AWS Bedrock vs Azure vs Confidential AI: Which Keeps Your Prompts Private?
Published
Which keeps prompts private: Bedrock, Azure or Confidential AI?
It depends what you need to prove. If you need a closed frontier model, Bedrock and Azure are the way to get it, and your privacy rests on their retention policy and contract. If you need to show a customer, auditor or regulator that nobody, including the provider, could read the prompt, use open-weight models in a trusted execution environment (TEE) and check the attestation before you send anything. That's what Confidential AI sells. If you want to run your own model on Azure, its confidential GPU VMs give you TEE hardware and leave the stack to you.
Policy says one thing, a footnote says another
On 1 Oct 2026, @apparentorder put two AWS sentences side by side:
AWS Bedrock – data retention mode "none":
Docs: "Zero data retention. No request or response data is written to durable storage by AWS"
Blog: "We may store and review flagged content ... even when mode is none"
Only one of these can be correct.
Both sentences are real. The Bedrock data retention docs say mode none means "No request or response data is written to durable storage by AWS or shared with the model provider." The AWS Security Blog post on enforcing zero data retention says "We may store and review flagged content ... even when mode is none."
The exception is narrow. The point is different: a retention policy is a promise with exceptions, and the exceptions move. Per the Bedrock abuse detection docs, all Claude Fable 5 and 5.1 traffic is retained for up to 30 days for automated offline abuse detection, and Enterprise Frontier Safeguards customers keep zero data retention only through 31 Dec 2026. From the client, you can't check which rule applied to your request.
Side by side
As of 20 Oct 2026, from each provider's own documentation.
| AWS Bedrock | Azure (models sold by Azure in Foundry) | Confidential AI | |
|---|---|---|---|
| Models | Closed frontier models (Claude, OpenAI) and open-weight models | Closed frontier models (OpenAI) and open-weight models | Open-weight models: DeepSeek V4 Flash live, Kimi K3, GLM 5.3 and Qwen3.8 27B on request |
| Default retention | default mode: "AWS may retain the data for safety and abuse-prevention purposes" | Abuse monitoring stores flagged prompts and completions for human review | Prompts and responses are processed inside the TEE, invisible to us |
| Zero retention | Mode none, per model and per account, with the exceptions above | Managed customers can apply for modified abuse monitoring | Not a setting: the operator can't read memory in use |
| Who can read prompts | AWS, under the retention mode and abuse rules | Authorized Microsoft employees, for flagged content | Nobody outside the TEE, including Confidential AI |
| How you check | Read the policy and contract | Read the policy and contract | Fetch the attestation with a fresh nonce and verify the Intel TDX evidence yourself |
Azure detail is from Microsoft's data, privacy and security page for models sold by Azure, last updated 20 May 2026.
When each one fits
- Bedrock or Azure: you need Claude or GPT specifically, and a contract plus a zero data retention approval is enough for your buyers.
- Azure confidential GPU VMs: you want TEE hardware on Azure and will build and operate the inference stack, attestation and key release yourself. H100 confidential VMs are generally available.
- Confidential AI: you need privacy you can prove, an OpenAI-compatible API today, and open-weight models are good enough for the task. Overhead is about 1 to 3% token throughput on B200s (benchmarks).
What attestation proves, and what it doesn't
Our /attestation endpoint returns Intel TDX evidence bound to your nonce, the measured VM image, and the image digest of every workload in the serving path. Verifying it proves what was launched and admitted to handle your request. It doesn't prove model quality, uptime or GPU health. Details: Attestation.
To try it: get started, or see pricing.