Registry / compare

Cohere API vs Cohere via AWS Bedrock

The same dimension can grade differently depending on who serves the model. Every cell links to its source; grades are evidence grades, not endorsements.

Dimension	Cohere API	Cohere via AWS Bedrock
SOC 2 Type II	◐Yes, sales-gated Cohere’s trust center confirms the SOC 2 Type II report exists but is only available after a request, matching a sales‑gated scenario.	◐Yes, sales-gated Cohere’s own Trust Center confirms a SOC 2 Type II audit exists but the report is only available upon request, making it sales‑gated.
ISO 27001	◐Yes, sales-gated Cohere's own trust center lists ISO 27001 (ISMS) and offers the official certificate only via a request, so the certification exists but the artifact is sales/request-gated,...	●Yes, public Cohere’s own trust center publicly lists ISO 27001 certification, which applies to Cohere models regardless of the serving platform (AWS Bedrock).
ISO 42001	◐Yes, sales-gated Cohere's Trust Center lists the ISO 42001 certification but provides it only through a request form, indicating a gated access	●Yes, public Cohere’s own Trust Center publicly lists an ISO/IEC 42001 AI Management System certification with an official certificate, confirming the developer holds the certification.
Trust center	●Yes, public The Cohere Trust Center page is publicly accessible and contains a resources section confirming a maintained compliance portal.	●Yes, public Cohere's publicly accessible Trust Center page lists SOC 2, ISO 27001, ISO 42001, GDPR, CCPA, and HIPAA, confirming a maintained compliance portal.
HIPAA BAA	◐Yes, sales-gated Verified verbatim on Cohere's own security page that a standard BAA can be executed, but qualification requires contacting a sales representative, matching yes_sales_gated.	◐Yes, sales-gated AWS lists Amazon Bedrock (excluding Fable and Mythos) as HIPAA‑eligible and requires entering into an AWS BAA, which applies to Cohere models served via Bedrock.
GDPR DPA	◔Partial The enterprise commitments page states the DPA must be requested, so not publicly available, but also directs users to a public Trust Center where the subprocessor list is...	●Yes, public AWS publicly provides a GDPR DPA that references Standard Contractual Clauses and links to a publicly published sub‑processor list, covering the Bedrock offering used for Cohere.
No-training default	○No public evidence Cohere's own enterprise-data-commitments page confirms an opt-out model — prompts/generations may be used for training unless the customer opts out ("If you are opted out,...	●Yes, public The AWS Bedrock FAQ publicly states that customer content is not used to improve base models nor shared with providers, covering Cohere models accessed via Bedrock.
Retention / ZDR	◐Yes, sales-gated Cohere publicly documents a 30‑day retention policy and states zero‑data‑retention is available only after approval, matching a yes_sales_gated classification.	◔Partial The AWS Bedrock data‑retention page publicly documents retention policies and states ZDR is only available after contacting an account manager, so the claim is only partially satisfied.
Residency	?Unclear Verified the verbatim quote on Cohere's own docs page; the value "unclear" is a defensible judgment since the page indicates region pinning exists but leaves available regions...	◔Partial The value partial is defensible: AWS Bedrock documents self-serve In-Region pinning, and some current Cohere models are EU-available, but the flagshiip Command R+ remains...
GPAI Code	●Yes, public The EU Commission’s GPAI Code of Practice signatory list publicly includes Cohere, confirming it as a signatory.	●Yes, public The European Commission's official GPAI Code of Practice signatory list publicly includes 'Cohere', confirming the model developer is on the list.
Art. 53 summary	●Yes, public Audit confirmed the recorded value: the PDF, authored by Cohere Germany GmbH and linked from docs.cohere.com/docs/command-a-plus as "EU AI Act Article 53(1)(d): Public Summary...	●Yes, public Cohere’s official documentation for Command A+ publicly links to the Article 53 training‑data summary PDF, confirming the developer has published the required summary.