AWS Bedrock SOC 2 Type II and GDPR compliance

Every foundation model you call through AWS Bedrock inherits AWS's SOC 2 Type II report, because AWS is the audited data processor and each model provider (Anthropic, Meta, Mistral, Cohere, Stability AI, Amazon) sits underneath it as a sub-processor. There is no separate SOC 2 Type II report to chase per model. That single fact resolves most of the confusion behind the question "which AWS partners on Bedrock have SOC 2 Type II."

Bedrock is the enterprise choice for teams that need foundation models without routing data through third-party AI providers. You call the same or equivalent models through AWS infrastructure, under AWS's terms, in your chosen region. Each provider keeps its own sub-processor relationship, but the audited processor you rely on is AWS. That structure is the nuance most guides miss.

AWS Bedrock's compliance certifications

AWS holds the most extensive compliance portfolio of any cloud provider. The certifications that matter for Bedrock:

SOC 2 Type II. AWS maintains SOC 2 Type II reports for its services, including Bedrock, available through AWS Artifact. Type II covers how controls operated over a period, not just their design at a point in time.

ISO 27001, 27017, 27018. Information security, cloud security, and personal data protection. ISO 27018 is particularly relevant for GDPR.

GDPR. The AWS Data Processing Addendum covers all AWS services including Bedrock, available at aws.amazon.com/compliance/gdpr-center.

PCI DSS, HIPAA, SOC 3, FedRAMP. Available for workloads that require them; verify Bedrock GovCloud availability separately for FedRAMP High.

AWS Artifact (console.aws.amazon.com/artifact) provides on-demand access to all AWS compliance reports. For a vendor assessment, download the current AWS SOC 2 Type II report from Artifact. The Trust Service Criteria it covers are the same ones your own auditor will hold you to.

GDPR: how Bedrock changes the data flow

The core GDPR advantage of using Bedrock versus calling model providers directly:

Single DPA covers all models. When you call Claude through Bedrock, you have one processor relationship with AWS, not two. The AWS DPA governs the processing. Anthropic, in this context, is a sub-processor of AWS for model delivery, not a direct processor of your data.

Regional data residency. Bedrock is available in regions including us-east-1, eu-west-1, eu-central-1, ap-southeast-1, and others. Selecting an EU region keeps your data within the EU, in a way standalone API access to the same models often cannot.

VPC endpoints. Bedrock supports AWS PrivateLink, which lets you call the API from within your VPC without traffic going over the public internet.

Data handling in Bedrock: what AWS stores and does not

This is the critical question for every compliance review:

By default, Bedrock does not store your prompts or responses. The API is stateless. Your request goes in, a response comes back, and nothing is retained on AWS's side.

Model customization changes this. If you use fine-tuning or continued pre-training to customize a model on your data, that training data is stored in an S3 bucket you own, within your account and region. You control retention and deletion.

Knowledge Bases and Agents store data. RAG embeddings and agent state land in an AWS-managed OpenSearch collection or your own S3 bucket depending on configuration. Guardrails and Model Evaluation add logging options too. Document what is stored, where, and confirm it matches your data handling requirements.

Per-model compliance matrix

Bedrock offers models from multiple providers. The compliance posture for each:

The point holds across the table: AWS is the data processor and the model provider is a sub-processor under AWS's terms. One DPA with AWS covers all of these models. Calling Anthropic, Mistral, and Cohere directly would mean three separate DPAs to negotiate and maintain. If you also use a provider's API outside Bedrock, treat that as its own vendor and read our note on Anthropic Claude GDPR and SOC 2 compliance.

SOC 2 controls for teams using Bedrock

CC9.1 vendor management. AWS should already be in your inventory if you run on AWS. Add a Bedrock note: AI model inference, data processed, risk tier, zero-retention default, and region configuration. Our SOC 2 vendor management guide covers the register format auditors accept.

CC6 logical access. Bedrock access is controlled via IAM. Create a dedicated role for your Bedrock-using services, restrict it to only the model actions and regions needed, and use IAM conditions to limit which models can be called. Audit permissions quarterly.

CC6 encryption. Bedrock supports customer-managed KMS keys for data stored during Knowledge Bases, fine-tuning, or logging. If you use those features, configure KMS CMKs.

Audit logging (CC7). Enable CloudTrail for Bedrock. Every InvokeModel call and configuration change is logged. Export to your SIEM. For SOC 2, this is your primary evidence of access control and anomaly detection, which lines up with the CC7 monitoring requirements.

Token and cost controls. Bedrock has no built-in per-tenant token caps. If you build a product on it, implement your own per-tenant tracking. Runaway usage is a SOC 2 availability risk.

The one line item that trips up questionnaires

Here is the part most write-ups skip. When a questionnaire asks whether your AI sub-processor holds SOC 2 Type II, the correct answer for Bedrock is to name AWS as the processor and attach the AWS SOC 2 Type II report, not to hunt for a report branded by the model provider. Do three things in your vendor file:

If security questionnaires are the reason you are reading this, our walkthrough on how to pass a security questionnaire and the security questionnaire help page cover the rest of the form, not just the AI line.

Where this fits for AI startups

AI startups get hit with SOC 2 and security-questionnaire demands early, often from the first enterprise buyer and before anyone in-house owns security. Building on Bedrock removes the sub-processor sprawl, but it does not build your access controls, logging evidence, risk assessment, or policies. That work still maps to the same frameworks every SaaS company is measured against. For the AI-specific angle, see SOC 2 for AI startups and, if you sell into governed markets, ISO 42001.

That gap, senior security ownership without a full-time hire, is what a fractional CISO fills. Xorabyte runs SOC 2 for AI companies as a founder-led fractional CISO service, getting you audit ready and questionnaire ready without adding headcount. Reference pricing is retainers from $4,000 a month and fixed-scope projects from $1,500 (USD). Start with a SOC 2 readiness review or a cloud security review, or book a call and leave with a clear path, not a sales pitch.

Related reading

• SOC 2 for AI Startups: 2026 Guide
• Anthropic Claude GDPR and SOC 2 Compliance
• SOC 2 Vendor Management
• SOC 2 Evidence Collection
• SOC 2 CC7 Monitoring Requirements