Server hosting
Amazon Web Services privacy rating
Cloud computing platform from Amazon offering virtual servers (EC2), storage, databases and hundreds of other services in regions worldwide.
Summary
Amazon Web Services scores 45 out of 100 (grade D) on the server hosting criteria. It meets 5 of 12 criteria: transparency report, tells users about requests, TLS configuration, security headers and IPv6. It partly meets independent audit, mail-friendly (port 25) and Reverse DNS. It does not meet open source, no trackers or telemetry, no ads or data sales and anonymous payment. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.
Score 45 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
AWS websites set cookies from third parties including The Trade Desk, Oracle BlueKai and LinkedIn.
-
No
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
The privacy notice says cookies and identifiers are used to advertise to visitors on third-party websites.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Only the SOC 3 summary report is public; SOC 1 and SOC 2 reports are available to customers in AWS Artifact.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Semi-annual reports with counts of government requests to Amazon and AWS and how they were answered.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Amazon notifies customers before disclosing content unless prohibited or there is clear indication of illegal conduct.
-
Partial
Mail-friendly (port 25) Weight 1 of 3
Is outbound port 25 open by default, or opened on request?
Outbound port 25 to public addresses is blocked by default, and customers can request removal of the restriction.
-
Partial
Reverse DNS Weight 1 of 3
Can reverse DNS (PTR) records be set for IPv4 and IPv6?
Reverse DNS can be set for Elastic IP addresses, which are IPv4 only.
-
Yes
IPv6 Weight 1 of 3
Is native IPv6 included?
IPv6 addresses can be assigned to instances, and only public IPv4 addresses carry an hourly charge.
-
No
Anonymous payment Weight 1 of 3
Can servers be paid for with cryptocurrency or without identity checks?
Payment is by card or direct debit. Cryptocurrency is not accepted.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Yes
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade A+ (105/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.