Skip to content
KisunoAI
Self-host for free Get started
Pricing Docs Blog Get started Self-host for free

Models and operation

Claude Opus and Sonnet on Amazon Bedrock: three workflows, and where the data is really processed

Anthropic’s top models can be reached through Kisuno, run on Amazon Bedrock in the Frankfurt data centre. DORA, the proposed Cloud and AI Development Act and Chapter V of the GDPR all put the same question to you: where the processing happens. This article walks through three workflows, explains the architecture behind them and names the drawback that stays.

Models and operation Reading time: 12 minutes

In brief

  • In a Swiss survey, 51% of the companies asked call it business critical that AI systems meet Swiss or European data protection requirements.1
  • Kisuno gives you access to Anthropic’s models, Claude Opus and Claude Sonnet. They run on Amazon Bedrock, the model service from AWS, and specifically in the AWS data centre in Frankfurt.
  • Your documents, knowledge bases, conversation histories and accounts stay on the Swiss server or on your own. Only what a single request needs goes to the model, and it is not stored there.
  • The drawback, stated plainly: AWS is a US company, so the US CLOUD Act applies. Where the servers stand does not protect against that, and encryption does not help at the moment of processing.

Starting point: the best model or the right place

In European companies artificial intelligence has arrived in everyday work. Scaling it has not. A Swiss survey by EY among 604 people in Swiss companies records that for half of the respondents, exactly 51%, it is business critical that AI systems meet Swiss or European data protection requirements.1 Not desirable, not important: business critical. That makes the location of the data something other than an argument for the second meeting. It is a condition a project fails on.

The European statistics show the same thing from the other side, and for this audience they are the figures to start from. According to Eurostat, 19.95% of enterprises in the EU with ten or more employees used artificial intelligence in 2025. Among those that looked at it and then let it go, 48.8% named concerns about data protection and privacy.2 That number covers the whole Union rather than one country, which is why it carries more weight here than any single national survey. In Germany, 54% of the companies surveyed say data protection is holding back the use of AI in their own business.3 Three surveys, three sets of countries, one finding.

The obvious answer is to use a European model instead. The same body of research shows that this answer does not sell. In the Bitkom Cloud Report, a German survey, 78% of the companies asked consider Germany too dependent on US cloud providers, but 65% would accept none of the drawbacks put to them in exchange for digital sovereignty: not longer waits for new features, not missing features, not higher costs.4 Sovereignty is wanted and not paid for as soon as it costs performance. That is uncomfortable, and it is the most honest number in this article.

That sets the task. Not to replace the good model with a European one. Instead, to bring in the model people will choose anyway, in a way that keeps the body of documents where it belongs and lets someone say afterwards what happened where. The next sections show what that looks like, first in three workflows, then in the architecture, and last in the limit that stays.

  1. Your documents and knowledge bases stay on your server
  2. Only the extract a request needs goes with it
  3. The model runs in the AWS data centre in Frankfurt
  4. Answer with its source, log entry on your side
The path of a single question. Anything not on that path stays where it is.

Who asks for this: a sober look at the demand

The question about location is rarely a matter of taste. In most cases someone stands behind it who has a regulation, a contract or a supervisor at their back. Chapter V of the GDPR sets the frame for everyone: a transfer to a third country needs a legal basis and it has to be documented, whatever the service is called. For banks and insurers in Europe, DORA, the regulation on digital operational resilience in the financial sector, goes further and requires the contract for an IT service to state in which regions and countries the service is performed and where data is stored, with advance notice when that changes.5 National supervisors ask for the same evidence in their own audits. Because we operate from Switzerland, the FINMA outsourcing circular applies here as well: the institution, its audit firm and the supervisor must be able to exercise their inspection and audit rights even when a service is outsourced abroad, and the information needed for a resolution has to be accessible in Switzerland at all times.6

For the public sector, a preference is turning into a procurement condition right now. The European Commission has proposed a Cloud and AI Development Act which sets out four sovereignty levels for cloud and AI services. The first requires that data is processed and stored in infrastructure inside the Union.7 That is a proposal and not law yet, but anyone supplying public administrations today already knows the direction from the questionnaires.

