At AWS, customer trust is our top priority. We deliver services to more than one million active customers, including enterprises, educational institutions, and government agencies in over 190 countries. Our customers include financial services providers, healthcare providers, and governmental agencies, who trust us with some of their most sensitive information.
We know customers care deeply about privacy and data security. That’s why AWS gives customers ownership and control over their customer content by design through simple, but powerful tools that allow customers to determine where their customer content will be stored, secure their customer content in transit or at rest, and manage access to AWS services and resources for their users. We also implement responsible and sophisticated technical and physical controls designed to prevent unauthorized access to or disclosure of customer content.
Maintaining customer trust is an ongoing commitment, we strive to inform customers of the privacy and data security policies, practices and technologies we’ve put in place. These commitments include:
Ownership and Control of customer content:
- Access: Customers manage access to their customer content and AWS services and resources. We provide an advanced set of access, encryption, and logging features to help you do this effectively (such as AWS CloudTrail). We do not access or use customer content for any purpose without the customer’s consent.
- Storage: Customers choose the region(s) in which their customer content will be stored. We will not move or replicate customer content outside of the customer’s chosen region(s) without the customer’s consent.
- Security: Customers choose how their customer content is secured. We offer our customers strong encryption for customer content in transit or at rest, and we provide customers with the option to manage their own encryption keys.
- Disclosure of customer content: We do not disclose customer content unless we’re required to do so to comply with the law or a valid and binding order of a governmental or regulatory body. Unless prohibited from doing so or there is clear indication of illegal conduct in connection with the use of Amazon products or services, Amazon notifies customers before disclosing customer content so they can seek protection from disclosure.
- Security Assurance: We have developed a security assurance program using global privacy and data protection best practices in order to helping customers establish, operate and leverage our security control environment. These security protections and control processes are independently validated by multiple third-party independent assessments.
How does AWS define customer content?
AWS classifies customer data into two categories: customer content and account information.
We define customer content as software (including machine images), data, text, audio, video or images that a customer or any end user transfers to us for processing, storage or hosting by AWS services in connection with that customer's account and any computational results that a customer or any end user derives from the foregoing through their use of AWS services. For example, customer content includes content that a customer or any end user stores in Amazon Simple Storage Service. Customer Content does not include account information, which we describe below. The terms of the AWS Customer Agreement or other agreement with us governing the use of AWS services apply to your customer content.
We define account information as information about a customer that a customer provides to us in connection with the creation or administration of a customer account. For example, account information includes names, usernames, phone numbers, email addresses and billing information associated with a customer account. The information practices described in the AWS Privacy Notice apply to account information.
Who owns customer content?
Customers maintain ownership of their customer content and select which AWS services process, store and host their customer content. We do not access or use customer content for any purpose without the customer’s consent. We never use customer content or derive information from it for marketing or advertising.
Who controls customer content?
Customers control their customer content. With AWS, customers:
• Determine where their customer content will be stored, including the type of storage and geographic region of that storage.
• Choose the secured state of their customer content. We offer customers strong encryption for customer content in transit or at rest, and we provide customers with the option to manage their own encryption keys.
• Manage access to their customer content and AWS services and resources through users, groups, permissions and credentials that customers control.
What about account information?
We know that customers care how account information is used, and we appreciate customers' trust that we will do so carefully and sensibly. The AWS Privacy Notice describes how we collect and use account information.
What happens when AWS receives a legal request for customer content?
We are vigilant about our customers' privacy. We do not disclose customer content unless we're required to do so to comply with the law or a valid and binding order of a governmental or regulatory body. Governmental and regulatory bodies need to follow the applicable legal process to obtain valid and binding orders, and we review all orders and object to overbroad or otherwise inappropriate ones. Unless prohibited from doing so or there is clear indication of illegal conduct in connection with the use of Amazon products or services, Amazon notifies customers before disclosing customer content so they can seek protection from disclosure. It's also important to point out that our customers can encrypt their customer content, and we provide customers with the option to manage their own encryption keys.
We know transparency matters to our customers, so we regularly publish a report about the types and volume of information requests we receive here.
Where will customer content be stored?
Customers choose the region(s) in which their customer content will be stored, allowing them to deploy AWS services in the location(s) of their choice, in accordance with their specific geographic requirements. AWS datacenters are built in clusters in various regions around the globe.
For example, an AWS customer in Australia can choose to deploy its AWS services exclusively in the Asia Pacific (Sydney) region and store its content onshore in Australia. If the customer makes this choice, its customer content will be located in Australia. Customers can replicate and back up their customer content in more than one region, and we will not move or replicate customer content outside of the customer's chosen region(s) without the customer’s consent.
*All AWS services may not be available in all regions.
What is the customer's role in securing their content?
When evaluating the security of a cloud solution, it is important for customers to understand and distinguish between:
• Security measures that AWS implements and operates - "security of the cloud"
• Security measures that customers implement and operate, related to the security of their customer content and applications that make use of AWS services - "security in the cloud"
For a complete list of all the security measures built into our core AWS cloud infrastructure, platforms and services, please read our Overview of Security Processes Whitepaper.
Now that the EU-U.S. Safe Harbour program has been ruled invalid, can customers still use AWS and comply with EU law?
Security of our customers' data is our number one priority, and AWS has already obtained approval from EU data protection authorities, known as the Article 29 Working Party, of the AWS Data Processing Addendum and Model Clauses to enable transfer of data outside Europe, including to the U.S. With our EU-approved Data Processing Addendum and Model Clauses, AWS customers can continue to run their global operations using AWS in full compliance with EU law. The AWS Data Processing Addendum is available to all AWS customers that are processing personal data whether they are established in Europe or a global company operating in the European Economic Area. For additional information, please visit the AWS EU Data Protection FAQ.
For more information on how customers can enter into the AWS Data Processing Addendum, please visit here (sign-in required).
What steps does AWS take to protect customer privacy?
AWS’s alignment with ISO 27018 has been validated by an independent third party assessor. ISO 27018 is the first International code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance on ISO 27002 controls applicable to Personally Identifiable Information (PII) processed by public cloud service providers. This demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content. For more information, please visit the AWS ISO 27018 FAQ.
We have developed a security assurance program using additional global privacy and data protection best practices in order to help customers establish, operate and leverage our security control environment. These security protections and control processes are independently validated by multiple third-party independent assessments.
EU-US Privacy Shield
Recently, the European Commission and the US Government agreed on a new framework called the EU-US Privacy Shield, and on July 12, the European Commission formally adopted it. The EU-US Privacy Shield replaces Safe Harbor. Amazon Web Services (AWS) welcomes this new framework for transatlantic data flow.
To learn more about this topic in the context of AWS, visit our EU-US Privacy Shield page.