Cohere via AWS Bedrock

Cohere’s own Trust Center confirms a SOC 2 Type II audit exists but the report is only available upon request, making it sales‑gated.

Cohere undergoes an annual SOC 2 Type II audit. Request here to see our report.

source

Cohere’s own trust center publicly lists ISO 27001 certification, which applies to Cohere models regardless of the serving platform (AWS Bedrock).

### ISO 27001 Information Security Management System (ISMS) ### ISO 27001 Certification Official Certificate

source

Cohere’s own Trust Center publicly lists an ISO/IEC 42001 AI Management System certification with an official certificate, confirming the developer holds the certification.

### ISO 42001 Artificial Intelligence Management System (AIMS) ### ISO 42001 Certification Official Certificate

source

Cohere's publicly accessible Trust Center page lists SOC 2, ISO 27001, ISO 42001, GDPR, CCPA, and HIPAA, confirming a maintained compliance portal.

### SOC 2 Type 2 ... ### ISO 27001 ... ### ISO 42001 ... ### GDPR ... ### CCPA ... ### HIPAA (please see FAQ)

source

AWS lists Amazon Bedrock (excluding Fable and Mythos) as HIPAA‑eligible and requires entering into an AWS BAA, which applies to Cohere models served via Bedrock.

"Amazon Bedrock ... [excluding Fable and Mythos models]" ... "NOTE: If you are a Covered Entity or Business Associate ... you agree not to use these HIPAA Eligible Services ... without first entering into an AWS business associate agreement."

source

AWS publicly provides a GDPR DPA that references Standard Contractual Clauses and links to a publicly published sub‑processor list, covering the Bedrock offering used for Cohere.

"Customer ... becomes aware that Customer Data transferred under the Standard Contractual Clauses is inaccurate or outdated..." and "The AWS website (currently posted at https://aws.amazon.com/compliance/sub-processors/) lists Sub‑processors that are currently engaged by AWS."

source

The AWS Bedrock FAQ publicly states that customer content is not used to improve base models nor shared with providers, covering Cohere models accessed via Bedrock.

With Amazon Bedrock, your content is not used to improve the base models and is not shared with any model providers.

source

The AWS Bedrock data‑retention page publicly documents retention policies and states ZDR is only available after contacting an account manager, so the claim is only partially satisfied.

Zero data retention (ZDR) access If your organization requires zero data retention for compliance reasons and you need access to these models, contact your AWS account manager to discuss eligibility. ZDR access is evaluated on a per‑account, per‑model basis in coordination with the model provider.

source

The value partial is defensible: AWS Bedrock documents self-serve In-Region pinning, and some current Cohere models are EU-available, but the flagshiip Command R+ remains available only in us-east-1/us-west-2 (its official model card lists no EU regions and Geo/Global 'Not supported'), so a material

Availability: The Cohere Embed models are available today for all AWS customers in two of the AWS Regions where Amazon Bedrock is available: US East (N. Virginia) and US West (Oregon).

source

The European Commission's official GPAI Code of Practice signatory list publicly includes 'Cohere', confirming the model developer is on the list.

Cohere

source

Cohere’s official documentation for Command A+ publicly links to the Article 53 training‑data summary PDF, confirming the developer has published the required summary.

EU AI Act Article 53(1)(d): [Public Summary of Training Content](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/cohere.docs.buildwithfern.com/22457734c44f1c4e417d5ff1230a3abf76a892d36d3c2b93f06902199d977ed7/assets/documents/eu-ai-public-summary_command-a-plus_2607031.pdf?... )

source