So why Anthropic’s models in particular? Because companies pick them anyway. A survey by Menlo Ventures among 495 decision makers puts Anthropic’s share of enterprise spending on language model interfaces at 40%, and at 54% in the coding segment.8 That sample is American, and we do not pass it off as a European figure. The European figure alongside it says something else. According to Synergy Research, the three large American providers hold around 70% of the European cloud market, and the European providers together hold 15%.9 Anyone serious about sovereignty has to work with that picture instead of arguing against it.

Who asks What triggers the need Where the top model makes the difference
Banks and insurers DORA requires the regions and countries of processing to be named in the contract, and national supervisors ask for the same evidence; in Switzerland the FINMA circular adds inspection rights and access in the country Holding new circulars and regulations against your own internal rules, with a source on both sides
Public administration and its suppliers The proposed Cloud and AI Development Act provides for processing and storage inside the Union at its first level Opening up long consultation and tender documents, in several languages
Law firms, accountants, medical practices Professional secrecy under national criminal law, plus client, payroll and patient data Opening up files, contracts and correspondence without losing the source
Manufacturing and construction Design and costing data are trade secrets; customer audits ask about the chain Reading tenders, specifications and revised standards in full and finding the contradictions
Engineering and digital teams Source code and system knowledge should not leave the organisation Reading large code bases, preparing changes, finding faults along the chain

What links these five groups is not the sector but the kind of work: a lot of text at once, a rule that has to be followed exactly, and a chain of steps that has to hold together. That is precisely where the difference between a small model and a large one shows. For classification, extraction and short summaries a small model is still enough, and it costs a fraction as much. The administration makes that choice, not chance.

Use case 1: the long document nobody reads in full

A tender arrives with the main document, seven annexes and references to three standards. By the time anyone knows whether a bid is worth making, two days are gone and the deadline for questions is running. You put the whole set into the workspace for that case. Back comes a list: every requirement on its own, with the passage it comes from, next to it what your organisation can already evidence, and what is missing.

The difference from a smaller model is not in the single sentence, it is in the span. A requirement in Annex C contradicts an assurance in the main document. A date in a footnote on the price sheet does not match the deadline in the schedule of works. Contradictions like that only show up for a reader who holds the whole text in view at once. That is exactly what the large models are built for.

  1. Main document, annexes and references to standards, as they arrive
  2. Opened up against your organisation’s own documents
  3. Requirements with evidence, open gap and question to ask
The stack becomes a working list. Whether you bid is still your own decision afterwards.

What does not happen: nothing is submitted and nothing is promised. A language model can miss a requirement or attach the wrong source to a line, and it does so more readily the longer the text gets. A large context window is a possibility, not a promise: what fits into it is not therefore found again reliably. That is why every line carries the passage it comes from, and why the list is a draft to be checked, not a statement of eligibility.

Use case 2: the new rulebook against your own practice

A regulation is revised, a circular comes out, a standard appears in a new version. The question is the same every time and tedious every time: which parts of this concern us, and where does our current practice differ? The AI colleague puts the new rulebook and your own instructions, templates and process descriptions side by side and delivers a list of deviations: covered, open, contradictory, each with a source on both sides.

This task is the reason why the choice of model is not a detail. A small model finds the literal matches. The difference lies in the place where two formulations mean the same thing without using the same words, and in the place where two similar formulations do not mean the same thing at all. Anyone who has ever built a list of deviations by hand knows that this is where the work sits.

  1. The new rulebook in the version in force
  2. Your instructions, templates and process descriptions
  3. List of deviations with a source on both sides
Two bodies of text, one list. Judging what follows from it stays with the specialists.

The same limit applies here as everywhere: the result is a pointer, not a decision. In regulated areas it replaces neither the qualified professional nor the internal sign-off, and it is not legal advice in any case.

Use case 3: the case that runs across several systems

An enquiry comes in, and the answer sits in three programs: the contract in the document store, the delivery status in the ERP system, the last exchange of letters in the mailbox. Today a person clicks through all three. The AI colleague can take that over once the systems are connected. It plans the steps, calls the released tools one after another, checks every intermediate result and puts a draft up for approval at the end.

