Amazon Bedrock vs Mistral AI API

Amazon Bedrock 80

AWS Health Dashboard with per-service, per-Region feeds and a public history file (20). The history lists Amazon Bedrock as disrupted in ME-CENTRAL-1 (UAE) and ME-SOUTH-1 (Bahrain) since March 2026, where AWS said on 15 September 2026 (still inside the 90-day window on 6 November) that it can't restore resources held only there. No other Bedrock event appears in the history in the 90 days to 6 November; an EU-SOUTH-2 packet-loss event on 4 October named Bedrock AgentCore, not Bedrock. This counts as one major event (10). StatusGator's third-party mirror shows 'Increased Error Rates' warnings on 24, 26 and 27 August and 10 September that we couldn't find in AWS's own history, so we didn't score them. Per-model token quotas with default values in the AWS General Reference, such as 30,000,000 tokens a minute for Opus 5.5 global inference (15). The error guide gives exponential backoff with jitter for 429, 503 and 529 and says to honour Retry-After, and the SDKs retry ModelNotReadyException up to five times (15). SLA of 99.9 per cent a month per Region for the model APIs, last updated 4 October 2023 (10). Converse and the current Claude, GPT-6 and Nova 2 Lite models are GA (10).

Mistral AI API 50

Status page at status.mistral.ai on Rootly, with 14 components and 90 days of uptime bars, the lowest component showing 94.36% on 1 October (20). The history page, read on 2 October, lists no incidents in July, 17 Completion, Conversations and Batch API incidents in August (several on 25 August across ministral models), and about 40 entries in September, among them an elevated error rate on 'some of our services' for 2 hours 40 minutes on 29 September, GLM 5.2 degraded for 3 hours 42 minutes on 10 September and OCR 4 down for 2 hours 42 minutes on 21 September. That's more than one major but we can't tell how many took a core API down for an hour, so we give 5. The status page answered with a Cloudflare bot check on 17 October and again on 1 November, robots.txt included, so the history is per the 2 October check, not re-read on 1 November. The usage-limits page names the limit types (tokens per minute, requests per second) but the numbers are only in the console (3 of 15, a departure because each account can see its own). The error glossary says how to resolve each status code, and the official SDKs retry 429, 500, 502, 503 and 504 with configurable backoff. No Retry-After header confirmed (12 of 15). A Priority Tier for queueing exists, no SLA found (0). Chat completions on GA models is GA (10). 20+5+3+12+0+10 = 50.

Amazon Bedrock 98

Model reading. IAM with SigV4, roles and STS session credentials, policies down to a model or inference-profile ARN, short-term API keys that expire within 12 hours, long-term keys with expiry and reset, and condition keys that can deny bearer tokens altogether (30). The security page says customer data isn't shared with model providers or used to improve the base models (20). The abuse detection page says Bedrock stores no inputs or outputs by default, and a per-Region none mode blocks models that require retention, but Claude Fable 5 and 5.1 keep all traffic up to 30 days and GPT-6 and GPT-5.x keep flagged traffic up to 30 days (13 of 15, a judgement call; Anthropic's own API got 12 for the same Fable exception without an account-level block). CloudTrail logs API calls, and model invocation logging can send prompts and responses to S3 or CloudWatch Logs (15). Bedrock is in ISO, SOC and CSA STAR Level 2 scope, HIPAA eligible and FedRAMP High in GovCloud (US-West) per its security page, with a vulnerability disclosure programme on HackerOne, and the aws.amazon.com security.txt, expired on 6 October, was renewed with Expires 2027-10-16 when read on 6 November (20). Up from 96 on 6 October for that reason.

Mistral AI API 73

Model reading. Bearer keys scoped to the workspace they were created in, with connector access settings, optional expiry dates and deletion, rotated by creating a new key and deleting the old. Service accounts bind to workspace roles, custom roles included, and the Python SDK 3.0.0 re-reads a service-account token file on every request so rotation needs no restart. Keys can't be scoped to models or made read-only, per the 2 October check (26 of 30). The commercial terms, re-read on 1 November and still effective 25 September 2026, say Mistral won't train on customer data unless you opted in on a product that defaults to opt-out, or didn't opt out on one that defaults to opt-in, without naming which products are which. Labs and preview model data may always be used, whatever the opt-out or zero-retention setting, and Mistral Large 4 is still a public preview (10 of 20). 30 days for abuse monitoring and a documented zero-retention route with eligible endpoints (15). Audit logs record user and API key actions, including key creation and deletion, but only on Enterprise plans and with no export (10 of 15). security.txt re-read on 1 November, with a security@mistral.ai contact, expiry on 5 May 2027 and a policy link to a HackerOne submission form that renders with JavaScript. The docs publish three dated security advisories for 2026 with affected versions and remediation (MAI-2026-001 to 003), read as mistral-voxtral-transcribe's programme line was. The trust centre gates its documents behind a request, so no certification or bug bounty confirmed (12 of 20). 26+10+15+10+12 = 73.

Amazon Bedrock 30

No x402, MPP or L402 (0). Per-token prices per model, tier and Region on the public pricing page, filled from AWS's public price feed (20). New accounts get up to $200 in Free Tier credits and the Free Tier page lists Bedrock among eligible services, and the Free Tier FAQ says most new customers don't need a payment method, but AWS may still ask for one, so half, as for S3 (10). A person signs up for AWS in a browser and sets up IAM before any key exists (0).

Mistral AI API 40

No machine payment protocol (0). Per-token prices published without a login, re-read on 1 November. Mistral Large 4 is now listed at $0.70/$2.10 with cached input at $0.07 (the 17 October check read $1.36/$4.18 with a launch sale), and cached input is 10% across the range (20). Timestral has no API price because it isn't served on the API. Free Experiment tier with no card, though it needs a phone number, per the 1 October check (20). Browser sign-up (0). 0+20+20+0 = 40.

Amazon Bedrock 85

Closed service under the AWS Customer Agreement and Service Terms, with the SDKs and Smithy models under Apache-2.0 (18, as for S3). The data retention, abuse detection and security pages agree that Bedrock stores nothing by default, name the models that retain traffic and for how long, and say retained data isn't shared with providers. The retention page's default mode says AWS 'may retain the data for safety and abuse-prevention purposes' without a period, and a legacy provider_data_share mode is kept though sharing isn't supported (25 of 30). A written lifecycle policy with Legacy and EOL dates per model, but the legacy table's 34-day Legacy periods for five Claude models in some Regions contradict its own 6-month floor (15 of 20, down from 18). AWS's sub-processor list, per the 4 October S3 check, and per-Region, geographic and global inference options, with global routing able to process data in any commercial Region (18 of 20).

Mistral AI API 80

Closed service with clear terms, SDKs Apache-2.0, and several models published as open weights. Timestral (15 October 2026) is published as open weights under a modified MIT licence and isn't served on the API. Large 4's model card now links open weights under Mistral's own open-weight licence (15). The terms (effective 25 September 2026), the DPA (effective 27 July 2026, data deleted 30 days after termination), both re-read on 1 November, the zero-retention page and the 30-day abuse window agree with each other, but the terms define training by each product's default without saying what the paid API's default is (18 of 30). Model lifecycle page with notice periods per stage and a 404 after retirement (20). The DPA points to a subprocessor list at trust.mistral.ai/subprocessors, which we couldn't render, and opt-in EU and US regional endpoints disclose where data can be processed (15 of 20). 15+18+20+15 = 68.