Cohere vs. sevdesk: data protection per plan

no (trial keys are subject to the terms of use and privacy policy; the Enterprise Data Commitments and the DPA offer apply to paying SaaS customers. Privacy policy: trial environments are not intended for personal data; for that, switch to an enterprise plan with a contract)

yes for SaaS/Model Vault customers on request (privacy@cohere.com, sent after NDA; the DPA contains the EU standard contractual clauses of 2021-06-04). According to the Enterprise Data Commitments, no DPA is required for private and third-party cloud deployments.

yes (on request: SaaS customers receive the DPA via privacy@cohere.com; according to the Trust Center, sent after a signed NDA)

yes (data processing agreement under Art. 28(3) GDPR, publicly available as a PDF, version Offenburg 04.07.2025; according to the help centre it is concluded digitally and does not need to be returned; applies to all customers, as according to the terms sevdesk only contracts with businesses)

yes (data processing agreement under Art. 28(3) GDPR, publicly available as a PDF, version Offenburg 04.07.2025; according to the help centre it is concluded digitally and does not need to be returned; applies to all customers, as according to the terms sevdesk only contracts with businesses)

yes (data processing agreement under Art. 28(3) GDPR, publicly available as a PDF, version Offenburg 04.07.2025; according to the help centre it is concluded digitally and does not need to be returned; applies to all customers, as according to the terms sevdesk only contracts with businesses)

yes (data processing agreement under Art. 28(3) GDPR, publicly available as a PDF, version Offenburg 04.07.2025; according to the help centre it is concluded digitally and does not need to be returned; applies to all customers, as according to the terms sevdesk only contracts with businesses)

Privacy policy (as of 2026-05-01, section 2.3): for Trial Users and Researchers, Cohere collects inputs and outputs and may use them for research and development, including 'using inputs/outputs to improve the performance and safety of Cohere Products'; data is de-identified beforehand; users should not enter personal data. An opt-out for trial keys is not described (the dashboard switch 'Data Controls' is described in the Enterprise Data Commitments for paying customers). According to the Enterprise Data Commitments, the Terms of Use and the privacy policy apply to trial keys; the Terms of Use (as of 2022-09-07, section 4.1) allow Cohere to use 'Customer Data', among other things, to 'IMPROVE AND ENHANCE THE COHERE SOLUTION' and other offerings, including by sharing API data and fine-tuning data with third parties.

Enterprise Data Commitments: for private and third-party cloud deployments, Cohere does not receive prompts and generations. Privacy policy: data in the customer's or cloud provider's environment is not accessible to Cohere and is not used for training. Model Vault as a platform managed by Cohere: use for training not separately addressed in the documentation or the Enterprise Data Commitments; for Encrypted Vault, prompts and responses are, according to the documentation, not visible in plaintext even to Cohere.

Enterprise Data Commitments (as of 2025-12-05): opt-out from the use of prompts and generations for training in the dashboard settings ('Data Controls', switch set to 'Off'); the change applies to data generated thereafter. For abuse monitoring, prompts and logs may be reviewed; PII is filtered before any possible use for training. Model Training Privacy Notice (as of 2026-05-01): 'Where a user has given Cohere permission to use inputs and outputs for model training', the data is de-identified beforehand. Default value of the switch for new accounts: not publicly documented.

No explicit statement on training AI models with customer data. Help article "Belege erfassen" (recording receipts): the automatic receipt recognition is continuously learning and improves with every uploaded receipt. Receipt capture product page: booking category suggestions learn from the user's assignments. DPA section 3(6): operational data may be used anonymously and in aggregated form for evaluation purposes and, where applicable, for error analysis and further development of the products; section 2(2): statistical use only anonymised and aggregated. Whether this includes model training across customer accounts and whether an opt-out exists is not described.

No explicit statement on training AI models with customer data. Help article "Belege erfassen" (recording receipts): the automatic receipt recognition is continuously learning and improves with every uploaded receipt. Receipt capture product page: booking category suggestions learn from the user's assignments. DPA section 3(6): operational data may be used anonymously and in aggregated form for evaluation purposes and, where applicable, for error analysis and further development of the products; section 2(2): statistical use only anonymised and aggregated. Whether this includes model training across customer accounts and whether an opt-out exists is not described.