This chain is the real test. Hardly any model fails on a single step. What fails is holding out across seven of them: keeping the task in view, recognising an empty result as empty instead of inventing one, and stopping once the answer is there. Models in the Opus and Sonnet class are built for that, and that is what we use them for.

  1. The enquiry as it arrives
  2. The AI colleague plans the steps
  3. Calls into the connected systems, draft for approval
Every system is connected through MCP. Permissions apply per tool, and every call is recorded in the log.

MCP stands for Model Context Protocol, an open standard for connecting external systems. What the AI colleague is not allowed to see there, it does not see: the order is individual user, role, group, server default. Write access has to be released separately. Which software can be connected today is listed on the Integrations page.

The architecture: what runs where

The split is simpler than it sounds. Your documents, your knowledge bases, your accounts, the conversation histories and the audit log stay where they are today: in the ISO 27001 certified data centres run by Green in Lupfig, or on your own server. In the model access, the only thing that changes is the moment a question reaches a model.

That moment runs through Amazon Bedrock, the model service from AWS. Bedrock is not a program sitting in a cabinet at our office, it is a service AWS operates. For a request, your instance assembles what the model needs: the question, the course of the conversation and the extracts from your documents that belong to the answer. That package goes out encrypted, the model runs, the answer comes back and is filed with you. The body of documents does not travel with it. What never becomes part of a request, Bedrock never sees.

  1. Documents, knowledge bases and accounts on your server
  2. Only the extract the question needs leaves the instance
  3. Execution on Amazon Bedrock in the Frankfurt data centre
  4. Answer and log entry come back to you
The body of documents stays where it is. Only what the single question needs is in transit.

Now the question of regions, and here we would rather say it ourselves than leave it to someone else. The obvious choice would be the AWS region Zurich. Anyone concluding from that the model runs in Zurich is wrong. AWS offers three modes for models: In-Region, where a request never leaves the chosen region, a geographic profile that distributes within one area, and a worldwide profile. For Claude Opus and Claude Sonnet, In-Region is not on offer in Zurich.10 Under the geographic profile for Europe, AWS undertakes that the data stays in European regions, and AWS itself decides which region processes the individual call.11 So we name the place: the models from OpenAI (ChatGPT) and Anthropic (Claude) that Kisuno offers run in the AWS data centre in Frankfurt. Alongside them, for customers with higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there.

For the processing itself, AWS states three undertakings you can look up. By default, inputs and outputs are not stored. Nobody operating the service sees them. And the model provider gets no access to them: the models run in separate accounts held by the Bedrock team, which the provider cannot enter. No model is trained on your inputs and outputs.12 The small print belongs here too. For a few individual models AWS names an exception, under which data is kept for up to 30 days for abuse detection, in the region that processes the call. Opus and Sonnet are not on that list.21 On our side the same undertaking is written into the data processing agreement, and everyone involved in the chain is named in the subprocessor list.

On our side everything stays as it was, and that is the point. The administration decides which models are available at all and which one is the default. Permissions apply down to individual tools. Every call is in the audit log, which you can export, and usage is broken down per model. If you self-host, you set up the route to the model yourself in any case, and you can leave this one out.

The drawback: AWS is a US company

Up to here a lot of this has sounded like an advantage. Now the part a provider had better say itself. Amazon Web Services is a US company, so the CLOUD Act of 2018 applies. The law obliges providers to hand over data in their possession, custody or control, and it says so expressly whether the data sits in the United States or anywhere else.13 AWS writes itself that the law applies to all providers that operate in the US or have a legal presence there.14 Where the servers stand does not protect against that. Anyone claiming otherwise is selling you a map instead of an answer.

The opposite is just as untrue. The European Data Protection Board and the European Data Protection Supervisor state in their joint assessment that the CLOUD Act does not permit systematic, large scale or indiscriminate collection, but governs targeted requests with procedural safeguards.15 For content data the normal route is a judicial order. The same assessment points out, though, that the CLOUD Act leaves further routes open beside it, among them official demands for disclosure that no judge reviews.

