Amazon Q Business
Amazon Web Services
Careful
AWS says Amazon Q Business is a HIPAA-eligible service, and its data-protection page tells you to use IAM, MFA, TLS, and CloudTrail. That page does not say whether prompts are used to train models. It also says Amazon Q Business is no longer open to new customers. Training is Unknown, and the product is closed to new buyers, so this is Careful rather than a recommendation to adopt it.
Last checked 2026-11-10
Data-safety checklist
Trains on your data by default
Unknown
The data-protection page describes the shared-responsibility model and security hygiene. It does not say customer content is excluded from training, and it does not say it is used for training.How to opt out
Steps
Unknown. No training opt-out is described on the pages we read.Data retention
What they keep
Unknown. The data-protection page does not state a retention period for prompts.BAA / HIPAA
Yes
The Amazon Q Business FAQ says the service is HIPAA eligible so healthcare organizations can run regulated workloads. AWS HIPAA eligibility still requires the customer's AWS business associate addendum. The data-protection page says the service is no longer open to new customers.Certifications
1 listed
- Unknown on these two pages beyond HIPAA eligibility
Enterprise and admin controls
Controls
AWS recommends IAM Identity Center or IAM, MFA, TLS 1.2 or higher, and CloudTrail logs. Access is the customer's to configure. The service is not open to new customers.Sources
2 pages