Q39
Are you PCI DSS compliant? At what level?
PCI DSS compliance claim found on trust page (Vendor attested)
Public evidencemedium confidence
Amazon Web Services Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about Amazon Web Services before Amazon Web Services sends a questionnaire or a security document.
Amazon Web Services's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from Amazon Web Services — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on Amazon Web Services's own trust page.
✓ FedRAMP Certified — Class D (High) FedRAMP Marketplace data as of November 2026.
Amazon Web Services has 2 FedRAMP Certified offerings: AWS GovCloud, AWS US East/West. FedRAMP certifies a named cloud service offering, not a company, so a service is covered only if it runs inside one of these offerings. Confirm the plan your team buys is one of them. Full FedRAMP detail
Risk
Tier 3 — Moderate RiskEvidence confidence
100%27 of 27 sources returned data
Questionnaire
132 / 134 answered99% from public evidence
Last assessed
Oct 3, 2026Completed in 8m 33s
Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟢IP Reputation: Abuse score: 0%, 0 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 31.9 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- FedRAMP Certified — Class D (High). Amazon Web Services has 2 FedRAMP Certified offerings: AWS GovCloud, AWS US East/West. FedRAMP certifies a named cloud service offering, not a company, so a service is covered only if it runs inside one of these offerings. Confirm the plan your team buys is one of them. (FedRAMP Marketplace data as of November 2026)
- SOC 2 Status
- Amazon Web Services — SOC 2: No public claim found. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- Amazon Web Services returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned Amazon Web Services a Moderate Risk tier across 27 intelligence sources, 27 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 27 returning usable evidence. The Amazon Web Services assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest Amazon Web Services Vendor Assessment →Full risk assessment + 134-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
132 questions answered before Amazon Web Services responds.
ThirdProof used public evidence to pre-fill 99% of a 134-question vendor security questionnaire — without waiting for Amazon Web Services. The remaining 2 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
AWS maintains current SOC 2 Type II reports that provide third-party validation of its control environment related to Security, Availability, Confidentiality, and Privacy.
Public evidencelow confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
GDPR compliance / DPA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
HIPAA compliance / BAA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
AWS documentation confirms that AWS has adopted transparent encryption of data at rest as standard across its service portfolio and supports envelope encryption with AWS KMS.
Public evidencelow confidence
+ 127 additional evidence-backed answers
Get the Complete Amazon Web Services Assessment →
See all 134 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before Amazon Web Services sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- FedRAMP — fedramp certified — class d (high)
- FedRAMP Authorization Independently Verified
- FedRAMP Authorization Confirmed (Cross-Source)
- No SEC Enforcement Filings Found
- Legal Entity Actively Registered
- Vendor Commits to Not Training on Customer Data
Still requires vendor confirmation
- Employee & HR — 1 of 4 questions need vendor input
- Contracts & Legal — 1 of 4 questions need vendor input
Reviewing Amazon Web Services for your company?
Get the complete ThirdProof assessment now, then run the same evidence-first diligence on the rest of your vendor stack — under 10 minutes each, without waiting on any of them to reply.
5 vendors free · No credit card · No vendor contact required
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for Amazon Web Services
Amazon Web Services (AWS) is a mature, large-scale cloud infrastructure provider operating at Tier 3 (Moderate Risk).
Area Requiring Attention
The vendor demonstrates substantial security maturity, extensive independent certifications, and a clear commitment to not training AI models on customer data — all significant positive signals for enterprise customers. Strengths include: verified FedRAMP authorization at High Impact Level, extensive published compliance certifications (ISO 27001, PCI DSS, HIPAA, GDPR, SOC 1), strong domain reputation and infrastructure security posture (TLS 1.3, A-grade HTTP security headers), and explicit commitment to not using customer data for AI model training.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
All evidence was independently sourced from external data repositories, public registries, domain analysis, threat intelligence platforms, and vendor-published documents, without vendor participation or approval.
