Your data can stay in the UK
The first question we get asked about AI is almost always the same: where does our data end up? You choose. We deliver Claude through Amazon Bedrock, and for UK work that means processing in-region in London. If your policy says the EU instead, we build that. Either way your content is not stored by default, is never used to train models, and is not shared with the model provider.
Claude Opus 5, Sonnet 5 and Sonnet 4.6 run in-region on Amazon Bedrock in London (eu-west-2). Where you prefer EU processing instead, the EU inference profile keeps requests inside EU member-state regions: Frankfurt, Ireland, Paris, Milan, Spain, Stockholm.
Neither AWS nor Anthropic trains models on your content. On Amazon Bedrock that is part of the service; at Anthropic it is contractually excluded in the commercial terms.
Amazon Bedrock does not store inputs or outputs by default. The model provider has no access to your prompts and responses.
Encryption in transit and at rest, optionally with your own KMS keys. Every request is logged in AWS CloudTrail together with the region that processed it, so your auditors can verify.
What the architecture looks like
Three steps, no exceptions:
Your CRM, Microsoft Teams or line-of-business app sends the request, encrypted, to an AWS endpoint in London.
The model runs inside AWS infrastructure. For UK residency we invoke it in-region in London rather than through a cross-region profile, so the request has nowhere else to go. On the EU path, the EU inference profile is fixed to EU member-state regions. Traffic never crosses the public internet.
Inputs and outputs are not stored by default. CloudTrail records, for every request, which region processed it.
For projects with especially strict requirements we walk the architecture through with your data protection officer up front, including the data processing agreement and technical documentation.
What you can verify
Not promises: attestations and contracts you can check:
Amazon Bedrock: ISO 27001, 27017, 27018, 27701 and SOC 1/2/3. Anthropic: ISO 27001, ISO/IEC 42001 for AI management systems, and SOC 2 Type II.
Amazon Bedrock is in scope of AWS's C5 attestation, the cloud criteria catalogue of Germany's Federal Office for Information Security. Not a UK requirement, but a useful extra if you also operate in Germany.
Processing under Article 28 UK GDPR. The AWS data processing addendum forms part of the AWS Service Terms, and where a restricted transfer needs safeguards the UK Addendum to the standard contractual clauses is the instrument. Anthropic likewise provides API customers a Data Processing Addendum. We supply the documentation for your data protection officer.
Since January 2026 AWS additionally operates the independent European Sovereign Cloud, first region in Brandenburg, Germany, with Amazon Bedrock among the initial services. For sovereignty requirements, an option we evaluate together with you.
Two paths, depending on your requirements
Not every project has the same constraints. We build both:
For organisations with a hard residency requirement. In-region processing in London for UK data, or EU regions if that is what your policy says. No storage by default, no model-provider access to your content.
For projects without a residency requirement. Contractually no training on your data, automatic deletion of inputs and outputs within 30 days, DPA with standard contractual clauses. Zero-data-retention arrangements are available for qualifying customers. Processing takes place in the US among other locations.
Honesty is part of the offer: not every newly released Claude model reaches every region on day one. We confirm which models are available in London, or in the EU regions, at project start and put it in writing.
What about the EU AI Act?
The EU AI Act does not apply in the UK. It reaches you the moment you sell into the EU: since 2 February 2025, Article 4 requires organisations placing AI systems on the EU market, or whose AI output is used there, to ensure a sufficient level of AI literacy among the staff who operate those systems. It mandates no specific certification or licence, and demonstrable measures such as training are the usual way to meet the duty.
Our UK legal guide sets out what actually applies here, from UK GDPR and the DUAA 2025 to the advertising and sector rules, and where the EU AI Act starts to bite if you sell into Europe. If you want to address the literacy duty in a structured way, our Claude-certified architects train your team.
What this website itself does
Transparency is part of it. The AI assistant on this website currently runs on Anthropic's Claude API under its commercial terms: no training on your input, automatic deletion of inputs and outputs within 30 days. Please do not enter personal or confidential data there; a general description of your business is all the analysis needs.
Client solutions are built to the stricter standard above. Which architecture applies is your decision.
The questions companies ask us
Not unless you want it to. Invoked in-region in London, the request is processed in eu-west-2 and nowhere else. If you choose EU processing instead, requests stay inside EU member-state regions, which is a permitted transfer: the UK recognises the EEA as providing adequate protection.
No. On Amazon Bedrock, Anthropic has no access to prompts and responses. And on the Claude API, Anthropic's commercial terms exclude training on customer content.
Not by default on Amazon Bedrock. On the Claude API, inputs and outputs are automatically deleted within 30 days; zero-data-retention arrangements are available for qualifying customers.
Yes. The AWS data processing addendum under Article 28 UK GDPR is part of the AWS Service Terms, with the UK Addendum to the standard contractual clauses where a restricted transfer needs it, and Anthropic provides API customers a Data Processing Addendum as well. We supply the technical documentation for your data protection officer.
Yes. Every request is logged in AWS CloudTrail together with its processing region. On top of that sit the attestations: ISO 27001 and SOC 2 at AWS for Amazon Bedrock, ISO 27001 and ISO/IEC 42001 at Anthropic.
No. There is no UK requirement for an AI certification. If you sell into the EU, Article 4 of the EU AI Act asks for proportionate AI-literacy measures such as training, but no specific certification or licence. We help you implement it pragmatically and verifiably.
Talk to us about your requirements
Tell us your data protection and data residency constraints. You get a clear architecture recommendation and the documentation for your data protection officer before any project starts.