Data Sovereignty & Compliance¶

stdapi.ai is deployed entirely within your AWS account. Model inference, data storage, and service calls run on the AWS services and regions you explicitly configure — no third party sits between your users and your models, and the gateway contacts no vendor endpoint of its own.

Application Data Flow¶

The diagram below shows exactly where data flows and what is retained at each step:

%%{init: {'flowchart': {'htmlLabels': false}} }%%
flowchart TD
    client["Client request"] -->|"HTTPS (TLS 1.2+, TLS 1.3 and PQ key exchange enabled)"| alb["ALB (your AWS account)"]
    alb -->|"HTTP (private VPC)"| ecs["ECS container\n(in-memory only, stateless)"]
    ecs -->|"HTTPS — inference"| bedrock["Amazon Bedrock\n(no prompt retention)"]
    ecs -->|"HTTPS — temp files"| s3["Amazon S3\n(your bucket, TTL = request duration)"]
    ecs -->|"HTTPS — metadata only"| cw["Amazon CloudWatch\n(no prompt content by default)"]
    ecs -.->|"HTTPS — when used"| ai["Polly / Transcribe\nComprehend / Translate"]
    ecs -.->|"when a client passes a public\nfile URL (SSRF-validated)"| web["Public web"]
    bedrock -.->|"when a client requests\na web search tool"| web

What this means:

• ECS container — holds request data in memory only; stateless between requests; no disk writes
• Amazon Bedrock — processes the inference and returns the result; does not retain prompts (AWS source)
• Amazon S3 — temporary storage for multimodal inputs/outputs (images, audio, PDFs); files are deleted immediately after the request completes — see S3 Data Storage for the lifecycle-policy failsafe
• Amazon CloudWatch — receives structured request metadata (method, path, status, model, latency); prompt and response content are never logged by default (requires LOG_REQUEST_PARAMS=true to enable)
• Amazon Polly / Transcribe / Comprehend / Translate — used only when audio or translation features are invoked; see AI service opt-out for data retention controls
• Public web — reached two ways, both driven by the client: the gateway fetches a file the client referenced by http(s) URL (destination chosen by the caller, every hop validated against the SSRF guard, private and loopback ranges refused by default), or Bedrock performs a web search on the model's behalf when the client asks for that tool. Neither happens for requests that send inline data or S3 references and no web-search tool; see the outbound paths below

stdapi.ai communicates with the seven AWS services above, all within the regions you configure, plus a handful of conditional AWS services enabled only by specific features: AWS SSM and Secrets Manager (API key storage, if configured), AWS STS (account ID lookup when the ECS task metadata endpoint is unavailable — credentials themselves come from the standard AWS credential chain), the AWS Price List API (only when COST_TRACKING=true), AWS Marketplace Metering (AWS Marketplace image only), bedrock-agent-runtime (Amazon Bedrock sessions backing store=true on the Responses and Chat Completions APIs, and the Rerank API), bedrock-agent (Bedrock Prompt Management, only when AWS_BEDROCK_ALLOW_PROMPT_ARN is enabled), and bedrock-mantle (the Amazon Bedrock Mantle endpoint serving OpenAI GPT, xAI Grok, Google Gemma and similar models, enabled by default via AWS_BEDROCK_MANTLE_ENABLED).

The server initiates no third-party calls of its own: it contacts no external API, analytics service, or vendor endpoint on its own behalf. Four outbound paths can leave AWS, each driven by your own configuration or your own clients:

• Remote URLs supplied by a client — when a request references an input file by http(s) URL, the gateway downloads that URL as instructed. The destination is chosen by the caller, never by the server, and every connection (including redirect hops) is validated against SSRF_PROTECTION_BLOCK_PRIVATE_NETWORKS, enabled by default. Clients that send inline data or S3 references never trigger any outbound fetch.
• OpenTelemetry trace export — when OTEL_ENABLED is set to true, traces are exported in OTLP format to OTEL_EXPORTER_ENDPOINT, which defaults to a collector on localhost. Tracing is disabled by default, and the endpoint is yours to choose.
• An operator-overridden Mantle endpoint — AWS_BEDROCK_MANTLE_ENDPOINT_URL replaces the default https://bedrock-mantle.{region}.api.aws address. The override must use https, and a {region} placeholder is substituted when present, but its host is whatever you set; left unset, Mantle traffic stays on the AWS endpoint in your configured regions.
• Model-side web search — when a client includes a web search tool in a request (Amazon Nova's nova_grounding system tool, or the native web_search tool on Claude models), Amazon Bedrock performs the search on the model's behalf and queries the public web with content derived from the prompt. The gateway issues no such request itself, and no call triggers it unless the client asks for the tool. Amazon Nova's code interpreter (nova_code_interpreter) likewise executes inside Bedrock, not in your container. See Built-in Tool Pricing for how these invocations are metered, and AWS_BEDROCK_MODEL_REGION_RESTRICT to pin the models that offer them.

