Loading the catalogue…
Amazon Bedrock
L0 · Third-country operator
amazon-bedrockUnited StatesEurope
Amazon Bedrock is AWS's managed inference service. Traffic routed through Stav stays in AWS's EU regions, either Stockholm alone or several EU regions depending on the model; AWS is a US company, so the US CLOUD Act applies.
Compliance posture · Stav's assessment
Jurisdiction
US · United States
Data residency
EU
CLOUD Act / FISA 702
Exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Adequate
Legal exposure
Poor
Serving retention
Adequate
Security posture
Weak
Contractual posture
Adequate
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 4 risk items · 6 safeguards · 3 privacy-policy issues · DPA, sub-processor list, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 26 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L0Third-country operatorIndicativeregistry 4.3
This level applies to traffic routed through Stav.
L0 on the Sovereignty Ladder. To reach L1, it needs: no coerced vulnerability silence. US legal process reaches the operator through its group.
2 criteria from L1: Infrastructure in the Union, No coerced vulnerability silence.
Stav's own assessment against criterion registry 4.3. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 26 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
ISO/IEC 27001
Information security management system (AWS services and Regions in scope per certificate) · Claimed by the provider
ISO/IEC 27017
Cloud-specific information security controls · Claimed by the provider
ISO/IEC 27018
Protection of personally identifiable information (PII) in public clouds · Claimed by the provider
ISO/IEC 27701
Privacy information management; covers Amazon Bedrock (excludes Amazon Bedrock Marketplace) · Current
ISO 22301
Business continuity management; covers Amazon Bedrock (excludes Amazon Bedrock Marketplace) · Current
ISO/IEC 20000-1
IT service management; covers Amazon Bedrock (excludes Amazon Bedrock Marketplace) · Current
CSA STAR Level 2
Cloud Security Alliance STAR certification, cited as covering Amazon Bedrock · Claimed by the provider
SOC 2 Type II
Security, Availability, Confidentiality & Privacy Trust Services Criteria across in-scope AWS services (including Bedrock's underlying infrastructure) · Claimed by the provider
ISO 9001:2015
Quality management; covers Amazon Bedrock (excludes Amazon Bedrock Marketplace) · Current
CSA STAR (CCM v4.0)
Cloud security best-practice self-assessment/certification; Amazon Bedrock is CSA STAR Level 2 certified · Current
SOC 1, SOC 2, SOC 3
Service Organization Control reports for security, availability and confidentiality; Amazon Bedrock is listed in scope (excludes Amazon Bedrock Marketplace) · Current
SOC 3
Public summary of the SOC 2 report and auditor's opinion · Claimed by the provider
FedRAMP High
US federal authorization to operate, cited as covering Amazon Bedrock · Claimed by the provider
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listpublished
Links to every document and certificate — 4 legal documents, 13 certification sources
Compiled by Stav from the provider's published documentation. Last verified 27 Sept 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 10
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| Claude Haiku 5.5 | €0.10 | €0.50 | 0.91 s | 431 |
| Claude Sonnet 5.5 | €2.00 | €9.98 | 0.85 s | 264 |
| Claude Opus 5.5 | €3.99 | €19.96 | 1.12 s | 177 |
| Claude Opus 5 | €4.99 | €24.96 | 1.22 s | 253 |
| Claude Opus 5 | €4.99 | €24.96 | 1.39 s | 231 |
| Claude Sonnet 5 | €2.00 | €9.98 | 1.35 s | 331 |
| Claude Sonnet 5 | €2.00 | €9.98 | 1.59 s | 353 |
| deepseek-v3.2 | €0.67 | €2.01 | 0.64 s | 69 |
| Claude Haiku 4.5 | €1.00 | €4.99 | 0.70 s | 384 |
| qwen3-235b-a22b-instruct-2507 | €0.20 | €0.80 | 0.52 s | 127 |