The situation
A manufacturer runs four plants. Two of them sit in a country whose regulator treats plant maintenance records as critical-infrastructure data. The raw records, the sensor histories, the fault codes, and the engineers’ free-text notes must remain physically on the site that produced them. Not in-country. On site. The regulator has audited the manufacturer twice and asked both times where the records were stored, and the answer both times was a rack in the plant’s own server room.
The team wants a plant assistant over those records. A technician standing at a stopped line should be able to ask why this pump keeps tripping, and get back the three most similar past faults with what fixed them. The records that would ground the answer are precisely the records that cannot be exported.
There is a second use case attached to the same handheld. The device runs a live checklist that reads a tag, validates the entry, and confirms it before the technician’s thumb leaves the screen. The plant’s operations lead has put a number on it: under 20 milliseconds for the confirm, because anything slower and the technicians start double-tapping and the checklist data goes bad. That handheld talks over the plant’s private 5G, not over wired networking.
The other two plants are in a jurisdiction with no such rule. The team would rather not build two entirely separate products.
What actually matters
“The data cannot leave” is never a single requirement, and the first useful move is to break the sentence into classes of bytes. There is the raw maintenance record, which the regulator named. There is derived text: a summary, a redacted excerpt, a fault code with the site identifier stripped. There is an embedding, which is a lossy numerical projection of text and is treated as a copy by some regulators and as a derivative by others. And there is the model’s answer, which may quote the source or may only describe it. A rule that pins the raw record does not automatically pin all four, but assuming it does not is how organisations end up in front of an auditor. Designing for data compliance across jurisdictions starts with getting a written answer, per class, on what may cross and what may not, because that answer decides the architecture and nothing else does.
The second thing to separate is latency from generation. Sub-20 millisecond response and foundation-model inference are not in the same conversation. A model call is hundreds of milliseconds at best and often seconds. Physical proximity does not change that. A first token that takes 400ms takes 400ms whether the model sits in a Region 30ms away or 3ms away. What the 20ms budget actually covers is the interactive layer: capturing the tag, validating the field, looking up a cached answer, and painting the confirmation. Those are the operations worth moving toward the user. Moving the model toward the user does very little for them and costs a great deal.
Third, somebody has to own the hardware. Putting compute in the plant or at a carrier’s edge site means a physical footprint with a capital-shaped commitment behind it. It also means a maintenance window, a spares story, and a person whose job includes the rack. That expense is worth it when it delivers a guarantee you cannot get another way, and it is waste when a Region in the same country would have satisfied the rule. Hybrid cloud architectures are justified by an obligation that cannot be met in a Region, not by a preference for local hardware.
Fourth, and this one settles most of the design: Amazon Bedrock is a Regional service. It does not run on an Outpost and it does not run at a Wavelength Zone. So the foundation model stays in a Region no matter what the rest of the architecture does, and everything that moves outward moves outward around it. What can sit on site is the record store, the retrieval index over it, the embedding of already-sanitised text, and a cache of answers already returned. So can the redaction and tokenisation step that turns a protected record into something safe to send. What cannot sit on site is the model. Cross-environment AI solutions are shaped by that asymmetry: the data goes to the edge, the inference does not follow it.
What we’ll filter on
- Which bytes cross. Does the design send a raw protected record over the boundary, or only text that has already been redacted or tokenised on site?
- Where the model runs. Does the option keep access to the managed foundation-model catalogue, or does it trade that away for local weights?
- Interactive latency. Can the sub-20ms confirm path be served without a round trip to a Region?
- Hardware and cost shape. Does the option add a rack somebody has to own, and is the residency guarantee worth that commitment?
- Routing and evidence. Is the path between the plant and the Region private, resolvable, and auditable, so a regulator can be shown what crossed?
The landscape
An in-country Region reached over PrivateLink
The lightest option: run everything in an AWS Region inside the same country, and keep the record store in Amazon S3 under a customer-managed KMS key. Bedrock is reached from a VPC over an interface VPC endpoint, so the traffic never touches the public internet. This is the standard secure posture, covered in the four planes of a Bedrock deployment, and for the two plants in the permissive jurisdiction it is the whole answer.