No explicit statement on training AI models with customer data. Help article "Belege erfassen" (recording receipts): the automatic receipt recognition is continuously learning and improves with every uploaded receipt. Receipt capture product page: booking category suggestions learn from the user's assignments. DPA section 3(6): operational data may be used anonymously and in aggregated form for evaluation purposes and, where applicable, for error analysis and further development of the products; section 2(2): statistical use only anonymised and aggregated. Whether this includes model training across customer accounts and whether an opt-out exists is not described.

No explicit statement on training AI models with customer data. Help article "Belege erfassen" (recording receipts): the automatic receipt recognition is continuously learning and improves with every uploaded receipt. Receipt capture product page: booking category suggestions learn from the user's assignments. DPA section 3(6): operational data may be used anonymously and in aggregated form for evaluation purposes and, where applicable, for error analysis and further development of the products; section 2(2): statistical use only anonymised and aggregated. Whether this includes model training across customer accounts and whether an opt-out exists is not described.

Trust Center FAQ: hosting on Google Cloud servers in US-Central; according to the FAQ, Cohere does not use servers outside the USA.

Region depends on the deployment at the customer or the cloud provider. Model Vault (Cohere-managed, single-tenant): documentation 'Compliance' for Encrypted Vault: 'Region selection supports data-residency requirements; contact Cohere to confirm the regions available for your vault.' There is no public list of regions.

Trust Center FAQ: hosting on Google Cloud servers in US-Central. According to the FAQ, in certain cases the offering can be configured so that no customer data is stored at Cohere ('ephemeral').

Sub-processor list (as of 10.04.2024): hosting with Amazon Web Services EMEA SARL, data hosted exclusively in Germany, access from third countries for support purposes conceivable; TOMs: AWS Frankfurt data centres; security page: hosting with AWS (no location stated); FAQ on the online banking page: receipts are stored 'in a certified data centre with server location in Germany' (translated). DPA section 2(3): processing in principle in the EU/EEA, outside only after prior notice and subject to Art. 44 et seq. GDPR. Where the AI features (receipt recognition, bank reconciliation, AI agent Sevi) are processed and whether external AI providers are used for them is not documented.

Sub-processor list (as of 10.04.2024): hosting with Amazon Web Services EMEA SARL, data hosted exclusively in Germany, access from third countries for support purposes conceivable; TOMs: AWS Frankfurt data centres; security page: hosting with AWS (no location stated); FAQ on the online banking page: receipts are stored 'in a certified data centre with server location in Germany' (translated). DPA section 2(3): processing in principle in the EU/EEA, outside only after prior notice and subject to Art. 44 et seq. GDPR. Where the AI features (receipt recognition, bank reconciliation, AI agent Sevi) are processed and whether external AI providers are used for them is not documented.

Sub-processor list (as of 10.04.2024): hosting with Amazon Web Services EMEA SARL, data hosted exclusively in Germany, access from third countries for support purposes conceivable; TOMs: AWS Frankfurt data centres; security page: hosting with AWS (no location stated); FAQ on the online banking page: receipts are stored 'in a certified data centre with server location in Germany' (translated). DPA section 2(3): processing in principle in the EU/EEA, outside only after prior notice and subject to Art. 44 et seq. GDPR. Where the AI features (receipt recognition, bank reconciliation, AI agent Sevi) are processed and whether external AI providers are used for them is not documented.

Sub-processor list (as of 10.04.2024): hosting with Amazon Web Services EMEA SARL, data hosted exclusively in Germany, access from third countries for support purposes conceivable; TOMs: AWS Frankfurt data centres; security page: hosting with AWS (no location stated); FAQ on the online banking page: receipts are stored 'in a certified data centre with server location in Germany' (translated). DPA section 2(3): processing in principle in the EU/EEA, outside only after prior notice and subject to Art. 44 et seq. GDPR. Where the AI features (receipt recognition, bank reconciliation, AI agent Sevi) are processed and whether external AI providers are used for them is not documented.

