SVENNISAIWhere your data sits, layer by layer
The first question we hear about AI is where the data ends up, and the answer has layers. The agents we build run on Amazon Bedrock in London, with no storage by default and no training on your content. Anthropic stores Claude Team and Enterprise data in the United States and may process it in the US, Europe, Asia or Australia.
Book a 30-minute call · with a Claude Certified Architect from our team.
- Where does the agent run?In your own AWS account, in Amazon's London data centre. The offer names the exact Claude model and confirms the region; if your policy says the EU instead, we set that.
- Is our data used to train AI?No, by contract, at both Amazon and Anthropic. Claude Pilot B sets your company up on Claude Team or Enterprise, whose terms prohibit it. Pro and Max are personal plans and are not used for business data.
- Is it kept?Not by the agent, unless you ask for it to be. The staff's Team seats keep their chat history under Anthropic's commercial terms, in the United States.
- Can we check?Yes. Every request the agent makes is logged with the place that processed it, and the certificates behind Amazon and Anthropic are listed below for your IT team.
Where your data sits, in one table
Three layers, and the people behind each. Anthropic stores Claude Team data in the US; the agents and connectors we build run in London, in your own AWS account. Our engineers work under a written processing agreement, and your IT team can keep this table.
| Layer | What data | Who processes it | Where | Under what |
|---|---|---|---|---|
| Claude Team or Enterprise seats | What your staff type, and the folders and connectors they switch on | Anthropic Ireland, Limited, under your company's own account. Pilot B and Claude Team Adoption work on Claude Team or Enterprise seats, Anthropic's plans for companies. | Anthropic stores the data in the United States and may process it in the US, Europe, Asia or Australia. There is no UK-only option for seats today. | Anthropic's commercial terms, which prohibit training on your content, and its data processing addendum, which includes the UK Addendum; a transfer risk assessment drafted for you to adopt, on request |
| The connectors we run | Only what passes between your ledger or CRM and the agent | Svennis Cloud Solutions Ltd | London, Amazon Web Services eu-west-2, the same region as the agent | Our processing agreement; the list of every company that touches the data, on request |
| The AI agent on Claude | The records of the one process it runs | Runs on Amazon Bedrock in your own AWS account, where AWS bills you for the usage; Svennis Cloud Solutions Ltd builds and maintains it under our processing agreement. Our account only if you have no AWS presence and ask for it. | London (eu-west-2). Claude Opus 5.5 is served in the region, so inference runs in the UK; Sonnet 5.5 and Haiku 5.5 reach London through EU cross-region inference, processed within Europe (AWS region table, read 10 October 2026). Google Cloud's London region where you prefer it. | Your AWS customer agreement and its data processing addendum; our processing agreement with the sub-processors listed; CloudTrail logs the region of every request |
| Engineering | Access during the build and operations, under your instructions | Svennis Cloud Solutions S.R.L., Cluj-Napoca and Satu Mare | Romania, an EEA country the UK treats as adequate for data transfers | Written processing agreement between the UK company and the Romanian one, available before kickoff |
For accountancy practices, solicitors and anyone holding client files
Xero's own connector for Claude, listed in Anthropic's directory, reads but does not write. You choose which organisation and which data it may read when it is connected. Client folders are shared with Claude only if you name them on the pilot's checklist.
We set Claude up on Team or Enterprise seats only, under Anthropic's commercial terms. Pro and Max are consumer plans and carry no client data. The company's AI policy, written in Claude Pilot B, says which client data may go into Claude and which may not.
Writing invoices or bills into the ledger is agent work. We do it with a connector or MCP server we build, running in London, not through the read-only Xero connector. Our engineers see client data only during the build and support, on your instructions, under the written processing agreement.
That agreement between the UK company and the Romanian one is available before you sign, with the list of every company that touches the data.
Who is responsible for your data, and how to complain
For the details you give us as a visitor or a client contact, Svennis Cloud Solutions Ltd is the controller under data protection law. For an agent we build for you, your company stays responsible for its data. We handle it only on your instructions, under a written processing agreement.
Svennis Cloud Solutions S.R.L. in Romania does the engineering under that agreement. Romania is in the European Economic Area, which UK law treats as adequate for data transfers.
If you think we have mishandled your personal data, use our contact form or write to us at the registered office in Manchester. We acknowledge within 30 days, look into it without undue delay, keep you updated and tell you the outcome. You can also complain to the Information Commission (formerly the ICO), the UK data regulator.
