Registry / Mistral via Azure AI
Mistral via Azure AI
Mistral AI models served on Microsoft Azure via Azure AI Foundry (Microsoft Foundry) Models. Some Mistral models (e.g. Mistral Large 3, Mistral Document AI) are "sold directly by Azure", hosted and operated by Azure under Azure SLAs, while others are offered as serverless Models-as-a-Service from the partners-and-community collection, where the model is a Non-Microsoft Product but Microsoft manages the hosting and acts as data processor.
Watch-outs 6
The cells where this offering is not a clean public yes. This is what to check before you sign.
- SOC 2 Type II: Yes, sales-gated report must be requested via Trust Center (sales‑gated)
- ISO 27001: Yes, sales-gated Certificate requires request access via Trust Center
- ISO 42001: Partial Platform-level cert covers Azure AI Foundry; the Mistral model itself is not individually in scope (Mistral AI holds no ISO 42001).
- HIPAA BAA: Unclear Microsoft has not publicly listed Mistral via Azure AI as covered by the HIPAA BAA.
- Retention / ZDR: Yes, sales-gated Zero-data-retention (modified abuse monitoring) requires applying via a form and being approved; it is not self-service.
- Art. 53 summary: No public evidence Mistral explicitly says it does not disclose training datasets, indicating no public Article 53 training‑data summary has been published.
Mistral’s own compliance page confirms SOC 2 Type II coverage but states the report is only available on request, making it sales‑gated; platform‑level SOC 2 does not apply to the model.
Yes, Mistral complies with both SOC 2 Type II ... For more information, and **to request a copy of our Compliance Reports**, please visit our Trust Center
Mistral’s own Trust Center lists an ISO/IEC 27001:2022 certificate, but access is gated, and this developer‑held certification covers the model when offered through Azure AI.
Mistral AI - ISO/IEC 27001:2022 Official Certificate
Verified: Microsoft (platform) holds ISO 42001 on its own blog; the model developer Mistral holds only ISO 27001/27701 and SOC 2 (trust.mistral.ai), so the developer has no certificate and only the platform is certified, which per the rule is partial.
Microsoft has achieved ISO/IEC 42001:2023 certification—a globally recognized standard for Artificial Intelligence Management Systems (AIMS) for both Azure AI Foundry Models and Microsoft Security Copilot.
Microsoft provides a publicly accessible Service Trust Portal, serving as a maintained compliance portal for its cloud services, including Azure AI offerings.
# Service Trust Portal Learn how Microsoft cloud services protect your data, and how you can manage cloud data security and compliance for your organization.
Public HIPAA page lists Azure services in scope but does not explicitly include Mistral, and a Microsoft staff answer states compliance is not guaranteed, leaving coverage unclear.
Until Microsoft provides similar documentation or an official response for Azure serverless LLMs such as Mistral AI, it’s safest to assume that compliance isn’t guaranteed and to seek clarification directly from Microsoft support or your Azure representative.
Azure's public privacy page provides a downloadable DPA, links to EU SCCs, and a publicly listed Subprocessor List, satisfying the requirement for a public DPA with SCCs and a published subprocessor list for Mistral via Azure AI.
Read the Online Services Data Protection Addendum (DPA)... • EU Standard Contractual Clauses ... The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services.
Microsoft’s public FAQ for Azure Foundry Models explicitly states that customer data is not used to retrain models, covering Mistral via Azure AI.
Foundry Models don't use customer data to retrain models, and customer data is never shared with model providers.
The recorded source was about Azure OpenAI (OpenAI's models), not Mistral via Azure AI. The correct source is Microsoft's "Data, privacy, and security for Models sold by Azure" page, which covers Mistral AI models sold through Azure. It publicly documents retention for abuse monitoring and states th
"Models sold by Azure store and process data to provide the service and to monitor for uses that violate the applicable product terms... As depicted in the diagram above, managed customers may apply to modify abuse monitoring."
Microsoft's official region-availability page lists Mistral-Large-3 and mistral-medium-3-5 (models sold by Azure) with checkmarks in the Data Zone Standard tables, confirming EU data-zone processing is supported. The GitHub discussion #176 is an unanswered user feedback post that is not authoritativ
Mistral-Large-3, 1, ✓, ✓, ✓, ✓, ✓, ✓, ✓, ✓, ✓, ✓, ✓, ✓. mistral-medium-3-5, 1 ... Data Zone Standard. For Data Zone deployments, Microsoft processes prompts and responses anywhere within the specified data zone: United States (data processed ...), European Union (EU data boundary)
The European Commission's GPAI Code of Practice signatory list on the official page includes "Mistral AI", confirming the model developer is a signatory.
Mistral AI
Mistral explicitly says it does not disclose training datasets, indicating no public Article 53 training‑data summary has been published.
We **do not** disclose the datasets used to train our models.
Spotted an error? Submit a correction with evidence, corrections with a primary source are folded in and credited in the changelog.