Data in Transit¶

ALB supports TLS 1.3 and post-quantum hybrid key exchange (ML-KEM / Kyber combined with a classical algorithm), so the session key is secure even against a future quantum adversary. See ALB security policies.

Stateless Design¶

ECS containers hold no user data between requests. All persistent data (multimodal inputs, async job outputs) is stored exclusively in your S3 buckets. When a container is stopped or replaced, no user data is lost.

Amazon Bedrock¶

Data Privacy¶

AWS gives you explicit control over whether your prompts and outputs are retained from inference requests via a data retention mode. The mode can be set at the account or project level and applies consistently across all inference calls. For full details, see the Amazon Bedrock data retention documentation.

Data Retention Modes¶

Zero Data Retention (ZDR) for High-Compliance Accounts¶

Some models require data retention for safety and abuse-prevention purposes. If your organization requires zero data retention for compliance reasons and needs access to these models, contact your AWS account manager to discuss eligibility. ZDR access is evaluated on a per-account, per-model basis in coordination with the model provider.

You can also enforce a zero-retention policy organization-wide via an AWS Service Control Policy (SCP) — contact your AWS account manager or cloud team to set this up.

provider_data_share Mode and Model Availability¶

Certain models — for example, models that require provider-side safety review — are only accessible if your account is configured to share inference data with the model provider. This is an explicit opt-in: most models do not require it, and AWS blocks the request if your retention policy does not permit it.

Model Deployment Account Architecture¶

The default isolation guarantee is enforced by the Model Deployment Account architecture: for each model provider, AWS maintains isolated accounts where model inference runs. AWS confirms:

"Model providers don't have any access to those accounts. [...] Because the model providers don't have access to those accounts, they don't have access to Amazon Bedrock logs or to customer prompts and completions."

This means that regardless of the geographic origin of a model, inference runs on AWS-owned infrastructure and — unless provider_data_share mode is explicitly configured — your prompts never reach the model provider.

Abuse Detection¶

AWS operates automated abuse detection mechanisms on Amazon Bedrock to identify activity that violates AWS or model provider terms of service. Full details are in the Amazon Bedrock abuse detection documentation.

Key points:

• Zero operator access (ZOA): No AWS operator can access model inputs or outputs.
• No storage of inputs or outputs by default: AWS does not store model inputs or outputs unless a specific model requires it for safety and abuse-prevention purposes (see Data Privacy); full zero data retention is the none retention mode.
• Model-specific retention for abuse detection: A small number of models require short-term retention of flagged or all traffic for automated offline abuse detection. For example, classifier-flagged traffic for certain OpenAI models may be retained for up to 30 days, and some Anthropic models require opting in to share retained traffic with the provider for abuse review. Eligible customers can request full ZDR for these models through their AWS account team.
• CSAM detection: AWS uses automated mechanisms (hash matching, classifiers) to detect child sexual abuse material in image inputs. Detected content is blocked (400 ValidationException), may be stored for review, and may be reported to NCMEC or relevant authorities.
• Policy violations: If abuse is detected, AWS may contact the email address on your AWS account and may suspend access to affected models. Keep your AWS account contact information current and monitored.

Encryption at Rest and in Transit¶

From the Amazon Bedrock FAQs:

"Your data in Amazon Bedrock is always encrypted in transit and at rest, and you can optionally encrypt the data using your own keys."

See KMS Encryption below for how stdapi.ai handles encryption at the infrastructure level.

Cross-Region Inference Profiles and Data Geography¶

When cross-region inference is enabled, Bedrock may route a request to another region within the inference profile's scope. AWS defines two types of profiles (source):

A model ID carrying no prefix is not an inference profile at all: it is a plain in-region invocation, served entirely by the region the request is sent to.

AWS explicitly states:

"if an inference profile is tied to a geography (such as US, EU, or APAC), its destination Region list will never change."

