Privacy Features of AWS Services
AWS is vigilant about your privacy, and we provide the most flexible and secure cloud computing environment available today. With AWS, you own your data, you control its location, and you control who has access to it. We are transparent about how AWS services process the personal data you upload to your AWS account (customer data), and we provide capabilities that allow you to encrypt, delete, and monitor the processing of your customer data.
You can use AWS services with the confidence that your customer data stays in the AWS Region you select. A small number of AWS services involve the transfer of customer data, for example, to develop and improve those services, where you can opt-out of the transfer, or because transfer is an essential part of the service (such as a content delivery service). We prohibit, and our systems are designed to prevent, remote access by AWS personnel to customer data for any purpose, including service maintenance, unless access is requested by you, is required to prevent fraud and abuse, or to comply with law.
Below we provide an overview of the key privacy features of AWS Services which you can use to perform data transfer assessments in accordance with the Schrems II decision of the Court of Justice of the European Union, and the European Data Protection Board Recommendations on measures that supplement transfer tools.
You can click on the underlined check marks in the below table for AWS documentation about how AWS services enable customers to encrypt, delete, and monitor the processing of their customer data.
| AWS service | Customer can encrypt | Customer can delete | Customer can monitor processing | No remote access* |
| HAQM API Gateway | ✓ | ✓ | ✓ | ✓ |
| HAQM AppFlow | ✓ | ✓ | ✓ | ✓ |
| HAQM AppStream 2.0 | ✓ | ✓ | ✓ | ✓ |
| HAQM AppStream 2.0 User Pools | ✓ | ✓ | ✓ | ✓ |
| HAQM Athena | ✓ | ✓ | ✓ | ✓ |
| HAQM Augmented AI (A2I) | ✓ | ✓ | ✓ | ✓ |
| HAQM Aurora | ✓ | ✓ | ✓ | ✓ |
| HAQM Bedrock1 | ✓ | ✓ | ✓ | ✓ |
| HAQM Braket | ✓ | ✓ | ✓ | ✓ |
| HAQM Chime | ✓ | ✓ | ✓ | ✓ |
| HAQM Cloud Directory | ✓ | ✓ | ✓ | ✓ |
| HAQM CloudFront | ✓ | ✓ | ✓ | ✓ |
| HAQM CloudWatch | ✓ | ✓ | ✓ | ✓ |
| HAQM CloudWatch Logs |
✓ | ✓ | ✓ | ✓ |
| HAQM CodeGuru Profiler | ✓ | ✓ | ✓ | ✓ |
| HAQM CodeGuru Reviewer | ✓ | ✓ | ✓ | ✓ |
| HAQM Cognito | ✓ | ✓ | ✓ | ✓ |
| HAQM Comprehend | ✓ | ✓ | ✓ | ✓ |
