Codestral

Vendor: codestral-2508, as of 29 September 2026

The code tier from the European vendor Mistral AI for programming and automation work. For work on client, patient or personnel files it is not a tool; it is in the catalogue because firms build their own reports, macros and interfaces, and real data can end up in examples and error messages while doing so. That is exactly what is clarified here: via Google Vertex AI the contractual chain is closed, because the confidentiality agreement under section 203 of the German Criminal Code signed there is service-bound and expressly applies to third-party models on this platform as well. A US group remains in the chain as platform operator; production data does not belong in development inputs in any case.

Through us once the provider clears it

The confidentiality agreement under section 203 of the German Criminal Code is signed. We set the route up without storage at the provider (zero retention) once the provider has committed to it - at Microsoft through the exception from abuse monitoring, which usually takes months. Until then, storage and review by the provider are not ruled out.

What it is good for

Code and automation work inside the same platform and contractual chain - no further service provider for development data
Processing committed to the EU and to the Netherlands, European model vendor
Covered by the platform operator's service-bound section 203 agreement

Where it stops

None of the seven task classes in this catalogue - the entry documents the coverage position for development work, it is not a recommendation for client matters
The platform operator is a US group - CLOUD Act exposure remains despite the European model vendor
Production data does not belong in development prompts - use synthetic material for examples
The reach of the logging exception for third-party models cannot be evidenced from publicly available documents (as of 2026-08-17)
The platform's global endpoint gives no residency guarantee - the same models can be called there as well. Binding to the EU is therefore a configuration requirement: the global endpoint is blocked by organisational policy, otherwise the EU commitment is a settings question rather than a property.

Status through us

The same model, procured differently, is a different legal position. The status above refers to procurement through us; processing takes place in a third country.

Which route carries it, with which instrument and under which condition, we set out in full to the firm before it commissions us - section 203(4) requires that the chain can be checked, not that it is published. The full matrix, with the sources behind every route, can be requested in the German catalogue after confirming your e-mail address, and we go through it in the conversation.

Is Codestral the right fit?

We go through your tasks and the route that carries them - and say plainly where it does not.

Arrange a conversation