Latest in AI
Cohere Model Vault Adds Open Models: Pricing, Regions and Encryption Limits
DeepSeek, Gemma and GPT-OSS join Cohere's managed inference platform, but model choice and confidential computing do not yet overlap everywhere.
Cohere added third-party open models to Model Vault on November 3, letting enterprises run models including DeepSeek, Gemma and GPT-OSS on dedicated managed infrastructure. The practical change is more model choice without operating your own inference cluster. But the encrypted option supports a smaller catalogue.
For a team evaluating private AI deployment, that difference matters more than the number of model names on the launch page.
Which open models does Model Vault support?
Cohere's announcement lists DeepSeek V4.1 Flash, GLM 5.3 Flash, MiMo V2.6 Pro, Gemma 4 and NVIDIA Nemotron, alongside GPT-OSS and Phi. Its compatibility table also includes Tencent's Hy3 family.
All those families appear in standard Model Vault. Among third-party families, Gemma, GPT-OSS and Phi also appear in Model Vault Encrypted. DeepSeek, GLM, MiMo, Nemotron and Hy3 do not currently have that encrypted option in the announcement's table.
A model being available in Model Vault does not mean it is available in Model Vault Encrypted. That needs to be checked before designing a workflow around it.
Model Vault pricing is per GPU, not per token
The public pricing page charges according to GPU type and replica count. These are selected promotional rates in US dollars per GPU-hour, valid through March 31, 2027:
| GPU | Standard Vault | Encrypted Vault |
|---|---|---|
| H100 80GB | $4.25 | $4.25 |
| B200 192GB | $8.00 | $8.00 |
Standard options also include L4 at $1, A100 at $2.25 and H200 at $5.50 per GPU-hour. Reserved capacity and monthly or annual commitments are available through sales. Listed pricing does not guarantee GPU availability.
The useful cost question is therefore how much capacity the workload occupies. A low hourly price can still produce an expensive experiment if several GPUs sit idle. A busy service can spread the same capacity cost across many requests. Without a particular model configuration, throughput measurement and workload, there is no honest conversion into a universal price per million tokens.
Where Model Vault is available
Standard Vault is available in the United States, European Union and Canada. Encrypted Vault is available in the US; EU and Canadian encrypted serving are still coming soon.
The regional documentation adds another constraint. EU deployments support models that run on B200 or L4 GPUs. Canada supports GB200 or L4, with GB200 arranged through sales. The US supports every listed model and GPU option.
A vault's region cannot be changed after creation. So a team with a specific residency requirement should choose the region first, then check the model and hardware combinations available there.
What confidential computing protects
Standard Vault provides an isolated, single-tenant environment. Encrypted Vault adds a hardware-backed trusted execution environment, or TEE, across the CPU and GPU. The aim is to protect prompts and responses while inference runs, including from infrastructure operators.
Cohere's security documentation describes a client-side encrypted connection that terminates inside that protected environment. Remote attestation checks the environment against expected measurements before the client sends data.
This is a useful distinction from simply encrypting a disk or a network connection. In those arrangements, data can still be readable in memory while software processes it.
There are limits. Cohere explicitly lists remaining risks from side channels, deep physical attacks, traffic-pattern observation and service availability. Hardware, firmware, attestation components and the customer's own client environment remain part of the trust boundary. Confidential computing does not remove the need to secure the application calling the model.
Check the deployment catalogue before committing
The launch announcement is ahead of part of the documentation. At publication, the encrypted supported-models page still describes a beta catalogue of Cohere families rather than the third-party models announced on November 3. It directs customers to the deployment dropdown or Cohere for exact availability.
That discrepancy should be resolved for the specific model, region and account before an enterprise promises support internally. The announcement establishes the expansion; it does not establish that every model variant is selectable in every deployment.
For an enterprise team, the valuable change is the ability to compare more models inside a managed deployment arrangement. The next test is whether switching between them actually reduces evaluation and operational work. If each model still requires a different region, security exception or capacity plan, much of that work remains with the customer.
I’m Paras. I work at the intersection of AI, engineering and distribution.
I help teams turn complex enterprise AI products into clear technical stories that developers and decision-makers can understand.