| HAQM Connect2 | ✓ | ✓ | ✓ | ✓ |
| HAQM Detective | ✓ | ✓ | ✓ | ✓ |
| HAQM DocumentDB (with MongoDB compatibility) | ✓ | ✓ | ✓ | ✓ |
| HAQM DynamoDB | ✓ | ✓ | ✓ | ✓ |
| HAQM Elastic Block Store (HAQM EBS) | ✓ | ✓ | ✓ | ✓ |
| HAQM Elastic Compute Cloud (HAQM EC2) | ✓ | ✓ | ✓ | ✓ |
| HAQM Elastic Container Registry (HAQM ECR) | ✓ | ✓ | ✓ | ✓ |
| HAQM Elastic Container Service (HAQM ECS) | ✓ | ✓ | ✓ | ✓ |
| HAQM Elastic File System (HAQM EFS) | ✓ | ✓ | ✓ | ✓ |
| HAQM Elastic Kubernetes Service (HAQM EKS) | ✓ | ✓ | ✓ | ✓ |
| HAQM ElastiCache for Memcached3 | ✓2 | ✓ | ✓ | ✓ |
| HAQM ElastiCache for Redis | ✓ | ✓ | ✓ | ✓ |
| HAQM EMR | ✓ | ✓ | ✓ | ✓ |
| HAQM EventBridge | ✓ | ✓ | ✓ | ✓ |
| HAQM Forecast | ✓ | ✓ | ✓ | ✓ |
| HAQM Fraud Detector | ✓ | ✓ | ✓ | ✓ |
| HAQM FSx for Lustre | ✓ | ✓ | ✓ | ✓ |
| HAQM FSx for ONTAP | ✓ | ✓ | ✓ | ✓ |
| HAQM FSx for OpenZFS | ✓ | ✓ | ✓ | ✓ |
| HAQM FSx for Windows File Server | ✓ | ✓ | ✓ | ✓ |
| HAQM GameLift | ✓ | ✓ | ✓ | ✓ |
| HAQM GuardDuty | ✓ | ✓ | ✓ | ✓ |
| HAQM Healthlake | ✓ | ✓ | ✓ | ✓ |
| HAQM Inspector | ✓ | ✓ | ✓ | ✓ |
| HAQM Inspector Classic | ✓ | ✓ | ✓ | ✓ |
| HAQM Interactive Video Service (IVS) | ✓ | ✓ | ✓ | ✓ |
| HAQM Kendra | ✓ | ✓ | ✓ | ✓ |
| HAQM Keyspaces | ✓ | ✓ | ✓ | ✓ |
| HAQM Managed Service for Apache Flink for Java Applications | ✓ | ✓ | ✓ | ✓ |
| HAQM Managed Service for Apache Flink for SQL Applications | ✓ | ✓ | ✓ | ✓ |
| HAQM Kinesis Data Firehose | ✓ | ✓ | ✓ | ✓ |
| HAQM Kinesis Data Streams | ✓ | ✓ | ✓ | ✓ |
| HAQM Kinesis VideoStreams | ✓ | ✓ | ✓ | ✓ |
| HAQM Lex | ✓ | ✓ | ✓ | ✓ |
| HAQM Lightsail | ✓ | ✓ | ✓ | ✓ |
| HAQM Location Service | ✓ | ✓ | ✓ | ✓ |
| HAQM Macie | ✓ | ✓ | ✓ | ✓ |
| HAQM Managed Blockchain (AMB) | ✓ | ✓ | ✓ | ✓ |
| HAQM Managed Service for Grafana (AMG) | ✓ | ✓ | ✓ | ✓ |
| HAQM Managed Service for Prometheus (AMP) | ✓ | ✓ | ✓ | ✓ |
| HAQM Managed Streaming for Kafka (MSK) | ✓ | ✓ | ✓ | ✓ |
| HAQM Managed Workflows for Apache Airflow (MWAA) | ✓ | ✓ | ✓ | ✓ |
| HAQM MemoryDB for Redis | ✓ | ✓ | ✓ | ✓ |
| HAQM MQ | ✓ | ✓ | ✓ | ✓ |
| HAQM Neptune | ✓ | ✓ | ✓ | ✓ |
| HAQM OpenSearch Service | ✓ | ✓ | ✓ | ✓ |
| HAQM Personalize | ✓ | ✓ | ✓ | ✓ |
| HAQM Pinpoint | ✓ | ✓ | ✓ | ✓ |
| HAQM Polly | ✓ | ✓ | ✓ | ✓ |
| HAQM Q Business | ✓ | ✓ | ✓ | ✓ |
| HAQM Q Developer | ✓ | ✓ | ✓ | ✓ |
| HAQM Quantum Ledger Database (QLDB) | ✓ | ✓ | ✓ | ✓ |
| HAQM QuickSight2 | ✓ | ✓ | ✓ | ✓ |
