Azure OpenAI vs Amazon Bedrock for private deployments
Azure OpenAI vs Amazon Bedrock for private deployments: data retention settings, abuse monitoring opt-outs, isolation, regions and what each provider can see.
Azure OpenAI vs Amazon Bedrock for private deployments#
Azure OpenAI and Amazon Bedrock both keep your prompts away from the companies that build the models: Microsoft states your prompts "are NOT available to OpenAI," and AWS states model providers "don't have access to Amazon Bedrock logs or to customer prompts and completions." The biggest difference is retention control. On Bedrock you set retention yourself with one API call per Region and can lock it with an organization policy. On Azure, abuse monitoring stores some prompts for possible human review by default, and turning that off means applying to Microsoft for modified abuse monitoring.
Every statement below comes from Microsoft Learn and AWS documentation, read on 2026-10-15. Microsoft now files Azure OpenAI under "Foundry Models sold by Azure," and its documentation uses that name.
Side by side#
| Question | Azure OpenAI (Foundry Models sold by Azure) | Amazon Bedrock |
|---|---|---|
| Who runs the model | Microsoft, in its Azure environment. The models "do NOT interact with any services operated by" their providers, such as the OpenAI API | AWS, in a Model Deployment Account per provider per Region, "owned and operated by the Amazon Bedrock service team" |
| Can the model maker see prompts | No, per Microsoft | No, per AWS: "Model providers don't have any access to those accounts" |
| Training on your prompts | Not used to train generative AI foundation models "without your permission or instruction" | Model providers do not receive your content; the AWS pages cited here do not address training, so check the AWS Service Terms |
| Default retention | Abuse monitoring may store sampled prompts and completions for human review | Depends on the model; inherit falls back to each model's default |
| Turning retention off | Apply for modified abuse monitoring under Limited Access eligibility criteria | Set data_retention_mode to none yourself |
| How you verify | ContentLogging shows false in the resource JSON | GET the data_retention endpoint, and read each model's allowed_modes |
| Who does human review | Authorized Microsoft employees, on flagged content | AWS, for models whose provider requires it (aws_review) |
| Network isolation | Private endpoints, with public network access disabled | VPC interface endpoints with AWS PrivateLink |
| Processing location options | Global, Data Zone (US, EU, APAC) or a single Azure geography | A single Region, geographic cross-Region inference, or global cross-Region inference |
Data retention settings#
Amazon Bedrock gives you a mode instead of an on/off switch, set per Region at the account level or per project. The modes run from least to most permissive: none, default, aws_review, and a legacy provider_data_share. Under none, "no request or response data is written to durable storage by AWS or shared with the model provider," and on the Responses API store=true is rejected. Under default, the model's own retention policy applies and "AWS may retain the data for safety and abuse-prevention purposes." Under aws_review, prompts and completions stay "within the AWS boundary for up to 30 days" and AWS may review them.
You can enforce none across an AWS organization with a Service Control Policy that denies any retention change to another mode. AWS states this ensures "no inference data is ever retained." The setting does not carry across Regions: a Region you have not configured stays at inherit.
The catch is model availability. Some models require retention. AWS lists Claude Fable 5 and Claude Fable 5.1 as requiring aws_review, so they show as unavailable to an account set to none or default. For most OpenAI models on Bedrock, AWS keeps classifier-flagged traffic up to 30 days, and eligible customers "may request full ZDR through their AWS account team."
Azure OpenAI describes the models as stateless: "no prompts or completions are stored in the model." Storage comes from features you choose. The Responses API, Assistants threads, stored completions, the Files API, vector stores and batch jobs all keep data. Microsoft states that this data sits "at rest in the Foundry resource in the customer's Azure tenant, within the same geography as the resource," is encrypted with AES-256 by default with an option for a customer-managed key, and "can be deleted by the customer at any time."
Abuse monitoring and the opt-out#
Azure runs content classifiers on every prompt and completion and looks for patterns of misuse. When something is flagged, it may be sampled for review. By default an AI model does that review, and Microsoft states those prompts and completions "are not stored by the abuse monitoring system." When automated review falls short, authorized Microsoft employees may look at flagged content through Secure Access Workstations with just-in-time approval. For deployments in the European Economic Area, those employees are in the EEA. The two Microsoft Learn pages cited here do not state how long the human-review store keeps data, so ask your Microsoft account team.
To switch off storage and human review, you apply for modified abuse monitoring. Microsoft offers it to customers "who meet additional Limited Access eligibility criteria," and notes that some advanced models have stricter criteria. Approval removes storage and human review. Automated review still runs, and Microsoft may limit access if it detects severe or recurring abuse. Once approved, you confirm it yourself: a ContentLogging capability appears with the value false in the Azure portal JSON view or in az cognitiveservices account show.
Bedrock describes "a zero operator access (ZOA) data security model," subject to model-specific abuse detection. AWS adds: "Retained inputs and outputs are stored and processed by AWS and are not shared with third-party model providers."
