Amazon Bedrock Guardrails is a set of configurable filters that sit between users and an AI model on Amazon Bedrock. It checks prompts and responses for harmful content, banned topics, personal data and ungrounded answers, and blocks or masks what it finds. For an ecommerce brand that sends customer names, addresses or order history to a model, Guardrails is one part of keeping that data safe. The other parts are how Bedrock itself handles data, which models the brand chooses and how its AWS account is set up. This answer covers all three, with AWS's published prices and terms. It is from Brand Media Works, an AI consulting and marketing data engineering firm for ecommerce brands.

What does Amazon Bedrock Guardrails do?

  • Content filters detect harmful text or image content in prompts and responses across six categories: hate, insults, sexual, violence, misconduct and prompt attacks, with adjustable strength for each.
  • Denied topics block subjects the brand defines, such as competitor comparisons or medical advice.
  • Word filters block custom words and phrases, using whole-word matching.
  • Sensitive information filters block or mask personal data such as Social Security numbers, dates of birth and addresses, plus custom patterns defined with regular expressions. AWS describes the detection as probabilistic.
  • Contextual grounding checks flag responses that are not supported by the source material or do not answer the user's question.
  • Automated Reasoning checks validate responses against a set of logical rules.

Guardrails can also run on their own through the ApplyGuardrail API, without calling a Bedrock model. AWS notes that Guardrails do not evaluate a model's reasoning content blocks (read 2 November 2026).

What does a guarded, private AI setup cost, and when is it worth building?

Guardrails are priced per text unit, which AWS defines as up to 1,000 characters. AWS lists content filters and denied topics at $0.15 per 1,000 text units, sensitive information filters and contextual grounding checks at $0.10, and Automated Reasoning checks at $0.17 per policy (read 15 October 2026). Word filters and regular expression filters are free. A support assistant handling 10,000 conversations a month, each with a 200-character question and a 1,500-character answer, uses 30,000 text units, so content filters, denied topics and personal data filters together cost about $12 a month (our arithmetic). Running an open model is similarly cheap: Bedrock lists Gemma 4 26B at $0.13 per million input tokens and $0.40 per million output tokens.

The cost is in the setup: choosing models whose data handling fits the brand's rules, keeping traffic inside the brand's own network, storing logs in the brand's own storage and testing the filters against real prompts. That work is worth it when prompts carry customer records at volume, when the brand handles health or other regulated data, or when it needs an audit trail of what the AI saw and said. AI data security on AWS and private LLMs on open-weight models describe how Brand Media Works builds this inside a brand's AWS account, and what a private LLM costs to run sets out the running costs.

Does Bedrock train on your data?

No, according to AWS. When a brand fine-tunes a model, Bedrock bases it on a private copy, so the data is not shared with model providers and is not used to improve the base models. AWS says each model provider's models run in a separate deployment account per region, and the providers have no access to those accounts, so they cannot see Bedrock logs or customer prompts and completions (read 15 October 2026).

Is AWS Bedrock fully private?

Mostly, with exceptions that depend on the model:

  • Encryption and networking. Data is encrypted in transit and at rest, keys can be managed in AWS Key Management Service, and AWS PrivateLink connects a brand's private network to Bedrock without going over the internet.
  • Abuse detection. AWS describes a zero operator access model, subject to abuse detection. For OpenAI models other than the open-weight gpt-oss family, traffic flagged by classifiers is kept for up to 30 days. For Anthropic's Claude Fable 5 and Fable 5.1, all traffic is kept for up to 30 days and may be reviewed by AWS. Retained data stays with AWS and is not shared with the model provider.
  • Retention settings. Brands can set data retention per region at the account or project level, and some models permit a setting under which no inference data is retained.

For customer data, that means choosing models whose retention terms fit, and checking the retention setting in every region the brand uses. The risks of public AI tools with customer data covers the alternatives.

Is Bedrock HIPAA compliant?

AWS says Bedrock is HIPAA eligible, in scope for ISO, SOC and CSA STAR Level 2, and can be used in compliance with GDPR. It is also FedRAMP High authorized in the AWS GovCloud (US-West) region (read 15 October 2026). Eligible means the service can be part of a compliant setup, not that every use of it is compliant. The brand still needs the right agreements with AWS, the right configuration and controls such as Guardrails' personal data filters.

Book a discovery call

Frequently asked questions

Can Bedrock Guardrails work with models outside Bedrock?

The ApplyGuardrail API evaluates text without calling a Bedrock model, so a brand can check prompts and responses from other sources against the same filters. AWS's Guardrails page does not spell out use with models outside Bedrock, so test it on the brand's own setup.

Do Guardrails catch every piece of personal data?

No. AWS describes the detection as probabilistic. Custom regular expression filters, which are free, can catch formats specific to the brand, such as order numbers, and testing on real prompts shows what slips through.

What is a text unit?

Up to 1,000 characters of text. AWS gives the example that a 5,600-character input is charged as 6 text units.