AWS Bedrock
What AWS Bedrock keeps, for how long, whether it trains on it, and what rights you grant, for Amazon Bedrock. Each answer quotes AWS Bedrock's own policy.
Amazon Bedrock API
- Default retention How long prompts and chats are kept
-
Inferred Bedrock uses a 'zero operator access' model, storing or reviewing inputs and outputs only in listed cases. We infer most traffic isn't kept; the linked Data retention page wasn't captured.
What the policy says
"In certain limited circumstances described below, we may also store or review model inputs or outputs. Amazon Bedrock uses a zero operator access (ZOA) data security model, subject to the model-specific abuse and CSAM detection detailed below."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08 - After you delete How long until it is gone
-
Not stated The captured policies don't say how long data takes to be deleted after closing an account or deleting resources.
- Kept longer when Safety flags, legal holds, backups
-
Stated OpenAI models (not gpt-oss): flagged traffic up to 30 days. Claude Fable 5/5.1: all traffic up to 30 days unless on temporary ZDR. Suspected CSAM may be stored and reported.
What the policies say (4 quotes)
"For all OpenAI models other than GPT OSS Safeguard 120B, GPT OSS Safeguard 20B, gpt-oss-120b, and gpt-oss-20b, classifier-flagged traffic will be retained for up to 30 days for automated offline abuse detection."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08"For Anthropic Claude Fable 5 and Claude Fable 5.1, all traffic will be retained for up to 30 days for automated offline abuse detection."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08"Amazon Bedrock may store and review the flagged input or output exclusively to determine if it is CSAM and may also file a report with the National Center for Missing and Exploited Children (NCMEC) or a relevant authority."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08"Any data that you enter into tags or free-form text fields used for names may be used for billing or diagnostic logs."
Data protectiondocs.aws.amazon.comcaptured 2026-11-08 - Zero data retention Whether it exists and who can get it
-
Stated Eligible customers may request full ZDR for OpenAI models via their AWS account team. Enterprise Frontier Safeguards-eligible customers get Claude Fable 5/5.1 ZDR only through December 31, 2026. Criteria unstated.
What the policies say (2 quotes)
"Eligible customers may request full ZDR through their AWS account team."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08"Customers that are eligible for the Enterprise Frontier Safeguards program will receive ZDR through December 31, 2026. After ZDR ends, all traffic will be retained for up to 30 days for automated offline abuse detection."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08 - Trains on your data By default
-
Stated No. AWS says your content isn't used to improve the base models and isn't shared with model providers.
What the policy says
"With Amazon Bedrock, your content is not used to improve the base models and is not shared with any model providers."
Build Generative AI Applications with Foundation Models - Amazon Bedrock FAQsaws.amazon.comcaptured 2026-11-08 - Opting out How, and what it doesn't cover
-
Inferred No opt-out is described. We infer none is needed because content isn't used to improve base models. The answer to the FAQ question on training wasn't captured.
What the policy says
"With Amazon Bedrock, your content is not used to improve the base models"
Build Generative AI Applications with Foundation Models - Amazon Bedrock FAQsaws.amazon.comcaptured 2026-11-08 - Human review Whether people read conversations
-
Stated Normally no operator access. Exceptions: AWS staff may review classifier-flagged Claude Fable 5/5.1 traffic, and may review suspected CSAM.
What the policies say (2 quotes)
"Classifier-flagged traffic will be subject to potential human review performed by AWS."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08"Amazon Bedrock may store and review the flagged input or output exclusively to determine if it is CSAM"
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08 - Memory Remembered facts and profiles
-
Not stated The captured policies don't describe agent memory. The FAQ answers about Agents and AgentCore weren't captured.
- Connected apps Email, calendar, drive
-
Not stated Knowledge Bases can connect to your data sources, but the captured policies don't say what is stored or what happens when a source is disconnected.
- Agent actions Actions taken, browsing, credentials
-
Not stated Agents can call your company systems and APIs, but logs of agent actions and stored credentials aren't described.
- Your inputs Who owns them
-
Not stated Under the shared responsibility model you control your content, but the captured policies contain no ownership clause.
- Outputs Who owns them
-
Not stated Not stated. The FAQ asks about an IP indemnity for generative AI, but its answer wasn't captured.
- License you grant Scope, and whether it is perpetual
-
Not stated The captured policies contain no license terms.
- Sharing Model providers, subprocessors, ads
-
Stated Model providers can't access the AWS-run accounts hosting their models, so can't see your prompts, completions or logs. Abuse-detection data stays with AWS. CSAM may be reported to NCMEC.
What the policies say (3 quotes)
"Because the model providers don't have access to those accounts, they don't have access to Amazon Bedrock logs or to customer prompts and completions."
Data protectiondocs.aws.amazon.comcaptured 2026-11-08"Retained inputs and outputs are stored and processed by AWS and are not shared with third-party model providers."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08"your content is not used to improve the base models and is not shared with any model providers."