• Google Cloud (infrastructure): USA
• Fullstory (software delivery): USA
• LaunchDarkly (feature flags): USA
• New Relic (platform monitoring): USA
• Retool (software delivery): USA
• Sentry IO (software delivery): USA
• Segment (event and error processing): USA
• Sendgrid (e-mail communication): USA
• Vercel (web application hosting): USA
• Salesforce (customer support management): USA
• Wiz (cloud security and compliance): USA
• Forethought (customer support management): USA

• Google Cloud (infrastructure): USA
• Fullstory (software delivery): USA
• LaunchDarkly (feature flags): USA
• New Relic (platform monitoring): USA
• Retool (software delivery): USA
• Sentry IO (software delivery): USA
• Segment (event and error processing): USA
• Sendgrid (e-mail communication): USA
• Vercel (web application hosting): USA
• Salesforce (customer support management): USA
• Wiz (cloud security and compliance): USA
• Forethought (customer support management): USA

• Google Cloud (infrastructure): USA
• Fullstory (software delivery): USA
• LaunchDarkly (feature flags): USA
• New Relic (platform monitoring): USA
• Retool (software delivery): USA
• Sentry IO (software delivery): USA
• Segment (event and error processing): USA
• Sendgrid (e-mail communication): USA
• Vercel (web application hosting): USA
• Salesforce (customer support management): USA
• Wiz (cloud security and compliance): USA
• Forethought (customer support management): USA

• Amazon Web Services EMEA SARL, German branch (external data centre, hosting; data only in Germany)
• EMAILBRIEF GmbH, Mutterstadt (sending invoices by post)
• Termitel GmbH, Ettlingen (handling customer phone enquiries)
• Twilio Inc. (SendGrid, Inc.), Dublin (sending emails; EU-U.S. Data Privacy Framework and standard contractual clauses)
• AI-specific sub-processors: not publicly documented (list as of 10.04.2024 names none)

• Amazon Web Services EMEA SARL, German branch (external data centre, hosting; data only in Germany)
• EMAILBRIEF GmbH, Mutterstadt (sending invoices by post)
• Termitel GmbH, Ettlingen (handling customer phone enquiries)
• Twilio Inc. (SendGrid, Inc.), Dublin (sending emails; EU-U.S. Data Privacy Framework and standard contractual clauses)
• AI-specific sub-processors: not publicly documented (list as of 10.04.2024 names none)

• Amazon Web Services EMEA SARL, German branch (external data centre, hosting; data only in Germany)
• EMAILBRIEF GmbH, Mutterstadt (sending invoices by post)
• Termitel GmbH, Ettlingen (handling customer phone enquiries)
• Twilio Inc. (SendGrid, Inc.), Dublin (sending emails; EU-U.S. Data Privacy Framework and standard contractual clauses)
• AI-specific sub-processors: not publicly documented (list as of 10.04.2024 names none)

• Amazon Web Services EMEA SARL, German branch (external data centre, hosting; data only in Germany)
• EMAILBRIEF GmbH, Mutterstadt (sending invoices by post)
• Termitel GmbH, Ettlingen (handling customer phone enquiries)
• Twilio Inc. (SendGrid, Inc.), Dublin (sending emails; EU-U.S. Data Privacy Framework and standard contractual clauses)
• AI-specific sub-processors: not publicly documented (list as of 10.04.2024 names none)

Free (pricing page: calls with a trial key are free, rate-limited)

