Get your Free 30 Days Gen AI Risk Discovery Trial -30 Days Gen AI Risk Trial -Start Now
Foundation Model Providers·API pay-per-token; enterprise / on-prem pricing custom·cohere.com
Cohere
Enterprise LLM platform — Command, Embed, and Rerank models with single-tenant deployment options.
Risk Score
Medium4/10
Independent assessment across data handling, compliance, security and transparency.
Overview
Cohere offers enterprise LLM APIs and on-premise / VPC deployments. By default Cohere does not train its production models on customer data submitted via the API; opt-in is required. SOC 2 Type II attested. HIPAA support is available on enterprise contracts but not standard. Notable for offering single-tenant deployments inside the customer's own cloud.
Risk factors
2- API access via personal accounts on the free / trial tier lacks enterprise contractual controls
- No HIPAA BAA on standard plans — requires enterprise contract
Recommendations
3- Enforce SSO via the enterprise plan; prohibit personal API keys for business workloads
- Use VPC / on-prem deployment for regulated data (PHI, classified, export-controlled)
- Confirm Cohere's zero-retention setting is enabled before production workloads
Data handling
- Storage
- Cohere's cloud (AWS) by default; VPC / on-prem available on enterprise
- Retention
- Configurable per tenant; zero-retention available
- Training on inputs
- Off by default — customer prompts and completions are not used to train production models
