Mistral Studio adds agents: what self-hosted covers for NZ firms

Mistral expanded Studio on 5 November with managed agents and apps. Its announcement tells customers they can run both the models and the platform in their own cloud, VPC or on-premises environment. For a New Zealand business that wants AI agents working near sensitive records, the offer looks close to ideal. Mistral's release notes and developer docs describe a more complicated product, because "self-hosted" covers several arrangements with very different data paths.

What Mistral shipped

Managed agents run multi-step tasks using skills, code sandboxes, subagents and custom hooks. Studio workflows combine rule-based steps with agent reasoning and human approvals, and apps get hosting, authentication and access controls. Mistral names BNP Paribas, CMA CGM and ABANCA among its production users.

The product is less mature than the launch post suggests. Mistral's release notes mark nearly every 5 November entry as Mistral-hosted and in public or private preview. Studio apps in Vibe Code Web are the only entry at general availability. The agents documentation warns that APIs, behaviour and limits can change during the preview, and that an update may need code changes.

Mistral's post gives no date for private deployments of the new features. AlphaSignal reported that private cloud and on-premises deployments will arrive at the end of November, but Mistral's post and release notes don't mention that date. The same report calls Workflows generally available, while Mistral's docs still say public preview, so we'd treat the November date as unconfirmed. Prices for private deployments are unpublished too. Mistral's pricing page lists self-hosted, private cloud and on-premises options, and its Enterprise tier sends buyers to a contact button.

Where the data travels

The self-hosted mode in the Agents SDK puts the agent harness and your tools on your servers. The model still runs on Mistral's API and Mistral stores the session, so prompts leave your network and a session record sits with Mistral.

Workflows split the work in a similar way. Mistral hosts the orchestrator and your code runs on your infrastructure, with workers connecting outbound. Mistral's April Workflows post puts the Temporal cluster, Workflows API and Studio on Mistral's side of the control plane. Inputs and outputs pass through the platform, and payload encryption is off by default. A customer has to switch encryption on and store the key, after which the platform holds only ciphertext. Payloads over 2MB go to the customer's own blob storage.

Telemetry is the path most likely to slip past a review. Workflow workers send logs, traces and metrics to Mistral's hosted platform by default, although administrators can redirect or disable that export. Studio traces record the input and output of each span and are kept for 30 days. Managed agents mask common secrets and personal data on the worker before spans leave. That masking helps, but a filter can still miss a customer's circumstances written in free text.

Geography adds to the problem. Mistral's Regional Endpoints let customers choose inference in Europe or the US, and the announcement lists no Asia-Pacific region. It also says limited transfers to sub-processors may occur outside the selected region. A New Zealand customer using Mistral-hosted services should assume its data is processed overseas.

A fully private route exists on paper. The Workflows docs say enterprise customers can run the orchestrator and interface in a private cloud or on-premises, and Mistral's product page says of its self-hosted option: "Nothing leaves your perimeter." Installation requirements and cluster sizing for that option aren't public. The deployment docs also say apps run on Mistral Cloud, which is hard to square with the promise to deploy the whole platform anywhere. Buyers need local models as well, and our review of Mistral Large 4 found that even the compressed version runs on four Nvidia GB300 GPUs.

What it means for NZ businesses

Offshore processing isn't automatically a privacy breach. The Privacy Commissioner's guidance says you usually don't need a model-clauses agreement with a cloud provider holding information on your behalf, and you usually remain responsible for that information. If the provider uses the information for its own purposes, both parties hold it. The Commissioner's office also says the Privacy Act applies to everyone using AI tools and recommends a privacy impact assessment before starting.

We think agents demand a harder assessment than chat tools do. An agent reads tickets, customer records and supplier documents as it works, and that content can end up in session stores and traces. A review that only asks which model you're using would miss both. Client contracts can also set stricter location rules than the Privacy Act, so a legally acceptable setup may still breach an agreement with a customer.

Our recommendation depends on sensitivity. For low-risk internal automation, a hybrid workflow with encryption on and telemetry under your control is reasonable to trial, provided you accept that model calls go offshore. Health records, legal files and client-confidential material need a model on infrastructure you control. That means either Mistral's private deployment at enterprise scale or a smaller local AI server handling a narrower workload. Few mid-sized NZ firms will justify Large 4 hardware purely to get Studio's agent tooling, and the cost of a private Studio licence is unknown until Mistral quotes it.

Next steps

• Draw the data path for one proposed agent, showing the country and operator for inference, orchestration, session storage, tool execution, traces and evaluation datasets.
• Ask Mistral in writing which components run inside a private deployment, which features remain in preview there, when they'll ship and what they'll cost.
• Get the sub-processor list and check it against any location commitments in your client contracts.
• Before real data enters a hybrid workflow trial, enable full payload encryption, keep the encryption key in your own secret manager and send telemetry to your own endpoint.
• Test masking with synthetic records in your own formats. We wouldn't assume "common" personal data patterns include IRD numbers or NHI numbers.
• Update your privacy impact assessment so it covers sessions, traces and the 30-day retention period.
• Keep preview features away from processes that can't tolerate a breaking change, and budget time for code updates.