# Amazon Web Services privacy rating

Cloud computing platform from Amazon offering virtual servers (EC2), storage, databases and hundreds of other services in regions worldwide.

## Summary

Amazon Web Services scores 45 out of 100 (grade D) on the server hosting criteria. It meets 5 of 12 criteria: transparency report, tells users about requests, TLS configuration, security headers and IPv6. It partly meets independent audit, mail-friendly (port 25) and Reverse DNS. It does not meet open source, no trackers or telemetry, no ads or data sales and anonymous payment. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://aws.amazon.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: none found
- Category: [Server hosting](https://privacyratings.com/server-hosting/)
- Also rated: [Amazon SES](https://privacyratings.com/email-sending/amazon-ses/) (Email sending services), [AWS End User Messaging SMS](https://privacyratings.com/communications-apis/aws-end-user-messaging-sms/) (SMS and voice APIs), [Amazon Route 53](https://privacyratings.com/dns-hosting/amazon-route-53/) (DNS hosting), [Kindle](https://privacyratings.com/ebook-readers/kindle/) (Ebook readers), [Amazon Alexa](https://privacyratings.com/smart-home/amazon-alexa/) (Smart home), [Amazon Music](https://privacyratings.com/music-streaming/amazon-music/) (Music streaming), [Amazon Photos](https://privacyratings.com/photo-management/amazon-photos/) (Photo management)
- Grade: D (45/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | AWS websites set cookies from third parties including The Trade Desk, Oracle BlueKai and LinkedIn. | https://aws.amazon.com/legal/cookies/ |
| No ads or data sales | No | The privacy notice says cookies and identifiers are used to advertise to visitors on third-party websites. | https://aws.amazon.com/privacy/ |
| Independent audit | Partial | Only the SOC 3 summary report is public; SOC 1 and SOC 2 reports are available to customers in AWS Artifact. | https://d1.awsstatic.com/onedam/marketing-channels/website/aws/en_US/whitepapers/compliance/AWS_SOC3_Report.pdf |
| Transparency report | Yes | Semi-annual reports with counts of government requests to Amazon and AWS and how they were answered. | https://d1.awsstatic.com/onedam/marketing-channels/website/aws/en_US/security/pdfs/Amazon_Government_Request_Report_H1_2026.pdf |
| Tells users about requests | Yes | Amazon notifies customers before disclosing content unless prohibited or there is clear indication of illegal conduct. | https://www.amazon.com/gp/help/customer/display.html?nodeId=GYSDRGWQ2C2CRYEF |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=console.aws.amazon.com&hideResults=on |
| Security headers | Yes | Grade A+ (105/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=console.aws.amazon.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Mail-friendly (port 25) | Partial | Outbound port 25 to public addresses is blocked by default, and customers can request removal of the restriction. | https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html |
| Reverse DNS | Partial | Reverse DNS can be set for Elastic IP addresses, which are IPv4 only. | https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html |
| IPv6 | Yes | IPv6 addresses can be assigned to instances, and only public IPv4 addresses carry an hourly charge. | https://aws.amazon.com/vpc/pricing/ |
| Anonymous payment | No | Payment is by card or direct debit. Cryptocurrency is not accepted. | https://repost.aws/knowledge-center/accepted-payment-methods |

Source: https://privacyratings.com/server-hosting/amazon-web-services/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/server-hosting/amazon-web-services.md