| HAQM Redshift | ✓ | ✓ | ✓ | ✓ |
| HAQM Rekognition | ✓ | ✓ | ✓ | ✓ |
| HAQM Relational Database Service (HAQM RDS) | ✓ | ✓ | ✓ | ✓ |
| HAQM SageMaker | ✓ | ✓ | ✓ | ✓ |
| HAQM Simple Email Service (HAQM SES) | ✓ | ✓ | ✓ | ✓ |
| HAQM Simple Notification Service (HAQM SNS) | ✓ | ✓ | ✓ | ✓ |
| HAQM Simple Queue Service (HAQM SQS) | ✓ | ✓ | ✓ | ✓ |
| HAQM Simple Storage Service (HAQM S3) | ✓ | ✓ | ✓ | ✓ |
| HAQM Simple Storage Service Glacier | ✓ | ✓ | ✓ | ✓ |
| HAQM Simple Workflow Service (HAQM SWF) | ✓ | ✓ | ✓ | ✓ |
| HAQM Textract | ✓ | ✓ | ✓ | ✓ |
| HAQM Timestream | ✓ | ✓ | ✓ | ✓ |
| HAQM Transcribe |
✓ | ✓ | ✓ | ✓ |
| HAQM Translate | ✓ | ✓ | ✓ | ✓ |
| HAQM Virtual Private Cloud (HAQM VPC) | ✓ | ✓ | ✓ | ✓ |
| HAQM WorkDocs | ✓ | ✓ | ✓ | ✓ |
| HAQM WorkLink | ✓ | ✓ | ✓ | ✓ |
| HAQM WorkMail | ✓ | ✓ | ✓ | ✓ |
| HAQM WorkSpaces |
✓ | ✓ | ✓ | ✓ |
| HAQM WorkSpaces Application Manager (HAQM WAM) | ✓ | ✓ | ✓ | ✓ |
| AWS Amplify | ✓ | ✓ | ✓ | ✓ |
| AWS App Mesh | ✓ | ✓ | ✓ | ✓ |
| AWS App Runner | ✓ | ✓ | ✓ | ✓ |
| AWS Application Discovery Service | ✓ | ✓ | ✓ | ✓ |
| AWS Application Migration Service | ✓ | ✓ | ✓ | ✓ |
| AWS AppSync | ✓ | ✓ | ✓ | ✓ |
| AWS Audit Manager | ✓ | ✓ | ✓ | ✓ |
| AWS Backup | ✓ | ✓ | ✓ | ✓ |
| AWS Certificate Manager (ACM) | ✓ | ✓ | ✓ | ✓ |
| AWS Clean Rooms | ✓ | ✓ | ✓ | ✓ |
| AWS Cloud9 | ✓ | ✓ | ✓ | ✓ |
| AWS CloudFormation | ✓ | ✓ | ✓ | ✓ |
| AWS CloudHSM | ✓ | ✓ | ✓ | ✓ |
| AWS CloudShell | ✓ | ✓ | ✓ | ✓ |
| AWS CloudTrail | ✓ | ✓ | ✓ | ✓ |
| AWS CodeArtifact | ✓ | ✓ | ✓ | ✓ |
| AWS CodeBuild | ✓ | ✓ | ✓ | ✓ |
| AWS CodeCommit | ✓ | ✓ | ✓ | ✓ |
| AWS CodeDeploy | ✓ | ✓ | ✓ | ✓ |
| AWS CodePipeline | ✓ | ✓ | ✓ | ✓ |
| AWS CodeStar | ✓ | ✓ | ✓ | ✓ |
| AWS Config | ✓ | ✓ | ✓ | ✓ |
| AWS Control Tower | ✓ | ✓ | ✓ | ✓ |
| AWS Database Migration Service (AWS DMS) | ✓ | ✓ | ✓ | ✓ |
| AWS Data Exchange | ✓ | ✓ | ✓ | ✓ |
| AWS DataSync | ✓ | ✓ | ✓ | ✓ |
| AWS Device Farm | ✓ | ✓ | ✓ | ✓ |
| AWS Direct Connect | ✓ | ✓ | ✓ | ✓ |
| AWS Directory Service | ✓ | ✓ | ✓ | ✓ |
| AWS Elastic Beanstalk | ✓ | ✓ | ✓ | ✓ |
| AWS Elastic Disaster Recovery | ✓ | ✓ | ✓ | ✓ |
| AWS Elastic Transcoder | ✓ | ✓ | ✓ | ✓ |
| AWS Elemental MediaConnect | ✓ | ✓ | ✓ | ✓ |
| AWS Elemental MediaConvert |
✓ | ✓ | ✓ | ✓ |
| AWS Elemental MediaLive |
✓ | ✓ | ✓ | ✓ |
| AWS Elemental MediaPackage | ✓ | ✓ | ✓ | ✓ |
| AWS Elemental MediaStore | ✓ | ✓ | ✓ | ✓ |
| AWS Entity Resolution | ✓ | ✓ | ✓ | ✓ |
