Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

  1. Explore
  3. Amazon Bedrock
AB

Amazon Bedrock

Sovereignty grade C+ (62/100). EU region selectable; no training on your data. AWS, United States.

Category
inference-host
EU AI Act role
Deployer
Deployments
Hosted API
Certifications
ISO 27001ISO 42001SOC 2 Type II
Categories
Inference host
Government access exposure
US CLOUD Act
Countries
United States

Details

Deployment
hosted
Hq Country
United States
Hq City
Seattle
Ownership
public
Founded
2006
Trust Center Url
aws.amazon.com/compliance
Training Default
never
Residency Options
any AWS region, EU (Frankfurt, Ireland, Paris, Stockholm), AWS European Sovereign Cloud (Brandenburg, DE), GovCloud
Gov Access Exposure
us-cloud-act
Eu Ai Act Role
deployer
Certs
ISO 42001, ISO 27001, SOC 2 Type II, FedRAMP High (GovCloud, select models), CSA STAR Level 2
DPA available
yes
Zero Retention Available
Yes
Retention Default
Zero data retention + zero operator access by default — inputs/outputs not stored, and retained data is not shared with third-party model providers. Exceptions: for the listed OpenAI GPT-5.x models, classifier-flagged traffic is retained up to 30 days, with full ZDR available on request through the AWS account team; for Anthropic Claude Fable 5 and Claude Fable 5.1, all traffic is retained up to 30 days with AWS human review of classifier-flagged traffic, and ZDR is available only to Enterprise Frontier Safeguards customers and ends on December 31.
Retention Exceptions
Certain third-party models require abuse-detection retention up to 30 days (e.g. some Anthropic/OpenAI-on-Bedrock traffic); provider data-sharing is opt-in. CSAM hash-matching applies to all.
Subprocessors
Amazon-owned datacentres, third-party model providers (isolated deployment accounts)
Transfer Mechanism
sccs+dpf
Eu Procurement Ready
conditional
Eu Procurement Reason
Best default retention posture (ZDR + zero operator access) + ISO 42001; US CLOUD Act jurisdiction remains unless AWS European Sovereign Cloud is used (EU-incorporated, EU-resident operators).
Last Policy Change
2026-01-15T00:00:00.000Z
Change Summary
AWS European Sovereign Cloud reached general availability (first region Brandenburg, Germany) — EU-controlled, EU-operated.
Prior Value
European Sovereign Cloud announced/under construction, not GA.
Training Evidence Url
aws.amazon.com/bedrock/faqs
Training Claim Basis
stated
Training Confidence
high
Residency Evidence Url
press.aboutamazon.com/aws/2026/1/aws-launches-aws-european-sovereign-cloud-and-announces-expansion-across-europe
Residency Claim Basis
stated
Residency Confidence
high
Retention Evidence Url
docs.aws.amazon.com/bedrock/latest/userguide/abuse-detection.html
Retention Claim Basis
stated
Retention Confidence
high
Subprocessors Evidence Url
docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html
Subprocessors Claim Basis
inferred
Subprocessors Confidence
low
Residency Class
eu-selectable
Portability / Exit Path
serves-open-models
Subprocessor Jurisdiction
non-eu

Change history

  1. Sep 2, 2026Retention Default

    Zero data retention + zero operator access by default — inputs/outputs not stored; model providers cannot access traffic. → Zero data retention + zero operator access by default — inputs/outputs not stored, and retained data is not shared with third-party model providers. Exceptions: for the listed OpenAI GPT-5.x models, classifier-flagged traffic is retained up to 30 days, with full ZDR available on request through the AWS account team; for Anthropic Claude Fable 5 and Claude Fable 5.1, all traffic is retained up to 30 days with AWS human review of classifier-flagged traffic, and ZDR is available only to Enterprise Frontier Safeguards customers and ends on December 31.

    Source
  2. Aug 3, 2026Governance Grade

    B+ → C+

At a glance
Governance Grade
C+
Governance Score
62
EC SOV-2 Legal & Jurisdictional (0-4)
1
EC SOV-3 Data & AI (0-4)
2
Website

Similar

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D

More EU AI Act role

  • Deployer59
  • General-purpose AI (GPAI)10
  • provider9
  • GPAI with systemic risk5

More Deployments

  • Hosted API68
  • Self-hosted weights6
  • On-premise6
  • Private VPC2

More Certifications

  • SOC 2 Type II46
  • ISO 2700136
  • ISO 4200113
  • ISO 270177
  • ISO 277017
  • ISO 270186
  • HDS5
  • HIPAA4
  • CSA STAR4
  • C54
  • ISO 90013
  • PCI DSS3
  • FedRAMP High3
  • ISO 27001:20223
  • SOC 2 (type unverified)2
  • ISO 500012
  • BSI C52
  • SOC 32
  • FedRAMP2
  • GDPR2
  • CSA STAR Level 12

More Categories

  • Coding assistant15
  • meeting-ai13
  • Sovereign host13
  • Inference host13
  • SaaS-embedded11
  • Foundation model11
  • Cloud platform7

More Government access exposure

  • US CLOUD Act44
  • No non-EU government access27
  • Mixed jurisdiction9
  • PRC National Intelligence Law2

More Countries

  • United States45
  • Germany9
  • France7
  • Switzerland5
  • Singapore3
  • Israel2
  • United Kingdom2
  • China2
  • Netherlands2