AI Vendor Directory · Foundation model APIs
Does Amazon Bedrock train on your data?
No — does not train on your data by default. Vendor-stated default: no (all Bedrock usage). Bedrock FAQs state customer 'content is not used to improve the base models and is not shared with any model providers,' and 'AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.' Fine-tuning creates a private copy of the base model; content is encrypted in transit and at rest and stays in the AWS Region used, with customer-managed KMS keys and PrivateLink available.
By the Shieldra Compliance Team · Last updated 2026-07-29
What is Amazon Bedrock?
AWS's managed service offering Anthropic, Amazon Nova, Meta, Mistral and other models behind one API inside the customer's AWS account boundary. SMBs on AWS use it to keep model traffic within their VPC/region.
Key facts
- Vendor: Amazon Web Services — https://aws.amazon.com/bedrock/
- Trains on customer data by default: no (all Bedrock usage)
- Source for the training answer: https://aws.amazon.com/bedrock/faqs/
- Data residency: US; EU; Global (data stays in the customer-selected AWS Region)
- Last verified: 2026-07-29
What certifications does Amazon Bedrock hold?
- SOC 1/2/3
- ISO 9001, 27001, 27017, 27018, 27701, 22301, 20000
- CSA STAR Level 2
- HIPAA eligible
- FedRAMP Moderate
- GDPR-aligned (AWS DPA)
Security, DPA, and subprocessor links
- Security / trust page: https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html
- Data processing agreement (DPA): https://aws.amazon.com/compliance/gdpr-center/
What is your EU AI Act role when you build on Amazon Bedrock?
Building on Bedrock typically makes you the provider of your downstream AI system under the EU AI Act (Article 50 transparency duties on you); the upstream GPAI obligations sit with the model providers surfaced through Bedrock.
What to record in your AI registry
- Provider: AWS (Amazon Bedrock)
- Model type: third party api
- Data typically flowing to the vendor: prompts, completions, fine-tuning data, knowledge-base/RAG documents
Sources
- https://aws.amazon.com/bedrock/faqs/
- https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html
Disclaimer
Curated from vendor-published pages on the date above. Vendor terms change - verify against the cited sources before relying on a profile for a procurement decision. Last verified 2026-07-29.
Frequently asked questions
Does Amazon Bedrock train AI models on your data?
No — does not train on your data by default. Vendor-stated default: no (all Bedrock usage). Bedrock FAQs state customer 'content is not used to improve the base models and is not shared with any model providers,' and 'AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.' Fine-tuning creates a private copy of the base model; content is encrypted in transit and at rest and stays in the AWS Region used, with customer-managed KMS keys and PrivateLink available.
What certifications does Amazon Bedrock hold?
Per the vendor's published pages as of 2026-07-29: SOC 1/2/3; ISO 9001, 27001, 27017, 27018, 27701, 22301, 20000; CSA STAR Level 2; HIPAA eligible; FedRAMP Moderate; GDPR-aligned (AWS DPA).
Where does Amazon Bedrock store your data?
Vendor-listed data residency options as of 2026-07-29: US; EU; Global (data stays in the customer-selected AWS Region).
What is your EU AI Act role when you build on Amazon Bedrock?
Building on Bedrock typically makes you the provider of your downstream AI system under the EU AI Act (Article 50 transparency duties on you); the upstream GPAI obligations sit with the model providers surfaced through Bedrock.
