Azure OpenAI and Amazon Bedrock: GPT and Claude on your company data, in your own account

Your company can use GPT and Claude on its own data without a new vendor contract: requests run through your existing Azure or AWS account, can stay on private network paths, and appear on the invoice you already receive. Teams get one approved route to the models, so nobody needs a private account to get work done.

Where the provider and the processing location matter to your customers or your data protection officer, you can show where every request goes. In a Bitkom study published in 2026, 93% of companies said they prefer German AI providers, and 88% said the provider's country of origin is important. An EU deployment in your own account answers part of that question. Where it is not enough, the same gateway sends sensitive work to models on your own servers.

• Commercial models on internal documents and cases, under contracts you already manage.
• Processing in the EU, enforced in one place for all teams.
• A key and a budget for each team, with spend reported per team and application.
• No lock-in: Azure, AWS and your own models behind one API, so you can switch per task.

Running models through your own Azure or AWS account keeps them under contracts, data processing agreements, identity, networking and billing you already manage. Requests can stay on private network paths, access follows your existing roles, and spend appears on the same invoice as the rest of your infrastructure.

Where a request is processed depends on the deployment type you choose, not only on the region. On Azure, a global deployment may route requests outside the region you picked, while an EU data zone deployment keeps processing within the EU. On Amazon Bedrock, requests run in the region you call or, with an EU cross-region inference profile, across EU regions. A global inference profile can route requests worldwide. Which models are available in which deployment type changes often, so we check the current lists for the models you need.

Data location and legal jurisdiction are different questions. Microsoft and Amazon are US companies, and an EU region does not by itself remove the reach of US law such as the CLOUD Act. For many companies the contracts, encryption and EU processing are enough. Where they are not, the answer is your own servers or an EU provider, and we cover that with on-premise AI. This is not legal advice: you make that call, advised by your data protection officer and lawyers.

Both providers state that prompts and answers in these services are not used to train the models and are not passed to the model vendors. Azure applies abuse monitoring that can involve keeping data for a limited time, with an application process for changing it. We go through the current terms with your data protection officer, because they are updated, and record the result in the system documentation.

A LiteLLM gateway in front of all deployments gives every team one API, with keys, budgets and logs per team. Its model list can contain only EU deployments, with no fallback to global ones, so the routing rule is enforced in one place instead of in every application. Models you serve yourself with vLLM can sit behind the same gateway.

Providers retire model versions and release new ones on their own schedule. We test the system against agreed acceptance criteria before go-live, and run the same tests before every model version change, so a provider update cannot quietly change how your assistant answers.