Cohere opens Model Vault to third-party models, with regional limits
Cohere added third-party open models to Model Vault on November 3, 2026, expanding its managed inference service beyond its own models. The release gives enterprise teams more choices, but the model catalog and available regions differ between Standard Vault and Model Vault Encrypted. Cohere says the new options are available through the Model Vault app. (Release notes)
The practical choice starts with three questions: which model you need, where its inference must run, and whether the infrastructure operator must be excluded from seeing the request. Selecting a model family alone does not settle those requirements.
Which open models does Model Vault support?
The Standard Vault catalog lists DeepSeek, Z.ai’s GLM, Xiaomi’s MiMo, NVIDIA Nemotron, Google Gemma, OpenAI GPT-OSS, Microsoft Phi, Alibaba Qwen, and Mistral AI’s Ministral, Devstral and Leanstral families.
That is a family-level list, not a promise that every model version is available everywhere. Cohere directs users to the deployment catalog for the exact model and GPU combinations in their selected region. The model identifier shown on the vault’s details page is the one to use in API requests. Each open model also retains its developer’s license, which customers need to review before deployment.
Model Vault Encrypted has a smaller open-model list: Gemma, GPT-OSS, Phi, Qwen, Ministral and Devstral. Its supported-model documentation currently describes deployments on a single NVIDIA H100 80GB GPU operating in confidential-computing mode. DeepSeek, GLM, MiMo, Nemotron and Leanstral are not listed in that encrypted catalog.
This expansion concerns where existing model families can run. It does not establish a new model release or a performance improvement for those models.
Standard and Encrypted have different regional coverage
Cohere’s regional documentation shows the following availability:
| Region | Standard Vault | Model Vault Encrypted |
|---|---|---|
| United States | Available | Available |
| European Union | Available | Coming soon |
| Canada | Available | Coming soon |
The United States appears as Global in the app. EU and Canadian support for the encrypted product has no launch date in the documentation reviewed for this article.
GPU availability narrows the regional catalog further. The US supports the full listed range. EU deployments are limited to models running on NVIDIA B200 or L4 hardware, while Canada supports GB200 or L4 options. GB200 access goes through Cohere sales.
A vault’s region cannot be changed after creation. A team requiring both EU processing and confidential computing should therefore resolve the availability gap before planning a deployment. An EU Standard Vault should not be mistaken for an EU Encrypted Vault.
What the encrypted option protects
Cohere describes both products as dedicated, isolated infrastructure. The encrypted version adds a hardware-backed trusted execution environment, or TEE, around the inference workload. Its stated purpose is to prevent Cohere, the cloud provider and infrastructure administrators from reading plaintext prompts and responses. These are Cohere’s documented protections, not findings from an independent ByteForward security test. (Security model)
Zero Data Retention is enabled by default. Cohere says it processes prompts and responses without retaining them. For Encrypted Vaults, plaintext exists inside the protected environment during the request and is not persisted afterward. This is more precise than suggesting that a model performs every calculation directly on encrypted text. (Encryption and key management)
Confidential computing still has limits. Cohere identifies residual risks involving hardware side channels, deep physical access, observable traffic patterns and service availability. The customer’s own client remains part of the trusted system. Encryption also does not establish that a model’s answers are correct or that an application has appropriate permissions.
OpenAI-compatible calls need the right route
For third-party models in a Standard Vault, Cohere documents the OpenAI-compatible Chat Completions interface at the vault endpoint’s /v1 path. Requests use a Cohere API key and the deployed model’s identifier. The open models do not accept Cohere’s /v2 endpoints or the separate /compatibility/v1 route used for Cohere-model compatibility. (Standard API guide)
Encrypted deployments add a necessary client-side step. Cohere’s OHTTP proxy, or its Python wrapper, verifies the deployment’s attestation and encrypts requests before sending them. The standalone proxy runs in the customer’s environment. An OpenAI-compatible client can point to its local /v1 address. Verification failures should stop the request. (Encrypted API guide)
Cohere also documents a hosted proxy for demonstrations, but says it changes the trust model by requiring trust in Cohere’s proxy layer. It should not be treated as equivalent to the documented client-side production setup.
Pricing is per GPU hour, with temporary discounts
The current pricing page charges by GPU and replica count. Its promotional USD rates run through March 31, 2027. Selected rates per GPU hour are:
| Configuration | Regular on-demand rate | Promotional rate |
|---|---|---|
| NVIDIA L4 24GB | $3.00 | $1.00 |
| NVIDIA H100 80GB | $6.25 | $4.25 |
| NVIDIA H100 80GB with confidential computing | $9.00 | $4.25 |
| NVIDIA B200 192GB | $9.75 | $8.00 |
The total depends on GPUs per replica, replica count and runtime. A quoted GPU-hour price is not a complete model deployment estimate. Cohere offers reserved capacity and monthly or annual commitments through sales.
There is an availability detail to confirm: pricing also lists confidential-computing B200 hardware, while the encrypted supported-model page currently specifies H100. Cohere explicitly says published pricing does not establish GPU availability. Confirm the actual configuration before budgeting around it.
Check the deployment, not just the model name
For an enterprise evaluation, record the exact model, its license, region, GPU configuration, replica count and production connection method. Then test latency, output quality and the application’s handling of failures on that configuration. This article does not report a hands-on benchmark or a verified cost saving.
The distinction between an announcement and deployable controls also matters in ByteForward’s coverage of OpenAI’s Google Cloud private preview, where access conditions and planned protections are separate questions.
Cohere’s expansion makes model choice broader within a managed service. The useful next step is matching that choice to a configuration the customer can actually deploy, rather than assuming every model, region and protection can be combined today.