| AWS Fargate | ✓ | ✓ | ✓ | ✓ |
| AWS Firewall Manager | ✓ | ✓ | ✓ | ✓ |
| AWS Global Accelerator | ✓ | ✓ | ✓ | ✓ |
| AWS Glue | ✓ | ✓ | ✓ | ✓ |
| AWS Glue DataBrew | ✓ | ✓ | ✓ | ✓ |
| AWS IAM Identity Center | ✓ | ✓ | ✓ | |
| AWS IoT Analytics | ✓ | ✓ | ✓ | ✓ |
| AWS IoT Core | ✓ | ✓ | ✓ | ✓ |
| AWS IoT Device Management | ✓ | ✓ | ✓ | ✓ |
| AWS IoT Events | ✓ | ✓ | ✓ | ✓ |
| AWS IoT Greengrass V1 |
✓ | ✓ | ✓ | ✓ |
| AWS IoT Greengrass V2 | ✓ | ✓ | ✓ | ✓ |
| AWS IoT SiteWise | ✓ | ✓ | ✓ | ✓ |
| AWS IoT Things Graph | ✓ | ✓ | ✓ | ✓ |
| AWS IQ | ✓ | ✓ | ✓ | ✓ |
| AWS Key Management Service (AWS KMS) | ✓ | ✓ | ✓ | ✓ |
| AWS Lake Formation | ✓ | ✓ | ✓ | ✓ |
| AWS Lambda | ✓ | ✓ | ✓ | ✓ |
| AWS License Manager | ✓ | ✓ | ✓ | ✓ |
| AWS Migration Hub | ✓ | ✓ | ✓ | ✓ |
| AWS OpsWorks for Chef Automate | ✓ | ✓ | ✓ | ✓ |
| AWS OpsWorks for Puppet Enterprise | ✓ | ✓ | ✓ | ✓ |
| AWS OpsWorks Stacks | ✓ | ✓ | ✓ | ✓ |
| AWS Outposts | ✓ | ✓ | ✓ | ✓ |
| AWS RoboMaker | ✓ | ✓ | ✓ | ✓ |
| AWS Secrets Manager | ✓ | ✓ | ✓ | ✓ |
| AWS Security Hub | ✓ | ✓ | ✓ | ✓ |
| AWS Serverless Application Repository |
✓ | ✓ | ✓ | ✓ |
| AWS Service Catalog | ✓ | ✓ | ✓ | ✓ |
| AWS Snowball Edge |
✓ | ✓ | ✓ | ✓ |
| AWS Snowcone | ✓ | ✓ | ✓ | ✓ |
| AWS Snowmobile | ✓ | ✓ | ✓ | ✓ |
| AWS Step Functions | ✓ | ✓ | ✓ | ✓ |
| AWS Storage Gateway for FSx File Gateway | ✓ | ✓ | ✓ | ✓ |
| AWS Storage Gateway for S3 File Gateway | ✓ | ✓ | ✓ | ✓ |
| AWS Storage Gateway for Tape Gateway | ✓ | ✓ | ✓ | ✓ |
| AWS Storage Gateway for Volume Gateway | ✓ | ✓ | ✓ | ✓ |
| AWS Supply Chain2 | ✓ | ✓ | ✓ | ✓ |
| AWS Systems Manager | ✓ | ✓ | ✓ | ✓ |
| AWS Transfer Family | ✓ | ✓ | ✓ | ✓ |
| AWS WAF | ✓ | ✓ | ✓ | ✓ |
| AWS X-Ray | ✓ | ✓ | ✓ | ✓ |
| CloudEndure Disaster Recovery (an AWS Company) | ✓ | ✓ | ✓ | ✓ |
| CloudEndure Migration (an AWS Company) | ✓ | ✓ | ✓ | ✓ |
| Contact Lens for HAQM Connect | ✓ | ✓ | ✓ | ✓ |
| FreeRTOS | ✓ | ✓ | ✓ | ✓ |
* Unless access is requested by you, is required to prevent fraud and abuse, or to comply with law.
1 Processing occurs in conjunction with the foundational model (FM) you choose.
2 See the applicable service documentation for information about HAQM Q.
3. HAQM ElastiCache for Memcached supports encryption in transit. By design, Memcached doesn’t provide persistent disk storage, and only stores data in memory for the time needed for customer’s application. ElastiCache also supports memory encryption when choosing Graviton instances of family types r6g and m6g. All data-storing AWS services offer encryption.
