Bedrock stores no prompts or outputs by default and shares none with model providers, but some models require a retention mode, so check each model before you promise customers anything. Claude Fable 5 and 5.1 require AWS review, and some OpenAI models keep flagged traffic for abuse detection. The routing profile decides where processing happens and where any retained data sits.
When you need this
- Security or legal review asks where prompts are processed and how long they are kept.
- Customer contracts promise that a model provider never sees your data.
- A team wants to use Claude Fable or an OpenAI GPT model on Bedrock.
Evaluation criteria
Default handling
What happens to prompts on a model with no retention requirement?
Look forVerify the model's retention requirements. Bedrock has zero operator access and stores no inputs or outputs by default. It shares no content with model providers or base-model training. Stored content is encrypted at rest in the Region where you use Bedrock.
Retention mode per Region
Is the data retention mode set in every Region you use?
Look forSet none, default, aws_review, or legacy provider_data_share per Region at account or project level. A Region set to inherit uses each model's default. At launch, configuration requires the API or SDK. There is no console setting.
Models that require review
Will you use a model that requires aws_review?
Look forAllow aws_review only where your policy permits it. Claude Fable 5 and 5.1 require it. AWS keeps prompts and outputs up to 30 days, with flagged traffic subject to human review and nothing shared with Anthropic. Enterprise Frontier Safeguards customers receive zero retention through December 31, 2026.
Abuse-detection retention
Does any model you use retain flagged traffic?
Look forCheck AWS's listed OpenAI models, including GPT-6 Astra, Sol, and Luna and GPT-5.4 to GPT-5.6. Classifier-flagged traffic stays up to 30 days for automated abuse detection. Eligible customers can request full zero retention through the AWS account team.
Routing and residency
Where is each request processed, and where would retained data be stored?
Look forChoose Geo profiles when processing must stay inside a geography. Opus 5.5 offers the US, EU, Australia, and Japan. Fable 5.1 offers only the US. Global routes to any supported commercial Region. Retained data stays in the Region that processed the request.
Enforcement
Can a team change the retention mode on its own?
Look forSet a Service Control Policy on bedrock-mantle:DataRetentionMode to restrict modes across the organization.
Questions to ask vendors
- Which Regions have we set to none, and which still inherit model defaults?
- Do our customer contracts allow AWS review of flagged traffic, as Claude Fable requires?
- Do we need Geo routing for every workload, or only for those under residency rules?
- Are we eligible for zero retention on the OpenAI models we use?
Red flags
- Telling customers that nothing is ever retained while using a model that requires retention.
- Global routing for a workload under EU or national residency rules.
- Retention configured in one Region and assumed in others.
- Relying on store=false in the Responses API and skipping the none retention mode.
Products in this piece
Sources
- Official documentation
- 7
- Public source
- 5
- Amazon Bedrock User Guide: Data retention
- Amazon Bedrock User Guide: Abuse detection
- Amazon Bedrock User Guide: Data protection
- Amazon Bedrock FAQs
- Amazon Bedrock security and compliance
- Amazon Bedrock User Guide: Cross-Region inference
- Amazon Bedrock User Guide: Claude Fable 5.1 model card
- Hacker News comment on Opus 5 and provider data sharing on Bedrock (Jul 24, 2026)
- Hacker News comment on vetting Bedrock models for data retention (Jun 10, 2026)
- Hacker News comment on keeping data in-country with Bedrock (Jun 2, 2026)
- Hacker News comment on running Anthropic models on Bedrock in EU regions (Sep 28, 2026)
- Hacker News comment on 4 to 6 months of legal review for Bedrock (Sep 10, 2026)