AI tools and client data

Is Vibe safe for client data?

Short answer: Whether Vibe is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Free, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Vibe Pro, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Team, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Enterprise, Mistral says it does not train its models on conversations and uploaded documents, by default. Every fact on this page is Mistral's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in Mistral’s own words

Vibe is Mistral's assistant for chat, productivity and coding, formerly named Le Chat.

What you are askingFreeVibe ProTeamEnterprise
Trains the vendor's models by defaultYes, by default for non-Enterprise Vibe usage; you can opt out of training.“Input and output data are used by default to train our artificial intelligence models” source, read Yes, by default for non-Enterprise Vibe usage; you can opt out of training.“Input and output data are used by default to train our artificial intelligence models” source, read Yes, by default for non-Enterprise Vibe usage; you can opt out of training.“Input and output data are used by default to train our artificial intelligence models” source, read No, by default for Enterprise; an administrator manages the opt-in. Feedback is handled separately.“customers are opted out of training by default” source, read
How to turn training offReview the training toggle under Vibe > Privacy in the Admin panel and disable it if you want to opt out.“Allow your interactions to be used to train our models” source, read Review the training toggle under Vibe > Privacy in the Admin panel and disable it if you want to opt out.“Allow your interactions to be used to train our models” source, read Review the training toggle under Vibe > Privacy in the Admin panel and disable it if you want to opt out.“Allow your interactions to be used to train our models” source, read Not found in the pages we read.
How long data is keptNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.Not found in the pages we read.
What an admin can see or controlNot found in the pages we read.Not found in the pages we read.Team and Enterprise administrators manage users and permissions.“User Management with permissions” source, read Team and Enterprise administrators manage users and permissions.“User Management with permissions” source, read
Single sign-onNot found in the pages we read.Not found in the pages we read.Mistral documents single sign-on among the company-wide controls on Team and Enterprise.“Single sign-on (SSO) to control your users” source, read Mistral documents single sign-on among the company-wide controls on Team and Enterprise.“Single sign-on (SSO) to control your users” source, read
Business Associate AgreementNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.Not found in the pages we read.
Where the data is processedNot found in the pages we read.Not found in the pages we read.Not found in the pages we read.Not found in the pages we read.

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Mistral pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Mistral before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. We didn't find a BAA statement in the pages listed below; ask Mistral before any patient data goes in. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From Mistral’s own documentation. Each one is a change somebody can make this afternoon.

  • Review the training toggle under Vibe > Privacy in the Admin panel and disable it if you want to opt out.“Allow your interactions to be used to train our models” source, read

Worth knowing

  • Le Chat is now called Vibe, with Work, Code and Chat modes.“Le Chat is now Vibe” source, read
  • On every plan, rating a response and adding a comment authorizes use of the rating, input and output for model improvement; feedback is separate from the training default.“authorize us to use your rating, your input and output” source, read
  • Mistral publishes the subscription options for Vibe's web interface on its pricing page.“Vibe on web” source, read

Questions we get asked

Is Vibe safe for client data?

Whether Vibe is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Free, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Vibe Pro, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Team, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Enterprise, Mistral says it does not train its models on conversations and uploaded documents, by default.

Every fact on this page is Mistral's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does Mistral train its models on what we put into Vibe?

On Free, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Vibe Pro, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Team, Mistral may use conversations and uploaded documents to train its models unless somebody turns that off; on Enterprise, Mistral says it does not train its models on conversations and uploaded documents, by default.

On Free, Vibe Pro and Team: Yes, by default for non-Enterprise Vibe usage; you can opt out of training. Mistral's own words: "Input and output data are used by default to train our artificial intelligence models" (read 2026-11-05).

On Enterprise: No, by default for Enterprise; an administrator manages the opt-in. Feedback is handled separately. Mistral's own words: "customers are opted out of training by default" (read 2026-11-05).

How long does Mistral keep what we put into Vibe?

On Free, Vibe Pro, Team and Enterprise: Not found in the pages we read.

Can an administrator read what we put into Vibe?

On Free and Vibe Pro: Not found in the pages we read. On Team and Enterprise: Team and Enterprise administrators manage users and permissions. Mistral's own words: "User Management with permissions" (read 2026-11-05).

Will Mistral sign a Business Associate Agreement for Vibe?

We didn't find a BAA statement in the pages listed below; ask Mistral before any patient data goes in.

How do we find out which version of Vibe our staff are using?

Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.

Sources

Mistral’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 47 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.