Does Mistral AI (La Plateforme API and Le Chat) sign a BAA?
Not confirmed
None of Mistral AI's public legal terms, help center or trust center mention HIPAA or Business Associate Agreements, so BAA availability for La Plateforme or Le Chat is unknown. Ask Mistral directly before sending any PHI.
- Business associate
- Mistral AI
- Tool
- Mistral AI (La Plateforme API and Le Chat)
- Plans with a BAA
- Not stated
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| La Plateforme API (pay-as-you-go / enterprise) | Not confirmed | Not stated | The Commercial Terms, Additional Product Terms and DPA overview are GDPR-oriented and don't mention HIPAA. Zero Data Retention is available on request for pay-as-you-go customers on stateless endpoints, at Mistral's discretion.[1],[2],[3],[4] |
| Le Chat (Free / Pro / Team / Enterprise) | Not confirmed | Not stated | No HIPAA or BAA statement found. ZDR does not apply to chat, agents, conversations or libraries. The Usage Policy restricts health-related guidance.[1],[4],[5] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Mistral AI says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Mistral models via API and Le Chat | Not stated | Mistral publishes no BAA coverage information.[1],[2],[5] |
LLM APIs that offer a BAA
- Claude API (Claude Platform)BAA on: First-party API (custom / negotiated BAA), First-party API (self-serve Console enablement)Some plans only
- CohereBAA on: Custom model development engagementSome plans only
- GroqCloudBAA on: GroqCloud paid, generally available services (customers with an existing Groq agreement)Some plans only
- OpenAI API platformBAA on: API (enterprise / sales-managed accounts), API (pay-as-you-go / self-serve organizations), API FedRAMP (with Modified Retention)Signs a BAA
All BAA-ready alternatives to Mistral AI (La Plateforme API and Le Chat)
Sources
- Can I activate Zero Data Retention (ZDR)?
- Commercial Terms of Service
- Additional Product Terms
- Do you have SOC 2 or ISO 27001 certification?
- Usage Policy
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.