Set AWS_BEDROCK_CROSS_REGION_INFERENCE_GLOBAL=false to prevent Bedrock from using global profiles. Geography-pinned profiles (us.*, eu.*, apac.*) remain available and provide resilience within their geography. See Region-Specific Configuration for examples.

Model Providers and Data Access¶

All third-party models available through Bedrock are subject to the same Model Deployment Account architecture: the provider's software runs in AWS-owned, AWS-operated accounts that the provider cannot access. Your prompts and completions are never shared with any model provider, regardless of where that provider is headquartered.

This applies to providers from every geography, for example:

• Alibaba Cloud (China 🇨🇳) — Qwen models
• Amazon (United States 🇺🇸) — Nova and Titan models
• Anthropic (United States 🇺🇸) — Claude models
• Cohere (Canada 🇨🇦) — Command and Embed models
• DeepSeek (China 🇨🇳) — DeepSeek models
• Meta (United States 🇺🇸) — Llama models
• MiniMax (China 🇨🇳) — MiniMax models
• Mistral AI (France 🇫🇷) — Mistral models
• Moonshot AI (China 🇨🇳) — Kimi models
• Stability AI (United Kingdom 🇬🇧) — Stable Diffusion models
• Writer (United States 🇺🇸) — Palmyra models

AWS AI Services¶

Amazon Polly, Transcribe, Comprehend, and Translate each run in an independently configurable region. By default all four treat every AWS_BEDROCK_REGIONS entry as a candidate and fail over between them, so pointing AWS_BEDROCK_REGIONS to your target geography is usually sufficient.

AWS AI Service Improvement Opt-Out¶

S3 Data Storage¶

S3 is used as temporary storage for multimodal content (images, PDFs, audio files) passed to or returned from Bedrock and the AI services. Data is stored only in buckets you own and configure.

• Primary bucket (AWS_S3_BUCKET) — must reside in the same AWS region as the first entry in AWS_BEDROCK_REGIONS.
• Regional buckets (AWS_S3_REGIONAL_BUCKETS) — for multi-region deployments, one bucket per Bedrock region ensures each region reads and writes data locally. When using the Terraform module, these are created automatically.
• Lifecycle policies — the Terraform module applies a 1-day lifecycle policy to the temporary prefix as a failsafe. The application itself removes temporary files as soon as the operation completes, so files rarely remain beyond the duration of a single request.

S3 stores data within the AWS region where each bucket is created. Data does not leave that region unless you explicitly configure replication.

Logging¶

Application Logging¶

By default, stdapi.ai logs only request metadata — HTTP method, path, status code, execution time, and model identifier. Prompt and response content are never written to logs unless explicitly enabled.

Setting LOG_REQUEST_PARAMS=true enables full request/response payload logging. This is disabled by default and should remain disabled in production environments handling sensitive data. See Logging & Monitoring for details.

Amazon Bedrock Invocation Logging¶

Bedrock optionally supports invocation logging — recording model inputs and outputs to S3 or CloudWatch Logs. This feature is disabled by default on AWS. When enabled:

• S3 destination: objects are encrypted using SSE-KMS (CMK supported via key policy).
• CloudWatch destination: log group can be encrypted with a KMS CMK.
• Logging scope is configurable: metadata only, or including full prompt and completion content.

See Amazon Bedrock invocation logging for configuration details.

KMS Encryption¶

All data stored by stdapi.ai is encrypted at rest. The Terraform module automatically creates a Customer Managed Key (CMK) with a restrictive key policy and automatic annual rotation enabled.

For higher compliance needs, AWS KMS supports additional controls: custom key policies, crypto-shredding, multi-region keys, and CloudHSM-backed custom key stores for FIPS 140-3 Level 3 hardware-validated key storage.

AWS Security Hub, GuardDuty & DNS Firewall Integration¶

Security Hub Foundational Security Best Practices control mapping, GuardDuty Runtime Monitoring, and Route 53 Resolver DNS Firewall are infrastructure-level security controls, covered on the Authentication & Security page — see AWS Security Hub, GuardDuty & DNS Firewall Integration for the full module compliance mapping and configuration details.

