The best AI SaaS platform for regulated enterprises

Microsoft's data privacy documentation for the models Azure sells, a group that includes the Azure OpenAI models, states that prompts and completions are not available to OpenAI or other model providers and that standard deployments process them within the geography the customer specifies. Microsoft Azure OpenAI is our pick for regulated enterprises that want to exclude model-provider access and select an Azure processing geography, provided the chosen deployment and governing agreements cover their requirements. The pick covers Azure OpenAI models on a standard deployment; other deployment types and other model families in Foundry follow different rules.

Amazon Web Services suits a buyer who has settled on a serverless model in Amazon Bedrock, where AWS's data protection page says the model provider has no access to the account that runs the model. Google suits a buyer whose model supports the jurisdictional endpoint that its rules require, with Assured Workloads configured where a federal boundary applies.

What should a regulated enterprise weigh in an AI platform?

FedRAMP Marketplace record and impact level for the offering

FedRAMP's guidance for agencies says an agency must verify that its planned use falls within the certified scope and uses the certified version, and that each agency still authorizes its own system. That guidance is written for federal agencies, so this factor carries weight when you are one or sell to one. Microsoft, AWS and Google each publish their own table of services in FedRAMP scope; read it as the vendor's statement and ask for the live Marketplace package. In the package, confirm the named service, the model and version, the impact level, and whether the boundary is the commercial cloud or the government cloud. FedRAMP's help center says a listing can stay on the Marketplace while a service has no active agency authorization, so check the current status too.

HIPAA business associate agreement availability and how it is activated

HHS cloud computing guidance says a covered entity or business associate that has a cloud provider handle electronic protected health information should enter a business associate agreement with that provider and conduct its own risk analysis. The three vendors reach the agreement by different routes: Microsoft folds it into the customer agreement, and AWS and Google ask the customer to accept it. Either route leaves two things open, which are the services and features the agreement covers and whether your account and configuration fall under it. Ask for the governing agreement and its covered-service list, and find your model and feature in that list.

Regions for data storage and for processing

HHS says in the same guidance that HIPAA permits storage overseas when the agreement and the other requirements are met, and that location changes the risks a buyer has to analyze. On all three platforms the location of stored data and the location of inference are set by separate choices: a region or geography for storage, and a deployment type, inference profile or endpoint for processing. Write down four locations for the model and version you plan to run: data at rest, inference, fine-tuning data, and prompts retained for abuse review.

Whether the model maker can see or retain prompts, with model-specific exceptions

Microsoft's page on Claude models in Foundry describes Anthropic as the seller and operator of those models and as an independent data processor for prompts and outputs, a different arrangement from the one Microsoft states for the models it sells itself. So the answer to this factor is set model by model, inside a single platform. Put four questions to the vendor about the exact model: whether its maker can read prompts, whether the cloud operator reviews them for abuse, how long anything is retained, and whether any of it trains a model.

SOC 2, ISO 27001 and ISO 42001 scope and issuer

HHS notes that HIPAA does not expressly require a cloud provider to supply security documentation or permit customer audits, and that customers can contract for added assurances. A SOC 2 report is an auditor's attestation over a period and an ISO certificate comes from a certification body, so the two are separate documents with separate scopes. Each of the three vendors holds them in a customer portal. Request the report or certificate itself and read the period, the legal entity, the service and model in scope, and the exceptions.

How Microsoft, AWS and Google document each factor

Microsoft: Azure OpenAI among the models Azure sells

Foundry hosts the models Azure sells in Microsoft's own Azure environment, and Microsoft's data privacy page says they do not interact with services the provider operates, such as ChatGPT or the OpenAI API. The same page says the providers do not use customer prompts, completions, embeddings or training data to improve their models. Claude in Foundry sits outside that statement: Microsoft's page on those models describes one option hosted on Azure and one hosted on Anthropic's infrastructure, where data can be processed outside Azure under Anthropic's terms.

Microsoft's abuse monitoring documentation describes automated review of a sample of prompts and completions when abuse indicators trigger, with human review by authorized Microsoft employees as necessary. Customers who meet Microsoft's additional Limited Access criteria can apply for modified abuse monitoring, and once approved the storage and human review stop and automated review can still run. So the exclusion covers the model maker, and Microsoft as cloud operator keeps a review path unless that application is approved.

