Registry / AWS Bedrock (platform)
AWS Bedrock (platform)
Amazon Bedrock is AWS's managed platform for serving foundation models from multiple providers. This platform-level row covers AWS's own audit scope, contractual terms, and Bedrock-wide data-handling commitments; model-specific behavior (e.g. provider data sharing for certain Anthropic models) is noted where it deviates from the platform default.
Watch-outs 2
The cells where this offering is not a clean public yes. This is what to check before you sign.
- SOC 2 Type II: Yes, sales-gated Report accessible only through AWS Artifact portal after signing NDA
- HIPAA BAA: Yes, sales-gated BAA must be obtained via AWS Artifact portal (login/gated process)
AWS lists Amazon Bedrock in‑scope for SOC 2 and states SOC 2 reports are gated behind Artifact login and an NDA
"An NDA is required to review the AWS SOC 1 and SOC 2 reports. The AWS SOC 2 ... are available to customers by using AWS Artifact, a self-service portal for on-demand access to AWS compliance reports."
Audit confirmed the recorded cell is correct. AWS's own compliance page (aws.amazon.com/compliance/iso-certified/) lists "Amazon Bedrock [excludes amazon Bedrock Marketplace]" as in scope for ISO/IEC 27001:2022, the provider's authoritative domain, and yes_public is the appropriate value for the pla
Amazon Bedrock [excludes amazon Bedrock Marketplace]
The AWS official blog publicly states that ISO/IEC 42001 certification covers Amazon Bedrock, satisfying the yes_public criterion.
AWS is excited to be the first major cloud service provider to announce ISO/IEC 42001 accredited certification for AI services, covering: Amazon Bedrock, Amazon Q Business, Amazon Textract, and Amazon Transcribe.
AWS Artifact page publicly confirms a self‑service compliance portal, confirming a maintained trust/compliance portal for the platform.
Save time with on-demand access to AWS and Independent Software Vendor (ISV) compliance reports in a self‑service portal.
AWS lists Amazon Bedrock as a HIPAA‑eligible service and explicitly requires a Business Associate Agreement, which is only available through the gated AWS Artifact portal.
"If you are a Covered Entity or Business Associate ... you agree not to use these HIPAA Eligible Services ... without first entering into an AWS business associate agreement."
AWS publicly provides its GDPR DPA containing SCCs and a publicly accessible sub‑processor list, satisfying the requirement.
The AWS Data Processing Addendum … includes the Standard Contractual Clauses … and the AWS website (currently posted at https://aws.amazon.com/compliance/sub‑processors/) lists Sub‑processors that are currently engaged by AWS.
AWS Bedrock’s own privacy page publicly commits that customer prompts and outputs are not used to train the models by default, meeting the public commitment criterion.
No, prompts that AWS customers enter into Amazon FMs and outputs produced in response to Amazon FM prompts are not used to train the underlying Amazon FMs, unless a customer consents.
The AWS Bedrock documentation publicly describes a zero‑data‑retention mode, confirming the retention policy is documented and the feature is available.
If your account or project is configured for zero data retention (`data_retention_mode: none`) ...
The official AWS Bedrock documentation publicly describes an In-Region inference option that guarantees data stays within the chosen AWS Region, confirming region pinning including EU regions.
"In-Region:Your requests never leave the AWS Region you specify. Use this when regulations require strict single-Region data processing."
The GPAI Code of Practice is an obligation of the GPAI model provider, not of a distribution platform, so it does not attach to Bedrock as a platform serving third-party models. For the record: Amazon IS on the EC signatory list, having signed the full Code (no chapter limitation noted, unlike xAI's
The Art 53(1)(d) public training-data summary is a GPAI provider obligation; AWS Bedrock as a serving platform is not the provider of the third-party models it hosts, so the obligation does not attach to this platform row. Whether Amazon has published an EU-template training-data summary for its own
Spotted an error? Submit a correction with evidence, corrections with a primary source are folded in and credited in the changelog.