// Trust & Security Report
Amazon Lex
by Amazon Web Services, Inc.
Amazon Lex is AWS's conversational AI / chatbot-building service (voice and text), available as Lex V1 (legacy) and Lex V2, and embedded in Amazon Connect contact-center flows; it inherits AWS's platform-wide compliance program rather than holding independent certifications.
Certifications held
10
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on docs.aws.amazon.com“Third-party auditors assess the security and compliance of Amazon Lex V2 as part of multiple AWS compliance programs... It is PCI, SOC, and ISO compliant.”
Verify on aws.amazon.com“Amazon Lex is now one of the AWS services under ISO Compliance for the ISO 9001, ISO 27001, ISO 27017, and ISO 27018 standards.”
Verify on aws.amazon.com“Amazon Lex is now one of the AWS services under ISO Compliance for the ISO 9001, ISO 27001, ISO 27017, and ISO 27018 standards.”
Verify on aws.amazon.com“Amazon Lex is now one of the AWS services under ISO Compliance for the ISO 9001, ISO 27001, ISO 27017, and ISO 27018 standards.”
Verify on aws.amazon.com“Global CSA STAR GxP ISO 14001 ISO 20000 ISO 22301 ISO 27001 ISO 27017 ISO 27018 ISO 27701 ISO 42001 ISO 45001 ISO 50001 ISO 9001 KY3P PCI 3DS PCI DSS PCI P2PE PCI PIN ProcessUnity SOC 1 SOC 2 SOC 3 Uptime”
Verify on aws.amazon.com“STAR GxP ISO 14001 ISO 20000 ISO 22301 ISO 27001 ISO 27017 ISO 27018 ISO 27701 ISO 42001 ISO 45001 ISO 50001 ISO 9001 KY3P PCI 3DS PCI DSS PCI P2PE PCI PIN ProcessUnity SOC 1 SOC 2 SOC 3 Uptime Institute”
Verify on aws.amazon.com“of compliance. Global Americas Asia Pacific Europe, Middle East & Africa Global CSA STAR GxP ISO 14001 ISO 20000 ISO 22301 ISO 27001 ISO 27017 ISO 27018 ISO 27701 ISO 42001 ISO 45001 ISO 50001 ISO 9001 KY3P”
Verify on aws.amazon.com“Amazon Lex is now a Payment Card Industry Data Security Standard (PCI DSS) compliant service. Customers can now use Amazon Lex to capture, transmit, and retrieve sensitive payment card data for use cases such as payment processing, and mobile wallet that are subject to PCI DSS compliance.”
Verify on aws.amazon.com“Amazon Lex is an AWS service for building conversational interfaces into applications using voice and text. [Amazon Lex] ... achieved FedRAMP Moderate authorization in the AWS US East/West Regions.”
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Customer selects the AWS Region for Lex deployment; content used for service improvement/model training may be stored in a different AWS Region unless the customer opts out.
AWS's own documentation states AI services including Lex may use and store customer content by default for service improvement, including model training, and may store it outside the region of use; this is opt-out (not opt-in) via an AWS Organizations AI services opt-out policy. Opting out stops future use and deletes previously stored training copies, but does not delete content needed to run the service itself.
// Security controls
Encryption in transit
AWS documentation for Lex V2 recommends and defaults to SSL/TLS for all communication with AWS resources/APIs.
docs.aws.amazon.comShared responsibility model
AWS is responsible for securing the underlying global infrastructure; customers/APN partners are responsible, as data controllers or processors, for personal data they put into Lex.
docs.aws.amazon.comAccess control
AWS recommends IAM with least-privilege user accounts and multi-factor authentication (MFA) for accounts using Lex.
docs.aws.amazon.comAudit logging
AWS recommends enabling AWS CloudTrail for API and user activity logging around Lex usage.
docs.aws.amazon.comPCI DSS Level 1 assessment
AWS is certified as a PCI DSS Level 1 Service Provider (highest level), independently assessed by Coalfire Systems Inc., and Lex specifically is named as PCI DSS compliant.
aws.amazon.com// Products & data scope
Data it handles: Voice and text conversation input, intent/slot data, session attributes; can be configured to process payment-card and PHI data under BAA/PCI scope.
Current generation; explicitly named HIPAA-eligible, PCI DSS compliant, ISO 9001/27001/27017/27018 compliant, and SOC/PCI/ISO compliant per AWS's own compliance-validation documentation.
Data it handles: Same conversational data as V2.
Legacy version, still documented separately (docs.aws.amazon.com/lex/latest/dg/compliance.html); AWS steers new builds to V2.
Data it handles: Call/chat transcripts and routing data flowing between Amazon Connect and Lex bots.
Used for enterprise IVR and self-service automation (per AWS customer case studies on the product page); inherits Connect's own compliance scope in addition to Lex's.
// What to watch
- AWS AI services, including Lex, use customer content for service improvement by default; this is opt-out, not opt-in.
- ISO 27701, ISO 42001, and CSA STAR are held by AWS at the platform level, but Lex's specific inclusion in the certified service list is not confirmed from public vendor pages.
- FedRAMP authorization confirmed for Lex is Moderate, in AWS US East/West commercial regions, per a 2019 announcement. This is distinct from FedRAMP High or GovCloud authorization.
- Because Amazon Lex is a feature or service of the AWS platform rather than an independently operated company, its compliance posture is inherited from AWS's platform-wide programs (AWS Artifact) rather than product-specific audits.
// At a glance
Pricing model
Pay-as-you-go, usage-based (per AWS product page: "Pay-as-you-go pricing")
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Amazon Web Services, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
aws.amazon.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.