It fails the strict jurisdiction on one word. The regulator said on site, and an in-country Region is not on site. Region choice satisfies residency rules written at the level of the country; it does nothing for a rule written at the level of the building.
AWS Outposts in the plant
AWS Outposts for on-premises data integration puts an AWS-managed rack in the plant’s own server room, running AWS services on hardware that physically sits inside the boundary the regulator drew. The records land in local storage. A retrieval index over them runs on local compute. The redaction step runs there too, stripping site identifiers, employee names, and serial numbers. What leaves the plant has already had the protected fields removed or swapped for tokens whose mapping stays behind. The Outpost connects back to its parent Region as an extension of a VPC. That makes secure routing between cloud and on-premises resources a configuration rather than a bespoke build, because the private path is the same path the rest of the VPC uses.
What Outposts does not give you is Bedrock. The foundation models are not part of the service catalogue that runs on an Outpost, so the generation step still leaves for the Region. The rack holds the data and the sanitising step; the Region holds the model.
AWS Wavelength at the carrier edge
AWS Wavelength to perform edge deployments places compute inside a telecommunications provider’s 5G network. Traffic from a device on that network reaches the application without traversing the internet or backhauling to a Region. For the handheld’s checklist confirm, that is the mechanism that makes a single-digit-millisecond network hop possible. The application code running there is an ordinary EC2 instance or container: the tag validation, the field checks, the cached-answer lookup, the response the technician actually feels.
Wavelength has the same limit as Outposts on the model. Bedrock is not available in a Wavelength Zone, so nothing there generates anything. It serves the interactive layer, and it hands the slow path onward.
Self-hosting an open-weight model on local hardware
The remaining option is to stop using a managed model at all. An open-weight model runs on GPU capacity in the plant, on EC2 instances on the Outpost or on containers scheduled there, and generation happens inside the boundary with everything else. This is the only option where a protected record can reach a model verbatim.
The bill for that is large and it is not mostly financial. You give up the managed catalogue, so switching models becomes a redeployment rather than a configuration change. The technique in keeping the model identifier out of the code path loses most of its value when there is one model and you built the box it runs on. You own capacity planning for GPUs in a building that was not designed as a data centre. You own model updates, security patching, and evaluation of every new version yourself. It is a real answer for a genuinely absolute rule, and an expensive mistake when redaction would have been enough.
The trap in the routing layer
One configuration deserves naming because it is easy to switch on and directly violates a residency rule. A cross-Region Inference profileA Bedrock resource wrapping a model so calls to it can be tagged, routed across regions, or repointed without changing app code. spreads Bedrock invocations across several Regions to absorb bursts, which is exactly what you want for throughput and exactly what a jurisdictional rule forbids. Spreading load across Regions is a good default and a compliance breach here. The same caution covers the failover patterns in a multi-Region resilience design, because a failover that lands in a Region outside the permitted jurisdiction has failed differently, not gracefully. For the constrained plants, the profile is pinned to one Region and the IAM policy denies any other.
For the routing itself, Amazon Route 53 resolves the assistant’s name differently depending on where the caller is, so the handheld at a constrained plant reaches the local endpoint and one at an unconstrained plant reaches the Regional one. Amazon CloudFront fronts the static and cacheable parts of the interface, and AWS Global Accelerator gives the Regional endpoints a stable anycast address for the plants that talk to them directly.
Evaluation
Side by side
| Option | Raw records stay on site | Managed model catalogue | Serves the sub-20ms path | No local hardware to own | Private path to Bedrock |
|---|---|---|---|---|---|
| In-country Region + PrivateLink | ✗ | ✓ | ✗ | ✓ | ✓ |
| AWS Outposts in the plant | ✓ | ✓ (in the Region) | ✗ | ✗ | ✓ |
| AWS Wavelength at the carrier edge | ✗ | ✓ (in the Region) | ✓ | ✗ | ✓ |
| Open-weight model on local hardware | ✓ | ✗ | ✗ | ✗ | n/a |
No row wins. The first row is the cheapest and fails the rule that started the project. The last row satisfies the rule absolutely and costs the catalogue, the upgrade path, and a GPU fleet in a factory. The two middle rows each solve one problem and neither solves the other, which is the signal to compose rather than select. Outposts answers the residency question, Wavelength answers the latency question, and the Region answers the generation question.