What a provider can say about this was shown at a hearing in the French Senate on 10 June 2025. Before the committee of inquiry, where witnesses are sworn in, a representative of Microsoft France was asked whether he could guarantee that data belonging to French citizens would never be handed over on an order from the US government. His answer: no, he could not guarantee that, although it had never yet happened.16 Both halves belong together. We could not give you that guarantee either, and nobody in Europe using an American model can give it.

How often it happens is published by Amazon twice a year. In the first half of 2026, AWS handled 2,310 government requests worldwide. In one single case content data was handed over, in all the others only subscriber and usage data. Asked in how many cases content data belonging to enterprise or government customers outside the United States went to the US government, AWS answers in its own report with one word: none.17 Three qualifications belong to an honest reading of that. It is self reported, it covers only this narrowly drawn group, and requests in the field of national security are not included; by law those may only be reported as a range from 0 to 249.

Encryption is often brought up at this point, and this is exactly where care is needed. Encryption with your own key works for stored data and on the transport path. It does not work at the moment of processing, because a language model has to be able to read the text in order to answer it. The European Data Protection Board set this out in its Recommendations 01/2020: where a service provider needs the plain text, it sees no effective technical protective measure given the current state of the art.18 An offer that promises you encryption at precisely this point is worth a closer look.

What is left is unspectacular and effective: give away less. Your documents, knowledge bases, histories and accounts sit on the Swiss server or on your own. What goes to the model is the text of the single request, and it is not stored there. A provider can only hand over what it has. That is not legal immunity, but it reduces the scope and the time window of a possible access. If even that is too much, there are two routes: choose one of the open frontier models on European servers, or self-host and determine the chain yourself from the first link to the last.

For completeness the legal framework, without turning it into advice. Transfers to the United States fall under Chapter V of the GDPR, and on both sides of the border an adequacy decision is in place. The Swiss Federal Council added the United States to its list of countries in September 2024, but only for companies certified under the Swiss-U.S. Data Privacy Framework.19 On the European side the adequacy decision of 2023 applies. The General Court of the European Union dismissed an action against it on 3 September 2025, and an appeal is pending, so the matter is not settled.20 For those bound by professional secrecy, national criminal law comes on top, in Switzerland Article 321 of the Swiss Criminal Code. Whether an AI service with an American subprocessor is permissible there is judged differently in the literature and has not been decided. Check this for your own case, and if in doubt with your professional association. This article does not replace legal advice.

Frequently asked questions about Claude Opus, Claude Sonnet and Amazon Bedrock

Does this mean Claude Opus and Claude Sonnet run in Switzerland?

No, and we would rather say that plainly. Execution runs in the AWS data centre in Frankfurt. A mode that ties Claude Opus or Claude Sonnet to the Zurich region is not offered by AWS. Your documents are untouched by this and stay on the Swiss server or on your own.

Does Anthropic train on our data?

No. For Amazon Bedrock, AWS states that neither AWS nor the model providers use inputs or outputs for training, and that the model providers get no access to requests and responses at all: the models run in separate accounts held by the Bedrock team. On our side the same undertaking is in the data processing agreement.

What does the CLOUD Act mean for us in practice?

That a US authority can demand data from AWS which AWS holds, regardless of where it is stored. What AWS holds in the course of a model request is the text of that request, and it is not stored. Your documents, knowledge bases, histories and accounts sit outside that area. This is not a guarantee, it is a smaller attack surface. Anyone who does not want even that chooses one of the open models on European servers or self-hosts. This section does not replace legal advice.

Does encryption not solve the problem?

Not at this point. Encryption protects what is stored and the transport path. But a language model has to read the text in order to answer it, and for exactly that case the European Data Protection Board states that it sees no effective technical protective measure given the current state of the art. So the only thing that works is data minimisation: what does not go out cannot be handed over.

Are there also models the CLOUD Act does not reach?

Yes. For customers with higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there. The administration decides which routes and which models are available in your organisation and which model is the default. There is no obligation to use one route or the other.

Which model should we use?

For classification, extraction and short summaries a small model is enough, and it is considerably cheaper. A top model pays off when a lot of text has to stay in view at once, when a task runs across several steps and tools, or when a rule has to be followed exactly. Usage is broken down per model so that this choice stays traceable.

