Security / trust page (GDPR) — Amazon SES

Cited by

Facts read from this source

• Data processing Report an error

  “AWS customers can use all AWS services to process personal data (as defined in the GDPR) that is uploaded to the AWS services under their AWS accounts (customer data) in compliance with the GDPR.”

• Security features count Report an error

  “New features are launched regularly, and AWS has 500+ features and services focused on security and compliance.”

• Customer data control Report an error

  “Determine where their customer data will be stored, including the type of storage and geographic region of that storage.”

• Encryption options Report an error

  “We offer customers strong encryption for customer data in transit or at rest, and we provide customers with the option to manage their own encryption keys.”

• DPA sccs Report an error

  “The AWS Service Terms include the SCCs adopted by the European Commission (EC) in June 2021, and the AWS DPA confirms that the SCCs will apply automatically whenever an AWS customer uses AWS services to transfer customer data to countries outside of the European Economic Area that have not received an adequacy decision from the EC (third countries).”

• Role Report an error

  “AWS acts as both a data processor and a data controller under the GDPR.”

• Types Report an error

  “Yes, AWS may use three types of sub-processors: (1) AWS entities that provide the infrastructure on which the AWS services run; (2) AWS entities that support specific AWS services which may require these entities to process customer data; and (3) third parties that AWS has contracted with to provide processing activities for specific AWS services.”

• ISO 27001 Report an error

  “ISO 27001 for technical measures”

• ISO 27017 Report an error

  “ISO 27017 for cloud security”

• ISO 27018 Report an error

  “ISO 27018 for cloud privacy”

• SOC reports Report an error

  “SOC 1, SOC 2 and SOC 3, PCI DSS Level 1,”

• C5 ens Report an error

  “BSI’s Common Cloud Computing Controls Catalogue (C5) ENS High”

• Cispe code Report an error

  “Yes. Cloud Infrastructure Services Providers in Europe (CISPE) Data Protection Code of Conduct Public Register includes a list of adherent AWS services.”

• Breach notification Report an error

  “AWS has a security incident monitoring and data breach notification process in place and will notify customers of breaches of AWS’s security without undue delay and in accordance with the AWS DPA.”

• Audit logging Report an error

  “One of these tools is AWS CloudTrail which enables governance, compliance, operational auditing, and risk auditing of an AWS account.”

• Ddos protection Report an error

  “AWS Shield Standard is available at no additional charge and provides always-on detection and automatic inline mitigations that can minimize application downtime and latency.”

• Personal data discovery Report an error

  “Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect yourpersonal data in AWS.”

• Iam Report an error

  “IAM is a feature of AWS accounts offered at no additional charge.”

• Key management Report an error

  “Flexible key management options, including AWS Key Management Service, allowing the choice of whether to have AWS manage the encryption keys or enable customers to keep complete control over keys”

• Hsm Report an error

  “Dedicated, hardware-based cryptographic key storage using AWS CloudHSM, allowing customers to satisfy compliance requirements”

• Encryption at rest scope Report an error

  “Encryption of your data at rest with AES256 (EBS/S3/Glacier/RDS)”

• UK GDPR Report an error

  “AWS offers a UK GDPR-compliant UK GDPR Addendum to the AWS DPA that incorporates AWS’s commitments as a data processor under the UK GDPR.”

• UK idta Report an error

  “The UK GDPR Addendum, which is part of the AWS Service Terms, includes the SCCs adopted by the EC and the international data transfer addendum (IDTA) issued by the UK data protection regulator (the Information Commissioners Office).”

• Swiss fdpa Report an error

  “AWS offers a Swiss Addendum to the AWS Data processing Addendum (the “Swiss Addendum”) that incorporates AWS’s commitments as data processor under the Swiss Federal Data Protection Act (the “FDPA”).”

• GDPR guidance Report an error

  “Customers can use AWS Support to receive technical guidance to help them on their road to GDPR compliance. As part of this activity we have teams of Cloud Support Engineers and Technical Account Managers (TAMs) that are trained to help identify and mitigate compliance risks.”

• API encryption Report an error

  “In addition, AWS provides APIs for customers and APN Partners to integrate encryption and data protection with any of the services they develop or deploy in an AWS environment.”

• Shared responsibility Report an error

  “The GDPR does not change the AWS shared responsibility model, which continues to be relevant for customers.”

• Cloudtrail default Report an error

  “(AWS CloudTrail is enabled on all AWS accounts by default)”

• MFA Report an error

  “AWS Multi-Factor Authentication adds an extra layer of protection on top of an AWS account’s user name and password. AWS gives customers the option of virtual and hardware MFA devices.”

• Default deny Report an error

  “Security by default means AWS services are designed to be secure by default. If the default configuration is used, access to resources is locked down to just the account owner and root administrator.”

• Data transfer assessment whitepaper Report an error

  “The AWS whitepaper, Navigating Compliance with EU Data Transfer Requirements, provides information about the services and resources that AWS offers customers to help them conduct data transfer assessments in light of the Schrems II ruling, and subsequent recommendations from the European Data Protection Board.”

• Audit reports available Report an error

  “AWS offers helpful information to customers, including several compliance reports from third-party auditors, who have verified our compliance with a variety of security standards and regulations, to prove the high levels of compliance AWS maintains for its infrastructure.”

• Partner solutions Report an error

  “Yes, you can search for “GDPR” in the AWS Partner Solutions Finder to help find ISVs, MSPs, and SI partners that have products and services to help with GDPR compliance.”

• Professional services Report an error

  “Yes, the AWS Security Assurance Services team has a number of activities to help customers on their journey to GDPR compliance.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Agency Lead Message data, retention & security
• The Agency Lead European sovereignty
• The Data Protection Officer Message data, retention & security
• The Data Protection Officer Reliability, accounts & support
• The Data Protection Officer European sovereignty
• The Shop Operator Message data, retention & security
• The Shop Operator Reliability, accounts & support
• The Shop Operator European sovereignty
• The Platform Engineer Message data, retention & security
• The Platform Engineer Reliability, accounts & support
• The Platform Engineer European sovereignty
• The SaaS Developer Message data, retention & security
• The SaaS Developer Reliability, accounts & support
• The SaaS Developer European sovereignty
• The Skeptic Message data, retention & security
• The Skeptic European sovereignty