Isolation: who can see what#
Both clouds put a wall between your prompts and the model maker. The open question is how much the cloud provider itself sees.
- Microsoft sees prompts when its abuse systems flag them, and through human review unless you hold modified abuse monitoring. OpenAI does not see them.
- AWS sees prompts when a model or your setting requires retention, and reviews them under
aws_review. The model provider does not see them under any current mode: AWS states that sharing content with model providers "is not supported today."
At the network layer, Microsoft's guide sets "Allow access from" to Disabled so that "private endpoint connections will be the exclusive way to access this resource." AWS recommends a VPC "so that your data isn't available over the internet," with an interface endpoint through AWS PrivateLink.
Regions and data residency#
Azure offers three processing scopes. Global deployments may process data in any Azure region. Data Zone deployments stay within the US, the EU or Asia Pacific. Standard and Regional Provisioned deployments keep processing within the Azure geography you choose. Across all types, Microsoft states that "data stored at rest remains in the designated Azure geography." Two details matter for residency: Microsoft "can add regions to either data zone without prior notice," and batch jobs are a Global or Data Zone type. You can block a deployment type, such as GlobalStandard, with Azure Policy.
Bedrock processes in the Region you call unless you use cross-Region inference. Geographic profiles keep processing inside a geography such as the US or EU. Global profiles route to "any supported AWS commercial Region worldwide," at about 10% lower cost. AWS states that cross-Region traffic "remains on the AWS network and does not traverse the public internet," and CloudTrail records the Region that processed each request in additionalEventData.inferenceRegion. If a model retains data, it is stored in the Region that processed the request.
What neither provider covers#
Both providers secure the model layer, and both hand the rest to you. AWS states it in its shared responsibility model: "You are responsible for maintaining control over your content that is hosted on this infrastructure." Your application, your logs, your connectors to email and documents, and the people who run them sit on your side of that line. Bedrock's model invocation logging is "disabled by default," and once you enable it, full prompts and responses stay in your CloudWatch or S3 "until the logging configuration is deleted." A retention setting at the model does nothing about a log you write yourself.
For the staffing and upkeep side of that choice, see building private AI in house vs. a done-for-you service.
Where Mitosis Labs fits#
Mitosis Labs runs Private SuperIntelligence, an AI concierge for enterprises, family offices and private clients: the most capable AI, trusted with everything. Each deployment is built for one client, from the hardware to the choice of model provider to where the data is stored, and Mitosis Labs works with leading vendors and providers to fit each one. Delivery takes weeks.
Frequently asked questions#
Can OpenAI see my prompts on Azure OpenAI?#
No. Microsoft states that prompts, completions, embeddings and training data "are NOT available to OpenAI or other providers of Models sold by Azure," and that the models do not interact with the OpenAI API.
Does Amazon Bedrock store my prompts?#
It depends on the retention mode and the model. With data_retention_mode set to none, AWS writes no request or response data to durable storage. Under other modes, some models keep prompts for up to 30 days within AWS.
How do I turn off abuse monitoring on Azure OpenAI?#
Apply for modified abuse monitoring through Microsoft's form. It requires meeting Limited Access eligibility criteria, and once approved you can confirm it by checking that ContentLogging reads false on the resource.
Which is better for data residency?#
Both offer geography-bound processing. Azure uses Data Zone or single-geography deployments and keeps data at rest in your chosen geography, and Bedrock uses single-Region or geographic cross-Region inference. Avoid Azure Global and Bedrock global profiles if your data must stay in one jurisdiction.
Are all models available with zero retention?#
No. On Bedrock, models that require retention become unavailable under none, and AWS lists Claude Fable 5 and 5.1 as requiring aws_review. On Azure, Microsoft notes that some advanced models have stricter criteria for turning off abuse monitoring.
Sources#
- Data, privacy, and security for Foundry Models sold by Azure (Microsoft Learn, accessed 2026-10-15)
- Foundry Models sold by Azure abuse monitoring (Microsoft Learn, accessed 2026-10-15)
- Understanding deployment types in Microsoft Foundry Models (Microsoft Learn, accessed 2026-10-15)
- Securing Azure OpenAI inside a virtual network with private endpoints (Microsoft Learn, accessed 2026-10-15)
- Data retention (Amazon Bedrock User Guide, AWS, accessed 2026-10-15)
- Data protection (Amazon Bedrock User Guide, AWS, accessed 2026-10-15)
- Amazon Bedrock abuse detection (Amazon Bedrock User Guide, AWS, accessed 2026-10-15)
- Route model inference requests across AWS Regions with cross-Region inference (Amazon Bedrock User Guide, AWS, accessed 2026-10-15)
- Protect your data using Amazon VPC and AWS PrivateLink (Amazon Bedrock User Guide, AWS, accessed 2026-10-15)
- Monitor model invocation using CloudWatch Logs and Amazon S3 (Amazon Bedrock User Guide, AWS, accessed 2026-10-15)
- Building private AI in house vs. a done-for-you service (Private SuperIntelligence)