AWS classifies customer data into two categories: customer content and account information.

We define customer content as software (including machine images), data, text, audio, video or images that a customer or any end user transfers to us for processing, storage or hosting by AWS services in connection with that customer's account and any computational results that a customer or any end user derives from the foregoing through their use of AWS services. For example, customer content includes content that a customer or any end user stores in Amazon Simple Storage Service. Customer Content does not include account information, which we describe below. The terms of the AWS Customer Agreement or other agreement with us governing the use of AWS services apply to your customer content.

We define account information as information about a customer that a customer provides to us in connection with the creation or administration of a customer account. For example, account information includes names, usernames, phone numbers, email addresses and billing information associated with a customer account. The information practices described in the AWS Privacy Notice apply to account information.

Customers maintain ownership of their customer content and select which AWS services process, store and host their customer content. We do not access or use customer content for any purpose other than as legally required and for maintaining the AWS services and providing them to our customers and their end users. We never use customer content or derive information from it for marketing or advertising.

Customers control their customer content. With AWS, customers:

• Determine where their customer content will be stored, including the type of storage and geographic region of that storage.

• Choose the secured state of their customer content. We offer customers strong encryption for customer content in transit or at rest, and we provide customers with the option to manage their own encryption keys.

• Manage access to their customer content and AWS services and resources through users, groups, permissions and credentials that customers control.

We know that customers care how account information is used, and we appreciate customers' trust that we will do so carefully and sensibly. The AWS Privacy Notice describes how we collect and use account information.

We are vigilant about our customers' privacy. We do not disclose customer content unless we're required to do so to comply with the law or a valid and binding order of a governmental or regulatory body. Governmental and regulatory bodies need to follow the applicable legal process to obtain valid and binding orders, and we review all orders and object to overbroad or otherwise inappropriate ones. Unless prohibited from doing so or there is clear indication of illegal conduct in connection with the use of Amazon products or services, Amazon notifies customers before disclosing customer content so they can seek protection from disclosure. It's also important to point out that our customers can encrypt their customer content, and we provide customers with the option to manage their own encryption keys.

We know transparency matters to our customers, so we regularly publish a report about the types and volume of information requests we receive here.

Customers choose the region(s) in which their customer content will be stored, allowing them to deploy AWS services in the location(s) of their choice, in accordance with their specific geographic requirements. AWS datacenters are built in clusters in various regions around the globe.

For example, an AWS customer in Australia can choose to deploy its AWS services exclusively in the Asia Pacific (Sydney) region and store its content onshore in Australia. If the customer make this choice, its customer content will be located in Australia. Customers can replicate and back up their customer content in more than one region, and we will not move or replicate customer content outside of the customer's chosen region(s), except as legally required and as necessary to maintain the AWS services and provide them to our customers and their end users.

*All AWS services may not be available in all regions.

When evaluating the security of a cloud solution, it is important for customers to understand and distinguish between:

• Security measures that AWS implements and operates  - "security of the cloud"

and

• Security measures that customers implement and operate, related to the security of their customer content and applications that make use of AWS services - "security in the cloud"

For a complete list of all the security measures built into our core AWS cloud infrastructure, platforms and services, please read our Overview of Security Processes Whitepaper.

Security of our customers' data is our number one priority, and AWS has already obtained approval from EU data protection authorities, known as the Article 29 Working Party, of the AWS Data Processing Addendum and Model Clauses to enable transfer of data outside Europe, including to the U.S. With our EU-approved Data Processing Addendum and Model Clauses, AWS customers can continue to run their global operations using AWS in full compliance with EU law. The AWS Data Processing Addendum is available to all AWS customers that are processing personal data whether they are established in Europe or a global company operating in the European Economic Area. For additional information, please visit the AWS EU Data Protection FAQ.

For more information on how customers can enter into the AWS Data Processing Addendum, please visit here (sign-in required).

AWS’s alignment with ISO 27018 has been validated by an independent third party assessor. ISO 27018 is the first International code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance on ISO 27002 controls applicable to Personally Identifiable Information (PII) processed by public cloud service providers. This demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content. For more information, please visit the AWS ISO 27018 FAQ.

We have developed a security assurance program using additional global privacy and data protection best practices in order to help customers establish, operate and leverage our security control environment. These security protections and control processes are independently validated by multiple third-party independent assessments.

Recently, the European Commission and the US Government agreed on a new framework called the EU-US Privacy Shield, and on July 12, the European Commission formally adopted it. The EU-US Privacy Shield replaces Safe Harbor. Amazon Web Services (AWS) welcomes this new framework for transatlantic data flow.

To learn more about this topic in the context of AWS, visit our EU-US Privacy Shield page.