Registry / compare
Cohere API vs Cohere via AWS Bedrock
The same dimension can grade differently depending on who serves the model. Every cell links to its source; grades are evidence grades, not endorsements.
| Dimension | Cohere API | Cohere via AWS Bedrock |
|---|---|---|
| SOC 2 Type II | ◐Yes, sales-gated The provider’s own Trust Center confirms the SOC 2 Type II audit exists but the report must be requested, matching a sales‑gated availability. | ◐Yes, sales-gated Cohere’s Trust Center confirms the SOC 2 Type II audit exists but the report is only obtainable by request, matching the sales‑gated classification. |
| ISO 27001 | ◐Yes, sales-gated Cohere’s Trust Center lists the ISO 27001 certification but only offers a request link to obtain the actual certificate, making it sales‑gated | ◐Yes, sales-gated Cohere's own trust center lists ISO 27001 Certification - Official Certificate with a request action, so the certification exists covering the model developer, but the... |
| ISO 42001 | ◐Yes, sales-gated Cohere’s Trust Center lists ISO 42001 certification but provides only a request link to obtain the official certificate, matching the definition of a sales‑gated certification. | ◐Yes, sales-gated Cohere's own trust center (https://trustcenter.cohere.com/) lists "### ISO 42001 Certification — Official Certificate" with a Request action and no public download, so the... |
| Trust center | ●Yes, public The Cohere Trust Center loads publicly without login and explicitly offers security and compliance resources, confirming a maintained compliance portal. | ●Yes, public Cohere's publicly accessible Trust Center page lists SOC 2, ISO 27001, ISO 42001, GDPR, CCPA and HIPAA, confirming a maintained compliance portal. |
| HIPAA BAA | ✕No, verified Provider's own trust center states the BAA does not cover the hosted API, confirming they will not sign a HIPAA BAA for this offering. | ◐Yes, sales-gated AWS lists Bedrock as HIPAA‑eligible and states a BAA with AWS is required, which covers the Cohere model accessed through Bedrock. |
| GDPR DPA | ◔Partial Cohere provides a public subprocessor list but the Data Processing Addendum is not publicly downloadable, requiring a request, so only partial compliance is met. | ●Yes, public AWS provides a publicly accessible GDPR DPA that includes SCC language and links to a publicly viewable sub‑processor list, satisfying the DPA requirement for Cohere via Bedrock. |
| No-training default | ○No public evidence The provider’s own page states data is used for training by default with an opt‑out toggle, confirming there is no public commitment not to train on customer API data. | ●Yes, public The AWS Bedrock FAQ publicly states that customer content is not used to improve base models, which applies to Cohere models accessed via Bedrock. |
| Retention / ZDR | ◐Yes, sales-gated The page publicly documents 30‑day retention and states zero‑data‑retention requires approval, making the offering sales‑gated. | ●Yes, public The abuse detection page documents default zero-data-retention and lists only OpenAI and Anthropic models as exceptions, confirming Cohere retains no data and ZDR is available. |
| Residency | ◐Yes, sales-gated Cohere's own compliance page says region selection can meet data‑residency needs but requires contacting them, indicating the capability is gated behind a sales interaction. | ●Yes, public The model card explicitly lists In-Region inference support for EU regions, confirming data can be pinned to a specific EU region. |
| GPAI Code | ●Yes, public The EC’s official GPAI Code of Practice signatory list on its own site includes Cohere, confirming it is a signatory. | ●Yes, public The EC's official GPAI Code of Practice signatory list includes Cohere, confirming the model developer is a public signatory. |
| Art. 53 summary | ●Yes, public Cohere provides a publicly accessible PDF titled “Public Summary of Training Content for Command A+ and family” meeting the EU AI Act Article 53 requirement. | ●Yes, public Cohere’s public model documentation page links directly to a publicly accessible PDF summarizing the training data, fulfilling the Article 53 publishing requirement without a gate. |