What the architecture looks like
Three steps, no exceptions:
Your CRM, Microsoft Teams or line-of-business app sends the request, encrypted, to an AWS endpoint in London.
The model runs inside AWS infrastructure, and traffic never crosses the public internet. For UK residency we invoke it in-region in London rather than through a cross-region profile. On the EU path, the EU inference profile is fixed to EU member-state regions.
Inputs and outputs are not stored by default. CloudTrail records, for every request, which region processed it.
For projects with especially strict requirements we walk the architecture through with your data protection officer up front, including the data processing agreement and technical documentation.
What you can verify
Not promises: attestations and contracts you can check:
Amazon Bedrock: ISO 27001, 27017, 27018, 27701 and SOC 1/2/3. Anthropic: ISO 27001, ISO/IEC 42001 for AI management systems, and SOC 2 Type II.
We handle your data as your processor under Article 28 of the UK GDPR. Where data leaves the UK, the UK Addendum covers the transfer, and both Amazon's and Anthropic's data processing terms include it. We supply the documentation for your data protection officer, or for whoever looks after it in a smaller firm.
Two paths, depending on your requirements
Not every project has the same constraints. Claude Pilot A runs on the first path by default, in your own AWS account in London; the second is used only if you ask for it.
For organisations with a hard residency requirement. On Bedrock in London (read 10 Oct 2026), Opus 5.5 runs in-region; Sonnet 5.5 and Haiku 5.5 may be processed elsewhere in Europe. If you want everything inside the EU, requests stay in EU countries, and the offer names the model and the region.
For projects without a residency requirement: no training on your data by contract, and inputs and outputs deleted automatically within 30 days. Processing takes place in the US among other locations, under a data processing addendum with standard contractual clauses. Zero-data-retention arrangements are available for qualifying customers.
Honesty is part of the offer: not every newly released Claude model reaches every region on day one. We confirm which models are available in London, or in the EU regions, at project start and put it in writing.
Which AI law applies in the UK?
There is no UK AI Act, and the EU AI Act is EU law, not UK law. For a UK company using Claude, the rules that apply are UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
Articles 22A to 22D of the UK GDPR cover decisions made by automated means, and the ICO is the regulator. Our UK legal guide sets out what applies here, from UK GDPR and the DUAA 2025 to the advertising and sector rules.
Training your team to use Claude well is good practice rather than a legal certificate. A Claude Certified Architect from our team runs it in Claude Team Adoption and in every Department Activation sprint.
What this website itself does
Transparency is part of it. The AI assistant on this website currently runs on Anthropic's Claude API under its commercial terms: no training on your input, automatic deletion of inputs and outputs within 30 days. Please do not enter personal or confidential data there; a general description of your business is all the analysis needs.
Client solutions are built to the stricter standard above. Which architecture applies is your decision.
The questions companies ask us
Does our data leave the UK?
Not unless you want it to. Opus 5.5 invoked in-region in London is processed in eu-west-2 and nowhere else, and the offer names the model. EU processing is a permitted transfer, because the UK recognises the EEA as adequate.
Does Anthropic train on our data?
No. On Amazon Bedrock, Anthropic has no access to prompts and responses. And on the Claude API, Anthropic's commercial terms exclude training on customer content.
Are our prompts stored?
Not by default on Amazon Bedrock. On the Claude API, inputs and outputs are automatically deleted within 30 days; zero-data-retention arrangements are available for qualifying customers.
Do we get a data processing agreement?
Yes: AWS's data processing addendum under Article 28 UK GDPR is part of its Service Terms, with the UK Addendum where a restricted transfer needs it. Anthropic provides API customers with a Data Processing Addendum too. We supply the technical documentation for your data protection officer or IT adviser.
Can we verify this independently?
Yes. Every request is logged in AWS CloudTrail together with its processing region. On top of that sit the attestations: ISO 27001 and SOC 2 at AWS for Amazon Bedrock, ISO 27001 and ISO/IEC 42001 at Anthropic.
Do our employees need an AI certification?
No. There is no UK requirement for an AI certification, and there is no UK AI Act. Training your team is good practice, and it is part of Claude Team Adoption and Department Activation.
Talk to us about your requirements
Tell us where your data may and may not go. You get a clear recommendation and the documentation for your data protection officer or IT adviser before any project starts.
Prefer to call? +44 7588 772736 · Not ready to talk? See it on your business first.
- 1Time
- 2Details
- 3Booked