Get the New State of AI & API Security Report (H1 2026)

Notification of Expanded Use of AWS as Subprocessor FAQ

Effective: June, 2025

1. Does this change the location of the data center pair for my customer instance?

No, this update does not impact the location of your data center pair, which remains as previously agreed. We will continue to adhere to all contractual requirements regarding the storage location of data.

2. What type of data does Amazon Bedrock process?

Amazon Bedrock processes the following types of data:

  • Prompts and generated content. Prompts are submitted by the customer via the Salt Security Platform, and content is generated by the service, via the completions, chat completions, images and embeddings operations.
  • Augmented data included with prompts. The service retrieves relevant data from a configured data store and augments the prompt to produce generations that are grounded with data from the Salt Security Platform.
  • Training & validation data. Salt has provided training data consisting of prompt-completion pairs for the purposes of fine tuning the models in Salt’s specific instance of the Amazon Bedrock service.

3. Why is Salt expanding its use of AWS now?

We are expanding our use of AWS to include Amazon Bedrock in order to support new Generative AI capabilities, including the ability for customers to ask free text questions about their entire dataset—such as API inventory and security posture. This enhancement is designed to improve usability, accelerate insights, and help customers take action more efficiently.

4. Is my data shared with other Salt customers?

No. Your customer data is not available to other customers.

5. Is my data shared by AWS with foundation model developers?

No. When using Amazon Bedrock, your data is not shared with the foundation model providers (such as AI21 Labs, Amazon, Anthropic, Cohere, Meta, Mistral AI, and others). Bedrock is designed to keep customer data isolated and secure—your inputs, outputs, and any related interactions are not used to train the foundation models and are not accessible to the model providers. AWS does not share customer content with third parties without your consent.

6. Is my data used to improve Amazon Bedrock models or AWS or third party products or services?

No. Your data is not used to improve Amazon Bedrock models, nor is it used to improve AWS or third party products or services.

7. How is my customer data used to improve Amazon Bedrock models?

We have not used customer data to improve or train Amazon Bedrock models. We’ve relied solely on non-customer data to train the Amazon Bedrock models.

8. How does Amazon Bedrock process customer data?

Amazon Bedrock processes customer data in three primary ways:

  • Generating content from prompts using Amazon Bedrock service.
  • Creating fine-tuned (custom) models with training data provided by Salt.
  • Analyzing prompts, completions, and images for harmful content or violations of product terms using automated abuse detection mechanisms.

9. What security and compliance standards does Salt’s use of Amazon Bedrock support?

Salt leverages Amazon Bedrock in a way that aligns with rigorous security and compliance standards. Amazon Bedrock is in scope for several industry-recognized certifications and frameworks, including SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, HIPAA eligibility, and GDPR compliance. It is also CSA STAR Level 2 certified, reflecting adherence to cloud security best practices. Importantly, customer content processed through Amazon Bedrock is not used to improve the underlying foundation models and is not shared with model providers. AWS supports secure connectivity options such as AWS PrivateLink, allowing Salt to maintain private, encrypted connections to Bedrock without exposing data to the public internet

10. I have additional questions or want more information. Who should I talk to?

Additional questions can be sent to privacy@salt.security or your designated account executive.

11. Can I opt out of this service?

Yes, customers can opt out by contacting your designated account executive or contacting us at privacy@salt.security.

We appreciate your continued trust in us as we strive to improve our services and provide you with the best possible experience.