A standard deployment processes prompts and responses within the geography the customer specifies, and the privacy page allows processing between regions inside that geography for operational purposes. Global deployment types process them in any geography where the model is deployed, and DataZone types process them anywhere inside the named zone, which for a resource located in the United States means anywhere in the United States. For both, data at rest stays in the customer-designated geography, and that covers the abuse-monitoring store. Microsoft's deployment types guide recommends Global Standard as the starting point for most workloads and says not every model supports every deployment type, so select a geography-bound type on purpose and confirm your model offers it.

Microsoft's data residency page lists an exception for fine-tuned models on Global or DataZone types: training and validation data and model weights can be stored temporarily outside the selected geography. Fine-tuning on those types therefore needs its own location answer before regulated data goes into a training set.

Microsoft's FedRAMP audit scope page carries an Azure OpenAI row marked under FedRAMP High in its Azure commercial table and again in its Azure Government table. The government table marks Defense Department impact levels for the same row, and the page assigns IL6 to the separate Azure Government Secret environment. Match the live Marketplace package to the one boundary your deployment will sit in.

For a covered entity or business associate that puts protected health information in its customer data, Microsoft's Data Protection Addendum says executing the customer agreement includes executing the HIPAA Business Associate Agreement, and it gives a written opt-out. The addendum points to the full agreement for the online services it applies to, and it takes previews out of its HIPAA section except those that allow personal data processing. Get that service list and find Azure OpenAI and each feature you plan to use before any protected health information goes in.

Microsoft's SOC 2 page describes Type 2 audits by a certified public accountant firm and a report scope that covers Azure, and its ISO 42001 page lists Microsoft Foundry among the AI services in scope. Both pages send customers to the Service Trust Portal for the documents. Ask for the report and the certificate, and check that Azure OpenAI and your model fall inside the scope each one states.

Amazon Web Services: Bedrock serverless models and retention set by model

AWS runs each serverless Bedrock model in what its data protection page calls a Model Deployment Account: one per model provider per Region, owned and operated by the Bedrock service team without access for the model provider. The page concludes that providers cannot reach Bedrock logs or customer prompts and completions. The Bedrock FAQ adds that inputs and outputs are not shared with any model provider and are not used to train Amazon's models or third-party models.

AWS's data retention page describes a retention mode set for each Region at the account or project level, and each model declares which modes it allows. A model whose minimum mode is AWS review is unavailable under a stricter setting, and requests to it fail. Review in that mode is carried out by AWS inside its own boundary, and the page says the content is not shared with the model provider. An organization policy example on the same page denies every mode other than no retention, which leaves the models that require review unavailable.

AWS's abuse detection page names specific OpenAI and Anthropic models for which some or all traffic is retained for automated abuse detection. Zero-retention access for models that require retention is evaluated for each account and each model, the retention page says, so ask for that decision in writing for the model you intend to use.

Bedrock stores content at rest in the Region where the customer uses it, the FAQ says. AWS's cross-Region inference guide says a geographic profile routes requests within a geography such as the US or EU, and a global profile routes them to any supported commercial Region. The companion geographic inference page says prompts and outputs can move outside the source Region during cross-Region inference, and that data stored for abuse detection is stored in the destination Region. The global inference page supplies a service control policy that disables global routing.

AWS's FedRAMP services-in-scope table marks Amazon Bedrock in both of the environments AWS certifies separately, US East/West and GovCloud (US), and its footnote links to a status page listed model by model. That page marks some models in one environment only, so look up your model by name and then match it to the live Marketplace package.

AWS's HIPAA page says a customer signs in to AWS Artifact to review and accept the Business Associate Addendum for an account. Its HIPAA eligible services list names Amazon Bedrock and says a covered entity or business associate must enter that agreement before using the listed services with protected health information. Confirm the acceptance on the account that will run the model.

