Registry / compare
Claude via AWS Bedrock vs Claude via Google Vertex AI
The same dimension can grade differently depending on who serves the model. Every cell links to its source; grades are evidence grades, not endorsements.
| Dimension | Claude via AWS Bedrock | Claude via Google Vertex AI |
|---|---|---|
| SOC 2 Type II | ●Yes, public Two-level rule: this grades AWS (the serving platform), not Anthropic. Amazon Bedrock is listed with a checkmark on AWS's SOC services-in-scope page. The SOC 2 Type II report... | ●Yes, public Google's services-in-scope page lists both "Vertex AI Platform" and "Generative AI on Vertex AI" as covered by Google Cloud's SOC 1/2/3 reports. SOC 2 Type II reports are... |
| ISO 27001 | ●Yes, public AWS holds ISO/IEC 27001:2022 certification with Amazon Bedrock named on the public ISO-certified services list (also 27017/27018/27701 programs). Certificates downloadable via... | ●Yes, public "Vertex AI Platform" and "Generative AI on Vertex AI" are listed in scope for Google Cloud's ISO/IEC 27001 (plus 27017/27018) certification. Certificates are available via... |
| ISO 42001 | ●Yes, public AWS holds an accredited ISO/IEC 42001:2023 AI-management-system certification; AWS announced (Nov 2024) that the initial scope covered Amazon Bedrock, Amazon Q Business, Amazon... | ●Yes, public Google has publicized ISO/IEC 42001:2023 certification of its AI management system covering Google Cloud Platform (announced via Google Cloud blog "Google Cloud's commitment to... |
| Trust center | ●Yes, public AWS Artifact is the compliance portal: on-demand, self-serve access to auditor-issued reports/certifications and to agreements (e.g. the BAA) from the AWS console. Public... | ●Yes, public Google Cloud maintains a public compliance resource center with per-standard pages, a services-in-scope matrix, and the Compliance Reports Manager for self-serve download of... |
| HIPAA BAA | ●Yes, public Amazon Bedrock is on AWS's public HIPAA Eligible Services list. PHI use requires first entering the AWS Business Associate Addendum (accepted self-serve via AWS Artifact... | ◔Partial Google Cloud offers a self-serve BAA covering its entire infrastructure, and Vertex AI Platform functionality (e.g. Vertex AI Workbench, Agent Engine) appears among... |
| GDPR DPA | ●Yes, public The AWS GDPR Data Processing Addendum is incorporated automatically into the AWS Service Terms for all customers, includes the 2021 EU Standard Contractual Clauses, and AWS... | ●Yes, public Google's Cloud Data Processing Addendum is public, incorporated into the Google Cloud agreement, addresses GDPR/European Data Protection Law (transfer mechanisms including SCCs... |
| No-training default | ●Yes, public Bedrock FAQ: "your content is not used to improve the base models and is not shared with any model providers"; AWS and third-party model providers "will not use any inputs to... | ●Yes, public Google Cloud Service Terms Section 17 (Training Restriction) commits that Google will not use customer data to train or fine-tune AI/ML models without customer permission or... |
| Retention / ZDR | ◔Partial Retention is thoroughly documented, hence not a clean "yes". Bedrock's baseline is zero data retention and zero operator access, inputs/outputs are not stored by default, and... | ●Yes, public Retention is documented - by default Vertex AI caches generative AI inputs/outputs for up to 24 hours in the serving data center to reduce latency; customers can disable... |
| Residency | ●Yes, public Bedrock FAQ: "Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock." Claude is offered in EU... | ●Yes, public Vertex AI documents data-at-rest residency by region and a separate ML-processing residency commitment supported only in US and EU locations. Claude models are reachable via... |
| GPAI Code | ●Yes, public Two-level rule: the GPAI Code of Practice is a provider (model developer) obligation, so this cell grades Anthropic, not AWS. Anthropic is on the EC's signatory list for the... | ●Yes, public Two-level layering - the GPAI Code of Practice is a model-provider obligation, so this cell grades Anthropic (the developer), which appears on the EC signatory list as a... |
| Art. 53 summary | ○No public evidence Grades Anthropic (model developer). No public training-content summary using the EU Commission's Article 53(1)(d) template was found on anthropic.com (Transparency Hub, news,... | ○No public evidence Developer-level (Anthropic) obligation under Art 53(1)(d). The EC's mandatory template for the public summary of training content was published 2025-07-24. As of 2026-07-05,... |