What does this cost on top?

Nothing extra. Testing is free and not limited in time; every new account starts with a starting credit of CHF 50 (EUR 55) for model usage. The managed instance costs CHF 7 (EUR 7.50) per person per month, through the end of the current month with 50 percent off on a twelve-month term, that is CHF 3.50 (EUR 3.75). Top models use up that credit faster than small ones, which is exactly why the choice of model is a setting and not a side issue. All the details are on the pricing page.

Does this work with self-hosting too?

Yes, and there you determine the whole chain yourself: you enter the access details for whichever model service you want, or you leave it out and run a model of your own. The LibreChat base is MIT licensed; the repository with our own extensions follows shortly. What that means in operation is described under Self-hosting.

Walk through it on a document of your own

Bring an anonymised tender, a rulebook or a case, and we will walk through the workflow together. Or sign up and try it yourself.

Book a live demo Get started

Sources

All figures and undertakings in this article come from the following sources, last checked in September 2026. The surveys come from different sets of countries, and we have said in the text which one is meant each time.

  1. EY Switzerland, survey on the use of artificial intelligence in Swiss companies, 604 respondents, published on 27 May 2026: ey.com
  2. Eurostat, Use of artificial intelligence in enterprises, reference year 2025: ec.europa.eu
  3. Bitkom Research, study report on data protection, 603 companies surveyed in Germany with 20 or more employees, report of February 2026: bitkom.org
  4. Bitkom, Cloud Report 2025, 604 companies surveyed in Germany with 20 or more employees, published on 11 June 2025: bitkom.org
  5. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Article 30(2)(b): eur-lex.europa.eu
  6. FINMA Circular 2018/3 Outsourcing, version in force since 1 January 2021, margin numbers 30 and 31: finma.ch
  7. European Commission, Cloud and AI Development Act, proposal with four sovereignty levels: digital-strategy.ec.europa.eu
  8. Menlo Ventures, The State of Generative AI in the Enterprise, 495 decision makers surveyed in the United States, November 2025: menlovc.com
  9. Synergy Research Group, market shares in the European cloud market, 24 July 2025: srgresearch.com
  10. Amazon Web Services, model cards for Claude Opus 5 and Claude Sonnet 5, Regional Availability section: In-Region is not supported in the Europe (Zurich) region for either model, whereas the geographic profile for Europe is: Opus 5, Sonnet 5
  11. Amazon Web Services, cross-region inference from the Zurich region, post of 21 October 2025: “your content generally remains in the source Region; however, notably, your input prompts (request data) move outside”: aws.amazon.com
  12. Amazon Web Services, Data protection in Amazon Bedrock, on the model deployment accounts to which the model providers have no access; non-storage and operator access are set out on the page named in footnote 21: docs.aws.amazon.com
  13. Clarifying Lawful Overseas Use of Data Act (CLOUD Act) of 2018, inserted as 18 U.S.C. § 2713: congress.gov
  14. Amazon Web Services on the CLOUD Act: “The CLOUD Act applies to all electronic communication service or remote computing service providers that operate or have a legal presence in the U.S.”: aws.amazon.com
  15. European Data Protection Board and European Data Protection Supervisor, joint response on the US CLOUD Act, 10 July 2019: edpb.europa.eu
  16. Sénat, committee of inquiry into public procurement, hearing of 10 June 2025, testimony under oath: “Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit.”: senat.fr
  17. Amazon, Government Request Report for the first half of 2026, published on 31 July 2026: awsstatic.com
  18. European Data Protection Board, Recommendations 01/2020 on supplementary measures, version 2.0 of 18 June 2021, paragraphs 94 and 95: edpb.europa.eu
  19. Federal Data Protection and Information Commissioner on the Swiss-U.S. Data Privacy Framework, in force since 15 September 2024: edoeb.admin.ch
  20. General Court of the European Union, judgment of 3 September 2025 in Case T-553/23 on the EU-U.S. Data Privacy Framework, press release No 106/25: curia.europa.eu
  21. Amazon Web Services, Amazon Bedrock abuse detection, on zero data retention and the models with an exception: docs.aws.amazon.com