AWS's SOC page names Ernst & Young LLP as the auditor of its SOC reports. Its ISO pages name EY CertifyPoint as the certifying agent for ISO 27001 and Schellman Compliance as the certifying body for ISO 42001. AWS's SOC services list and its ISO certified services list both enter the service as Amazon Bedrock with Bedrock Marketplace excluded, and the Bedrock Marketplace guide says Marketplace models deploy to endpoints managed by SageMaker AI. A model taken from Bedrock Marketplace is a separate route, so ask AWS which of its serverless statements apply to it.

Google: jurisdictional endpoints and a configured federal boundary

Google's data residency page for Gemini Enterprise Agent Platform, formerly Vertex AI, ties the processing location to the endpoint. Stored platform data such as custom model weights stays in the selected Cloud location whichever endpoint is used. A jurisdictional multi-region endpoint keeps machine-learning processing inside a defined geography, and the global endpoint processes worldwide with no regional isolation. Regional processing support varies by model and location, the page says, so check your model against Google's per-model table.

Google's partner model page documents regional, global and US and EU multi-region endpoints and names the Claude models available on them. The same page states that customer prompts and responses are not shared with third parties when using the Gemini Enterprise API, partner models included, and that Google processes customer data as the customer instructs. It refers model-specific details to the model card or the publisher.

Google's zero data retention page says Google will not train or fine-tune models on customer data without the customer's permission or instruction. The page says Google can log prompts for abuse monitoring on its own models, and that customers in scope can request an exception. Grounding with Google Search or Google Maps stores data that the page says cannot be disabled for those features, and session resumption stores cached data once a customer enables it.

Google's government deployment guide labels Generative AI on Gemini Enterprise Agent Platform as authorized for FedRAMP High and IL4. Its FedRAMP page says FedRAMP High use requires Assured Workloads with a Data Boundary and Assured Support, on Google's existing public cloud infrastructure. A default commercial project is a different configuration from that boundary, so confirm the model you plan to call inside the configured one and match it to the live Marketplace package.

Google's HIPAA guide puts the steps on the customer: decide whether an agreement is needed, enter one, use only covered services with protected health information, and keep pre-GA offerings away from that data unless the terms expressly permit it. The guide lists Generative AI on Agent Platform and Gemini Enterprise Agent Platform among its supported products. Find your model and feature in the current covered list and in your governing agreement.

Google's SOC 2 page names Ernst & Young LLP and Coalfire as its independent auditors and says Google issues Type II reports only. Its service list includes Gemini Enterprise Agent Platform and Generative AI on that platform. Google's ISO 42001 page lists the platform in scope and says certificates are available through the Compliance Reports Manager, which is where to request the report period and the scope wording.

Which AI platform should a regulated enterprise choose?

Microsoft Azure OpenAI is our pick for regulated enterprises that want to exclude model-provider access and select an Azure processing geography, provided the chosen deployment and governing agreements cover their requirements. We weight those two factors most because the first decides who outside your cloud vendor can read a prompt and the second decides where it is processed, and Microsoft documents both for one named service and deployment type. Before choosing Azure OpenAI, review the documents relevant to your workload: the live FedRAMP package for federal use, the governing business associate agreement and covered-service list for HIPAA-regulated data, and the audit reports and certificates your organization requires. Confirm that their scope covers your planned service, model, features and deployment, and assess the controls your organization must configure.

We would send one buyer to AWS ahead of our pick: the one whose model selection must enforce a defined retention mode. Bedrock sets that mode for an account or project and each model declares the minimum mode it accepts, which gives that buyer a setting to enforce the requirement with. Its limits come with it, because some models require AWS review and zero retention for those models depends on an approval.

Beyond that case, AWS suits the buyer whose chosen model is a serverless Bedrock model and who wants AWS's deployment-account design between its prompts and the model maker. Settle the exact model and inference profile first, since both affect where prompts go and what is retained. For HIPAA-regulated data, accept the Business Associate Addendum on the account that will run the model and confirm the covered-service terms for the features you will use.

Google is the better pick when the model you need supports the jurisdictional endpoint your rules call for, such as the US or EU multi-region. Configure Assured Workloads where a federal boundary applies, and accept Google's agreement and its covered-service terms before protected health information reaches the platform.

Other AI platform providers