Compliance Configuration Reference¶

Region-Specific Configuration¶

# Restrict Bedrock to EU regions
export AWS_BEDROCK_REGIONS=eu-west-1,eu-west-3,eu-central-1,eu-north-1

# Prevent Bedrock from using global profiles that could route outside the EU.
# Geography-pinned eu.* profiles are still used for failover within the EU.
export AWS_BEDROCK_CROSS_REGION_INFERENCE_GLOBAL=false

# S3 bucket in an EU region (must match the first entry in AWS_BEDROCK_REGIONS)
export AWS_S3_BUCKET=my-stdapi-eu-bucket

# Restrict Bedrock to US regions
export AWS_BEDROCK_REGIONS=us-east-1,us-west-2,us-east-2

# Prevent Bedrock from using global profiles that could route outside the US.
# Geography-pinned us.* profiles are still used for failover within the US.
export AWS_BEDROCK_CROSS_REGION_INFERENCE_GLOBAL=false

# S3 bucket in a US region
export AWS_S3_BUCKET=my-stdapi-us-bucket

# Restrict Bedrock to APAC regions
export AWS_BEDROCK_REGIONS=ap-northeast-1,ap-southeast-1,ap-southeast-2

# Prevent Bedrock from using global profiles that could route outside APAC.
# Geography-pinned apac.* profiles are still used for failover within APAC.
export AWS_BEDROCK_CROSS_REGION_INFERENCE_GLOBAL=false

# S3 bucket in an APAC region
export AWS_S3_BUCKET=my-stdapi-apac-bucket

US Law and Cloud Provider Obligations¶

AWS is incorporated and headquartered in the United States. Regardless of where your data is stored, AWS as a legal entity is subject to US law — including statutes with explicit extraterritorial reach. This section describes the statutes and the AWS commitments and technical controls that exist around them; it is not legal advice, and how these statutes apply to your data is a question for your own counsel.

CLOUD Act¶

The Clarifying Lawful Overseas Use of Data (CLOUD) Act, 2018 requires US-based cloud providers to produce customer data in response to a valid US law enforcement warrant or court order, even when the data is stored outside the United States. Content data requires a court-issued warrant establishing probable cause — the highest legal standard under US criminal procedure.

Key limits and AWS commitments (AWS CLOUD Act page):

• Challenge mechanism: AWS can file a motion to quash or modify requests that would require violating another country's laws, and preserves this right contractually.
• Customer notification: AWS's policy is to notify customers of government data requests unless prohibited by a court order (gag order).
• Zero cross-border content disclosures: AWS publicly reports that it has not disclosed enterprise or government content stored outside the US to the US government since it began reporting this metric in 2020.
• Administrative access controls: The AWS Nitro System restricts administrative access to customer workloads — including by AWS employees — a design validated by independent security audit (NCC Group).

FISA Section 702¶

Section 702 of the Foreign Intelligence Surveillance Act authorizes US intelligence agencies to compel US-based electronic communication service providers to deliver communications of non-US persons located outside the United States — without a per-target warrant. This authority was reauthorized in April 2024 and has no provider challenge mechanism equivalent to the CLOUD Act.

The encryption controls described on this page apply here as they do everywhere else: data stored by stdapi.ai is encrypted with a customer-managed KMS key (CMK) whose policy and grants you control, and whose usage is visible to you in CloudTrail (see KMS Encryption). Contractual protections, likewise, cannot override applicable US law. Whether a given combination of controls satisfies your obligations is a legal assessment to make with your own counsel.

Transfer Frameworks¶

EU — Data Privacy Framework and SCCs. The European Commission adopted the EU-US Data Privacy Framework (DPF) in July 2023, requiring proportionality constraints on US intelligence collection and establishing a Data Protection Review Court (DPRC) as a redress mechanism for EU individuals. AWS is certified under the DPF (AWS DPF page). A legal challenge by noyb is pending before the CJEU but has not resulted in invalidation as of this writing.

AWS also incorporates Standard Contractual Clauses (SCCs) into its Data Processing Addendum by default — providing a contractual transfer mechanism independent of the DPF. SCCs cannot override applicable US law, but they contractually bind AWS to notify customers of legal demands and challenge requests where legally permissible. Maintaining SCCs alongside the DPF is the recommended posture.

APAC and other regions. There is no unified bilateral transfer framework equivalent to the EU-US DPF for APAC jurisdictions. Enterprises typically rely on AWS contractual commitments, customer-managed encryption, and jurisdiction-specific legal analysis. AWS maintains local certifications (IRAP for Australia, ISMAP for Japan, K-ISMS for South Korea, MTCS for Singapore) relevant to respective regulatory environments.