AWS services that allow customers to opt-out of transfers of customer data
The following AWS services transfer customer data to develop and improve those services, and you can opt out of that transfer.
- HAQM CodeGuru Profiler
- HAQM Comprehend
- HAQM Connect*
- HAQM Fraud Detector
- HAQM GuardDuty**
- HAQM Lex
- HAQM Polly
- HAQM Q Developer Free Tier
- HAQM Rekognition
- HAQM Textract
- HAQM Transcribe
- HAQM Translate
- AWS Supply Chain
* This entry encompasses, for example, HAQM Connect Customer Profiles and HAQM Connect outbound campaigns, as well as HAQM Q features that are available in HAQM Connect.
** This AWS service will involve a transfer to the extent you have enabled the new HAQM GuardDuty Malware Protection feature.
AWS services that transfer customer data as an essential function of the service
The following AWS services transfer customer data as an essential function of the service. For example, if you choose to send messages via HAQM Simple Notification Service, the content of those messages will transfer to the location of the recipients.
- HAQM AppStream 2.0 User Pool
- HAQM Chime
- HAQM CloudFront
- HAQM Cognito*
- AWS IAM Identity Center**
- HAQM Interactive Video Service (IVS)
- HAQM Location Service
- HAQM Pinpoint
- HAQM Simple Email Service
- HAQM Simple Notification Service
- HAQM WorkMail
- AWS Elemental MediaConnect
- AWS IoT Core***
* In certain circumstances, HAQM Cognito uses HAQM Simple Email Service (HAQM SES) to send user emails and HAQM Simple Notification Service (HAQM SNS) to send user SMS text messages. If HAQM SES is not available in Region, HAQM Cognito calls HAQM SES’ endpoints in a different AWS Region. More information can be found here. Similarly, if HAQM SNS is not available in Region, HAQM Cognito calls HAQM SNS’ endpoints in a different AWS Region. More information can be found here.
** In certain circumstances, AWS IAM Identity Center uses HAQM Simple Email Service (HAQM SES) to send user emails. If HAQM SES is not available in Region, IAM Identity Center calls HAQM SES’ endpoints in a different AWS Region. More information can be found here.
*** To the extent you use the IoT Core for HAQM Sidewalk feature, or the Device Location feature supported by HERE is enabled.