North and Compass: custom (pricing page). Model Vault (Standard Vault) per instance, in USD, per hour / per month / per year (documentation 'Standard Vault Pricing'): Embed 5 Fast and Embed 5 Pro Small USD 3 / USD 2,000 / USD 20,000, Medium USD 5 / USD 3,250 / USD 32,500; Rerank 4 Fast, Rerank 4 Pro and Rerank 3.5 Medium USD 5 / USD 3,250 / USD 32,500; Rerank 4 Pro Large USD 10 / USD 6,500 / USD 65,000; Parse 5 Medium USD 4 / USD 2,500 / USD 25,000, Large USD 8 / USD 5,000 / USD 50,000, XL USD 7 / USD 4,300 / USD 43,000; Cohere Transcribe Medium USD 3.75 / USD 2,500 / USD 25,000, Large USD 7.50 / USD 4,750 / USD 47,500. Generative models on Standard Vault (mostly via waitlist) per instance and hour, L / XL: Command A USD 40 / USD 48, Command A Reasoning USD 48 / USD 57.50, Command A+ USD 17.50 / USD 32.50, North Mini Code USD 7.50 / USD 10.50. Encrypted Vault priced separately. According to the Terms of Use, prices, except where otherwise indicated, do not include applicable sales taxes ('do not include any applicable sales taxes').

In USD (pricing page): Command R input USD 0.15, output USD 0.60 per 1M tokens; Command R7B USD 0.0375 / USD 0.15; Embed 5 Pro USD 0.12, Embed 5 Fast USD 0.08 per 1M tokens; Rerank 4 Pro USD 2.50, Rerank 4 Fast USD 2.00 per 1,000 searches (1 search = 1 request with up to 100 documents); Parse 5 USD 1.50 per 1,000 pages. Legacy models for existing customers include Command R+ 08-2024 USD 2.50 / USD 10.00; Aya Expanse USD 0.50 / USD 1.50. Billing monthly or when USD 250 is outstanding. Command A+ and North Mini Code free as open-source models (Apache 2.0). According to the Terms of Use, prices, except where otherwise indicated, do not include applicable sales taxes ('do not include any applicable sales taxes').

EUR 0 ("permanently free", no credit card); according to the help centre applied automatically after the 14-day trial, unlimited in time; no add-ons bookable, limited support.

List price EUR 11.90 per month billed monthly, EUR 9.90 per month for 12 months (billed annually), EUR 8.90 per month for 24 months, each plus VAT; 1 user, additional users via add-on at EUR 5.90 per month. On the retrieval date the pricing page also showed promotional prices ("up to 50% discount"); according to terms section 1.5, discounts only apply to first bookings by new customers for the minimum term, renewals at regular prices.

List price EUR 25.90 per month billed monthly, EUR 22.90 per month for 12 months, EUR 19.90 per month for 24 months, each plus VAT; 1 user, more via add-on at EUR 5.90 per month. On the retrieval date the pricing page also showed promotional prices ("up to 50% discount"); according to terms section 1.5, discounts only apply to first bookings by new customers for the minimum term, renewals at regular prices.

List price EUR 34.90 per month billed monthly, EUR 30.90 per month for 12 months, EUR 27.90 per month for 24 months, each plus VAT; 1 user, more via add-on at EUR 5.90 per month. On the retrieval date the pricing page also showed promotional prices ("up to 50% discount"); according to terms section 1.5, discounts only apply to first bookings by new customers for the minimum term, renewals at regular prices.

yes (trial API key with rate limit, not for production or commercial use)

yes (workplace platform North, search system Compass, dedicated model instances 'Model Vault' incl. Transcribe, deployment in a VPC or on-premises as well as via the cloud platforms of OCI, Azure, AWS, Google Cloud)

yes (Command R, Command R7B, Embed 5 Pro/Fast, Rerank 4 Pro/Fast, Parse 5; older models for existing customers; Aya Expanse via the API)

no (pricing page: the free plan covers 3 (e-)invoices per month, contacts, products and support material; AI-supported receipt capture and the AI agent Sevi are only listed for paid plans)

yes (AI agent Sevi in support, according to the pricing page in all three paid plans; AI-supported receipt capture and online banking reconciliation only from the Buchhaltung plan)

yes (AI-supported receipt capture reading date, amount, receipt number and supplier and suggesting the booking category; AI-supported matching of bank payments to invoices and receipts; AI agent Sevi; suggestions must be reviewed and confirmed by the user)

yes (all AI features from Buchhaltung; additionally cost centres, management accounts (BWA) and REST API)