Le Chat

The assistant EU teams reach for when data residency decides it, which makes it a sanctioned alternative more often than a shadow AI finding.

What leaks through it

EU hosting settles the residency question and none of the others. A secret pasted into an EU-hosted assistant is still a secret you have to rotate.

• chat.mistral.ai
• api.mistral.ai

Guardrails once it is inspected

Alectura intercepts only tools it has been tested against. Everything else is discovered, meaning you get the app, the devices running it and how often, but the content is never decrypted, so content rules cannot run on it yet.

Today Le Chat is discovered: you get the app, the devices running it and how often, without decrypting anything. The rules below are the ones that apply to it, and they run once it is onboarded for inspection.

• MaskNo secrets in inputALC-001

  Keys are masked in the prompt, so a sanctioned tool does not become the quiet exception to your secrets policy.

• BlockNo cloud credentialsALC-003

  Cloud provider keys stop at the device regardless of where the destination is hosted.

• AlertInternal host / URL leakALC-005

  Internal hostnames and private IPs pasted in as context.

Those are the ones worth spelling out for Le Chat. All 27 rules in the catalog apply, and you can see the full catalog.

What happens to whatever gets through

Model training

Free-tier conversations may be used to improve models unless opted out. Paid and enterprise tiers are excluded.

Retention

Conversations persist in the account until deleted.

Data residency

EU-hosted, with self-deployment available for enterprise.

The vendor’s own controls

• ·SSO on the enterprise tier
• ·EU data residency
• ·Self-hosted deployment

Sources

• Mistral privacy policy

Vendor terms last checked August 14, 2026, and summarised from Mistral AI’s published documentation. Confirm against the sources above before writing policy around this page.