your Subscription Order by providing a subscription agreement (the “ Subscription Agreement ”) for your acceptance and processing your payment through the Cohere Solution. Your receipt of an electronic or other form of Subscription Order confirmation does not signify our acceptance of your Subscription Order, nor does it constitute confirmation of our offer to sell. For any reason, we may decline to accept your Subscription Order or any part of your Subscription Order. No Subscription Order will be considered accepted by Cohere until the applicable Subscription Agreement has been accepted by us and your payment has been processed. If (a) we decline to accept your Subscription Order, (b) one or more elements of your Subscription Order are unavailable, or (c) your Subscription Order cannot be fulfilled for any reason in our discretion, we will attempt to notify you as soon as practicable at the email address you provided. We may require additional verifications or information before considering any Subscription Order.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Enterprise Users: Individuals (such as employees or contractors) who use Cohere Products on the Platform using a paid account with a credit card on file, or are accessing the Platform via their employer under a paid commercial agreement or enterprise trial agreement. ” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ you and we acknowledge that Apple has no obligation to furnish any maintenance or support services with respect to the Cohere Solution;” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ If the Cohere Solution is provided to you through the Apple Inc. (Apple Inc. together with all of its affiliates, “ Apple ”) App Store, the following terms and conditions apply to you in addition to all the other terms and conditions of these Terms of Use:” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ If the Cohere Solution is provided to you through the Google Inc. (Google Inc. together with all of its affiliates, “ Google ”) Google Play store, the following terms and conditions apply to you in addition to all the other terms and conditions of these Terms of Use:” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ These trial and research environments are not intended for the processing of personal information. However, as a further safeguard, Cohere takes steps to de-identify input and output data prior to any use for research and development purposes. If you need to include personal information in inputs to Cohere Products, consider moving to an enterprise tier and entering into a commercial agreement and DPA with Cohere. If you are conducting a research project that involves personal information, contact Cohere at safety@cohere.com before initiating your project. ” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ you acknowledge that Google is not responsible for providing support services for the Cohere Solution; and” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Subscription and Services options displayed on the Cohere Solution may be discontinued or unavailable for any other reason, and prices are subject to change. Except where otherwise indicated, all prices do not include any applicable sales taxes, which will be added to your total purchase price. You are responsible for the payment of any provincial and local sales or use taxes that may apply to your Subscription Order. We will provide you no less than seven (7) days’ notice prior to implementing a change to our prices.” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We may run promotional offers from time to time on the Cohere Solution. The terms of any such promotion will be posted on the Cohere Solution. Unless otherwise indicated, we may establish and modify, in our sole discretion, the terms of such offer and end such offer at any point. Promotional offers may not be available in your jurisdiction. ” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ For Enterprise Users: Enterprise Users can control how we train on their data and can request a DPA if personal information will be processed in the course of using Cohere Products. Review our Enterprise Data Commitments to learn more or request a DPA at privacy@cohere.com . ” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ notwithstanding anything to the contrary hereunder, you may use the Cohere Solution only on an iPhone or iPod touch that you own or control;” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Trial Users : Individuals who create or access a free trial account to test out our Platform under our standard Terms of Use with no payment method on file. ” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ If the amount to be charged to your billing account varies from the amount you preauthorized (other than due to the imposition or change in the amount of applicable sales taxes), you have the right to receive, and we will provide, notice of the amount to be charged and the date of the charge before the scheduled date of the transaction. Any agreement you have with your payment provider will govern your use of your payment method of choice. You agree that we may accumulate charges incurred and submit them as one or more aggregate charges during or at the end of each billing cycle.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.