AI privacy is increasingly decided by product configuration, not public positioning.
Mistral's help article says inputs and outputs, including conversations, documents, and other user-provided content, may be included in model training programs in certain cases. It also says Vibe users are not opted out by default, while Vibe Enterprise customers are opted out by default and the opt-in toggle is managed at the admin level.
The operational detail matters: Vibe and API training controls are separate. Mistral says users must disable data sharing in Vibe settings or the admin panel, and separately disable “Anonymous improvement data” for Mistral Studio and related API services. Uploaded documents inside Vibe count as input data.
Grey Haven's read: enterprise AI governance is moving into the settings plane. Legal language is not enough if the same vendor has different defaults across consumer apps, enterprise workspaces, mobile apps, studio tools, and APIs. The failure mode is not usually malice. It is unmanaged surface area.
Operators should build an AI data-control inventory that lists every employee-facing tool, every API surface, the default training setting, who owns the admin toggle, how changes are logged, and whether uploaded files follow the same policy as chat text. If that inventory does not exist, the organization does not actually know its AI data posture.
This story becomes more important if vendors keep splitting controls across products while employees move work between chat, mobile, studio, and API contexts. The useful procurement question is blunt: show the defaults, show the toggles, show the audit trail.
Source: Mistral Help Center, “Can I opt out of my input or output data being used for training?”
