Cohere, Explained: What Canada's AI Company Actually Does With Your Data

The question that stalled our review wasn't whether Cohere's models were good. They're fine. By most accounts better than fine for retrieval-heavy enterprise work. What stalled us was who signs the data processing addendum, and under which entity's paper.

For a company that markets itself as a flagship of Canadian AI, a surprising amount of the actual contracting runs through structures that took our legal team three separate calls to untangle.

I lead compliance review for AI tooling at a mid-size organization that handles a lot of regulated client data. Evaluating Canadian AI platforms has become a recurring part of my job over the past year. Cohere comes up in almost every one of these conversations — it's the most visible name in Canadian AI, and procurement likes being able to say they picked a Canadian tool instead of defaulting to a US hyperscaler. Here's what we found when we looked past the pitch deck.

What Cohere Actually Is

Cohere Inc. is a Toronto-based AI company, founded in 2019 by Aidan Gomez, Ivan Zhang, and Nick Frosst. Gomez came out of the Google Brain team that wrote the original transformer paper. The company builds large language models — the Command family is the one enterprise buyers see most — and sells access through an API, cloud marketplace listings, and direct enterprise contracts. It has raised a lot of capital across multiple rounds, including from non-Canadian funds, which matters a little for the sovereignty question and not much for anything else.

It is, by any normal definition, a Canadian company. Headquarters in Toronto. Founders Canadian. Incorporated in Canada. That part isn't in dispute.

Where the Data Actually Goes

This is where it got less clean. Cohere's enterprise offering can be deployed through major cloud providers, including AWS and Azure regions, and a client's actual deployment can end up routed through infrastructure that is not Canadian at all, depending on which region and contract tier gets negotiated. Our security reviewer's read was that "Canadian company" and "Canadian data residency" are two separate claims, and Cohere's public materials sometimes let readers conflate them.

We asked Cohere's sales team directly, in writing, where inference would run for our specific use case and what jurisdiction would govern a subpoena request against our data. The answer came back as: it depends on deployment configuration. A fully Canada-resident deployment was possible, but it required a specific enterprise contract tier, not the standard API terms. That's a fair answer. It's also not the answer a one-line marketing claim implies.

PIPEDA doesn't flatly prohibit cross-border data flows. It requires that organizations stay accountable for personal information even when a third party processes it abroad, and that reasonable safeguards travel with the data. Québec's Law 25 is stricter: section 17 requires an assessment of factors like the data's sensitivity and the legal framework in the destination jurisdiction before certain transfers outside the province. Neither law says don't use Cohere. Both mean you have to be able to say, specifically, where the processing happens — and for a flexible multi-cloud deployment model, that answer can shift depending on which contract a client signs.

That's the clause our counsel kept circling back to.

Not because Cohere was doing anything wrong, but because "it depends on your contract" is a hard thing to write into a standing privacy impact assessment that's supposed to hold for the next three years.

One objection we had to answer internally before this went any further: does any of this actually matter if the data in question is low-sensitivity? For a chunk of our use cases — internal drafting, summarizing public filings — the honest answer was no, and we said so in the review memo rather than pretend every workload needed the same scrutiny. The deployment-tier question only earned the hours we gave it because a meaningful slice of what we wanted to run through the tool was client-identifying.

The CLOUD Act Question, and What Turned Out Not to Matter

Because Cohere's enterprise deployments can run on AWS or Azure infrastructure, we had to ask the obvious follow-up: does hosting through a US hyperscaler's Canadian region expose the data to the US CLOUD Act, even if the physical servers sit in Canada? Our counsel's view — and I'll say plainly this is a legal reading, not something I can independently verify — was that a US-incorporated cloud provider operating a Canadian data center can still, in some circumstances, be compelled to produce data under US jurisdiction regardless of where the servers physically sit. That's the CLOUD Act point our counsel would not move on. It's the reason "the servers are in Canada" didn't close the question for us the way I expected going in.

What turned out not to matter, in the end, was Cohere's benchmarks.

We spent an afternoon comparing Command R+ against a couple of alternatives on retrieval accuracy and summarization quality, and the differences were marginal enough that nobody on the review brought them up again. The decision was never going to be won or lost on model quality. It was going to be won or lost on contract language, and roughly nobody tells you that going in — I certainly didn't expect it when I scheduled the first call.

The other thing that turned out not to matter, which surprised me more, was uptime SLAs. Every vendor pitch leads with their percentage, and we dutifully compared them for about twenty minutes before realizing none of us could name a scenario where a half-point of SLA difference would change what we signed. What we actually argued about afterward was sub-processor disclosure — who else touches the data before it gets back to us, and whether that list gets updated without notice.

What We Asked Every Vendor

We ran the same six questions past every vendor on our shortlist, Cohere included:

• Where does inference physically run, by default and under our specific contract tier?
• Is customer data used to train models, and can that be excluded contractually?
• What is the company's corporate structure, and does any parent or investor sit under US jurisdiction?
• What happens to our data on contract termination?
• Which sub-processors are involved, and where are they located?
• Can you name the specific regulatory frameworks your architecture was built to satisfy, and show us how?

Cohere answered most of these reasonably, though the sub-processor list took two follow-up emails to get in full. The training-data question had a clean answer: enterprise customers can opt out of having their data used for model improvement, which matched the public documentation.

The termination question is the one I'd push harder on if I ran this review again. We asked what happens to our data on contract end and got a reasonable-sounding answer about deletion timelines, but we never asked for that in writing as a contractual deletion obligation with a specific number of days attached, just as a verbal assurance from sales. That's the gap I'd close first next time, before the sub-processor list, because a vague deletion promise is worse than an honest "it depends" on hosting region.

Where Augure Fit In

We put Augure on the same shortlist partly because it answers the jurisdiction question in one sentence instead of a contract-tier flowchart. Canadian company, no US parent, no US investors, inference on Canadian infrastructure with vetted EU partners for certain model tiers, never routed to US providers for customer content. That claim is scoped to AI inference and customer conversations specifically — payment processing and email delivery still touch US systems, and Augure's own privacy policy says so.

It was still easier for our counsel to sign off on than Cohere's deployment-dependent answer, because there was one configuration to assess instead of several. We were not fully sure, going in, whether that simplicity would hold up once we asked harder questions. It mostly did.

Pricing was also just more legible. Augure's team plan runs C$80 a month per seat with unlimited documents and deep research agents, against an enterprise Cohere quote that required a sales call and came back as a custom number we weren't allowed to share further. I don't think that makes Cohere worse. It made our review faster, and speed is its own kind of answer when you're on a deadline for a board memo.

We didn't move our whole organization onto either platform that quarter. Budget cycles got in the way, which happens more than any vendor comparison piece ever admits. But the exercise clarified something I'd go back and tell myself at the start: ask about contract tiers before you ask about model quality, because that's where the real difference sits.

If you're doing this same review, augureai.ca has the privacy policy and sub-processor table posted directly. That saved us at least one of the follow-up emails we had to send Cohere.