Build Generative AI Applications with Foundation Models - Amazon Bedrock FAQsaws.amazon.comcaptured 2026-11-08 - Where data lives Regions and residency
-
Stated Models run in per-Region deployment accounts. With cross-region inference on, data kept for abuse detection is stored in the Region that processed the request. The FAQ answer on moving data out of a Region wasn't captured.
What the policies say (2 quotes)
"in each AWS Region where Amazon Bedrock is available, there is one such deployment account per model provider."
Data protectiondocs.aws.amazon.comcaptured 2026-11-08"If cross-region inference is enabled for these models, retained inputs and outputs are stored in destination regions (i.e., the region where your inference request is processed)."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08 - Enterprise controls Retention settings, DPA, SSO
-
Stated Controls include IAM/Identity Center, optional CloudTrail API activity logging, your own encryption keys, PrivateLink, FIPS endpoints, and SOC/ISO/HIPAA-eligible/GDPR/CSA STAR compliance. Customer keys and bring-your-own-bucket for abuse data are planned, not available yet.
What the policies say (5 quotes)
"Set up API and user activity logging with AWS CloudTrail."
Data protectiondocs.aws.amazon.comcaptured 2026-11-08"we recommend that you protect AWS account credentials and set up individual users with AWS IAM Identity Center or AWS Identity and Access Management (IAM)."
Data protectiondocs.aws.amazon.comcaptured 2026-11-08"Your data in Amazon Bedrock is always encrypted in transit and at rest, and you can optionally encrypt the data using your own keys. You can use AWS PrivateLink with Amazon Bedrock to establish private connectivity between your FMs and your Amazon Virtual Private Cloud (Amazon VPC) without exposing your traffic to the Internet."
Build Generative AI Applications with Foundation Models - Amazon Bedrock FAQsaws.amazon.comcaptured 2026-11-08"Amazon Bedrock is in scope for common compliance standards such as Service and Organization Control (SOC), International Organization for Standardization (ISO), is Health Insurance Portability and Accountability Act (HIPAA) eligible, and customers can use Amazon Bedrock in compliance with the General Data Protection Regulation (GDPR)."
Build Generative AI Applications with Foundation Models - Amazon Bedrock FAQsaws.amazon.comcaptured 2026-11-08"The Enterprise Frontier Safeguards program plans to enable customer-managed encryption keys and bring your own bucket for storage for automated offline abuse detection."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08
Notes
-
Bedrock runs automated abuse detection against both AWS's policies and third-party model providers' policies.
What the policy says
"As part of providing the Service, Amazon Bedrock may use automated abuse detection mechanisms to detect activity that violates our, or third-party model providers', terms of service or use policies."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08 -
When abuse detection flags something, AWS may email the account's contact address asking about your usage, and may suspend access if you don't respond.
What the policy says
"These requests are sent to the email address associated with your AWS account, so ensure that your account contact information is current and monitored. AWS may suspend your access to any model or Amazon Bedrock if you fail to comply with applicable terms or policies or are non-responsive."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08 -
Models are deep-copied into AWS-owned deployment accounts that model providers cannot access.
What the policy says
"These accounts are owned and operated by the Amazon Bedrock service team. Model providers don't have any access to those accounts."
Data protectiondocs.aws.amazon.comcaptured 2026-11-08 -
Suspected CSAM in image inputs or outputs may be blocked with a ValidationException error.
What the policy says
"If Amazon Bedrock detects apparent CSAM in your image inputs or outputs, Amazon Bedrock may block the request and return a `ValidationException` (HTTP 400) error in the API response."
Amazon Bedrock abuse detectiondocs.aws.amazon.comcaptured 2026-11-08
Open questions
Questions the captured policies leave unanswered, and where the answer probably lives.
The linked Bedrock 'Data retention' page (data-retention.html) wasn't captured. It would state default retention for ordinary traffic and related controls.
Optional model invocation logging (prompts and outputs sent to CloudWatch Logs or S3) isn't described. The only logging mentioned is CloudTrail API activity. The Bedrock 'model invocation logging' user-guide page would answer.
The FAQ captured policy holds only question headings for key security items (whether content leaves the Region, provider access, training, IP indemnity); the answer text wasn't captured.
Ownership of inputs and outputs, and any license to AWS, aren't covered. These would be in the AWS Customer Agreement and AWS Service Terms (Bedrock section).
Eligibility criteria for ZDR and the Enterprise Frontier Safeguards program aren't defined.
Storage of agent memory (Agents, AgentCore), Knowledge Base indexes, and fine-tuning data isn't covered. The relevant Bedrock user-guide pages would answer.
Deletion timelines after account closure, and DPA terms, aren't covered. The AWS GDPR DPA and the Data Privacy FAQ would answer.
Documents read
-
Amazon Bedrock abuse detection
docs.aws.amazon.com captured 2026-11-08 sha256 0b2c87a70682 -
Build Generative AI Applications with Foundation Models - Amazon Bedrock FAQs
aws.amazon.com captured 2026-11-08 sha256 4d2450b6e12b -
Data protection
docs.aws.amazon.com captured 2026-11-08 sha256 4bc792e9e6b4