Best Practices for High-Compliance Deployments¶

• Restrict all region settings to compliant regions — AWS_BEDROCK_REGIONS is the primary control; all services default to it, and any optional per-service override must stay within your target geography.
• Set AWS_BEDROCK_CROSS_REGION_INFERENCE_GLOBAL=false — stdapi.ai will then use geography-pinned inference profiles (us.*, eu.*, apac.*), whose destination region list AWS commits to keeping within the named geography.
• Opt out of AWS AI service improvement via an AWS Organizations policy — one-time console action covering Polly, Transcribe, Comprehend, and Translate.
• Use a CMK with a restrictive key policy — the Terraform module creates one by default, so the key policy, its grants and its CloudTrail usage records are yours to control. For stricter control: bring your own key, limit decrypt to the ECS task role, enable automatic rotation, crypto-shredding for right-to-erasure, or a CloudHSM-backed store for FIPS 140-3 Level 3.
• Confirm LOG_REQUEST_PARAMS is disabled (the default) in production — prompt and response content are then kept out of application logs entirely. If Bedrock invocation logging is enabled for audit purposes, configure a KMS CMK for the S3 or CloudWatch destination.
• Use AWS PrivateLink for Bedrock and S3 to keep service calls off the public internet, and enable TLS 1.3 on the ALB to activate post-quantum hybrid key exchange.
• Enable AWS CloudTrail in all configured regions to monitor API activity across Bedrock, S3, KMS, and AI services.
• Enable AWS Security Hub and GuardDuty on the account — deploy via the Terraform module and set compliance_vpc_endpoints_enabled=true, guardduty_vpc_endpoint_enabled=true, and dns_firewall_enabled=true (dedicated VPC only) to close the remaining FSBP gaps, support GuardDuty Runtime Monitoring, and block DNS resolution of known-malicious domains. See AWS Security Hub, GuardDuty & DNS Firewall Integration.
• EU users: maintain SCCs alongside the DPF — SCCs (included by default in the AWS Data Processing Addendum) provide a transfer mechanism independent of DPF validity and contractually bind AWS to challenge requests and notify you.

Regulated Industries¶

Healthcare (HIPAA)¶

Amazon Bedrock is a HIPAA-eligible service and is covered under the AWS Business Associate Agreement (BAA). For the current list of all HIPAA-eligible AWS services, see the AWS HIPAA Eligible Services Reference.

There is no stdapi.ai BAA to sign. stdapi.ai runs entirely within your AWS account — you are the data controller. Your existing AWS BAA with Amazon covers the underlying services. No separate agreement with stdapi.ai is required.

Recommended configuration for PHI workloads:

• Configure the AI services opt-out policy before processing any PHI through Polly, Transcribe, Comprehend, or Translate
• Restrict AWS_BEDROCK_REGIONS to regions covered by your BAA geography requirements
• Enable Bedrock invocation logging to a KMS-encrypted S3 bucket if audit trails are required by your compliance programme
• Confirm LOG_REQUEST_PARAMS is disabled (the default) so PHI never appears in application logs

Financial Services (SOC 2, PCI-DSS, GDPR)¶

Amazon Bedrock carries SOC 1/2/3, PCI-DSS, and GDPR certifications. See AWS Compliance Programs for the current list.

stdapi.ai itself does not process or store payment card data. Your PCI-DSS scoping decision is determined by what data your application sends to the gateway — not by the gateway itself.

For the legal context around cross-border data access under US law (CLOUD Act, FISA 702), the AWS commitments that apply, and the region and encryption controls available to you, see US Law and Cloud Provider Obligations.

Government / Public Sector (FedRAMP)¶

Amazon Bedrock has received FedRAMP Moderate and High authorization. See the AWS FedRAMP page and the FedRAMP Marketplace for current authorization status.

Restrict AWS_BEDROCK_REGIONS to US regions and set AWS_BEDROCK_CROSS_REGION_INFERENCE_GLOBAL=false so that inference is served only from US regions and US geography-pinned inference profiles.

Legal & Professional Services¶

Attorneys, consultants, accountants, and other professionals bound by confidentiality obligations cannot transmit client materials to third-party AI services. stdapi.ai runs inference on the AWS services and regions you enable — no third party sits between your users and your models, and the gateway contacts no vendor endpoint of its own choosing. The outbound paths that can exist are driven by your configuration or your own clients; see Application Data Flow. This makes it a workable basis for AI-assisted document review, contract analysis, and research where client confidentiality is non-negotiable.

Next Steps¶