Investigation Findings
2 findings identified for Amazon Web Services
1 medium1 low
medium
Service disruption reported
A significant service disruption affecting AWS infrastructure was reported in October 2025, with impacts described as widespread across websites, applications, and airlines affecting millions of users globally. For customers relying on AWS for mission-critical workloads, this incident underscores the importance of designing for multi-region redundancy and understanding AWS's incident communication timeline and remediation speed.
low
Subprocessor list could not be parsed
AWS publishes a subprocessor page at https://aws.amazon.com/compliance/sub-processors/, but the automated parsing mechanism could not extract individual subprocessor entries. The page may use a non-standard format or dynamic content loading that requires manual review to identify all third-party processors AWS contracts with for data handling.
✓
Security Strengths
Evidence that positively supports Amazon Web Services's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
FedRAMP Authorization Independently Verified
Trust & Compliance Page Scan →✓
FedRAMP Authorization Confirmed (Cross-Source)
Certification Registry Verification →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Legal Entity Actively Registered
Business Registration →✓
Vendor Commits to Not Training on Customer Data
AI Data Usage Policy →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →Amazon Web Services complete vendor assessment
Tier 3
Moderate Risk
132 / 134
questionnaire answers
27
sources checked
Oct 3, 2026
assessment date
- Complete 134-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Compliance Resources
→ SOC 2 Vendor Assessment: What Your Auditor Actually Reviews→ SOC 2 CC9.2 Vendor Management with ThirdProof→ HIPAA Vendor Risk Assessment with ThirdProof→ PCI-DSS 4.0 Requirement 12.8 Vendor Due Diligence→ CMMC Level 2 Supply Chain Risk Assessment→ ABA Model Rule 1.6 Vendor Due Diligence for Law Firms→ FedRAMP Authorized Vendor List→ FedRAMP Vendor Authorization Status Guide→ Sanctions Screening for Vendor Due Diligence→ Vendor Due Diligence Checklist→ All 27 Intelligence Sources
Frequently asked about Amazon Web Services
Is Amazon Web Services FedRAMP authorized?+
Yes — Amazon Web Services has 2 FedRAMP Certified offerings: AWS GovCloud, AWS US East/West. FedRAMP certifies a named cloud service offering, not a company, so a service is covered only if it runs inside one of these offerings. Confirm the plan your team buys is one of them. Checked against FedRAMP Marketplace data as of November 2026.
Does Amazon Web Services have SOC 2 Type II?+
Amazon Web Services was not found in the Vendor trust page when it was checked on October 3, 2026. Absence of a public record is not evidence that the certification is absent; organisations with a hard requirement should confirm directly with the vendor.
Is Amazon Web Services on the OFAC sanctions list?+
Amazon Web Services returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of October 2026.
What is Amazon Web Services's vendor risk tier?+
ThirdProof assigned Amazon Web Services a risk tier of Moderate Risk as of October 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning Amazon Web Services.
Has Amazon Web Services had any data breaches or security incidents?+
ThirdProof's adverse media and incident screening as of October 2026 did not surface a validated security incident involving Amazon Web Services. Public sources do not record every incident, so this is not a guarantee that none occurred — ask Amazon Web Services directly for its incident disclosure history and breach notification commitments.
Is Amazon Web Services PCI DSS compliant?+
PCI DSS compliance claim found on trust page (Vendor attested) ThirdProof records this from Amazon Web Services's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does Amazon Web Services support HIPAA and sign BAAs?+
HIPAA compliance / BAA claim found on trust page (Vendor attested) If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a Amazon Web Services security questionnaire?+
Yes. ThirdProof answered 132 of 134 questions (99%) about Amazon Web Services from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 2 are listed as open, so the follow-up you send Amazon Web Services is short and specific.
Represent Amazon Web Services? Submit updated security evidence.
If Amazon Web Services is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The Amazon Web Services assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required