The solution
Put an Outpost in each constrained plant and give it the record store, the index, and the sanitising step. The maintenance records land in local storage on the rack and are never copied to a Regional bucket. The retrieval index over them runs on local compute, so a query about a tripping pump is answered by searching documents that never moved. The redaction and tokenisation step runs on the Outpost as well. A step that sanitises data has to execute on the safe side of the boundary; running it in the Region would mean the protected record had already crossed. Site identifiers, employee names, work-order numbers, and serial numbers are replaced with stable tokens, and the mapping table stays on the rack. A returned answer is re-expanded locally, and the Region never sees the real value. The same substitution discipline covers the ground in keeping identifying data out of prompts and logs, applied to a jurisdictional boundary rather than a privacy one.
Send only the sanitised text to Bedrock in the in-country Region, over an interface VPC endpoint backed by AWS PrivateLink, from the VPC the Outpost extends. The prompt that leaves the plant contains a question, three tokenised excerpts, and nothing that identifies a site or a person. Model invocation logging captures what was sent, and that log is itself the evidence a regulator asks for: a record of exactly which bytes crossed, retained under a customer-managed key. The inference profile is pinned to the single permitted Region, and the application role’s IAM policy denies invocation on any other. No configuration change and no failover can quietly route a call across a border.
Run the handheld’s interactive layer at a Wavelength Zone on the plant’s carrier. Tag capture, field validation, the checklist state machine, and the answer cache all live there, close enough that the confirm lands inside the operations lead’s budget. When a technician asks a question the cache cannot answer, the Wavelength component hands it back to the Outpost for retrieval and on to the Region for generation. The interface says so rather than pretending the answer is instant. Splitting the fast path from the slow path this way lets one number be met without pretending the other one can be.
Route by jurisdiction rather than by product. Route 53 resolves the assistant’s endpoint to the local path at a constrained plant and to the Regional path at an unconstrained one. CloudFront fronts the cacheable interface assets everywhere, and Global Accelerator gives the Regional endpoints one stable address. The application stays one codebase, with its retrieval and redaction layer configured per site. The two plants in the permissive jurisdiction run the plain Regional deployment; the constrained plants run the same code with the local store and the sanitising step switched on.
Leave the open-weight local model on the shelf. Revisit it only if the regulator’s position hardens from “the records must not leave” to “no derivative of the records may leave”. At that point there is nothing sanitised enough to send, and the model has to come to the data. Until then it costs the catalogue and the upgrade path to solve a problem that redaction already solves.
Worked example
A technician at a constrained plant stops at line 3 and asks the handheld why the transfer pump keeps tripping.
The keystrokes and the tag scan are handled at the Wavelength Zone. The tag is validated against the local asset list and the confirm paints in single-digit milliseconds; the technician’s thumb is already off the screen. The cache is checked for this asset and this fault code, misses, and the request goes back to the plant.
On the Outpost, the retrieval index searches the plant’s maintenance history and returns three past work orders for the same pump. Those documents never leave local storage. The redaction step rewrites the three excerpts. The plant code becomes a token, the two engineers’ names become tokens, the serial number becomes a token, and the free-text notes are scanned for anything that identifies the site. What comes out is three paragraphs about a pump that trips on high discharge pressure after a filter change, with no way to tell which pump or where.
That sanitised text plus the technician’s question travels the interface VPC endpoint to Bedrock in the in-country Region. The model reads three anonymised histories. It answers that the trips follow filter changes, that two were resolved by re-priming before restart, and that the third turned out to be a stuck check valve. The response comes back over the same private path.
Back on the Outpost, the tokens in the answer expand to the real work-order numbers so the technician can open them. The exchange is written to a local audit record alongside the Regional invocation log. The next audit shows the regulator two things: the records still sitting on the rack in the plant, and a log of every prompt that crossed the boundary. Nothing identifying appears in any of them.
What’s worth remembering
- Break “the data cannot leave” into raw records, derived text, embeddings, and answers, then get a written ruling per class: a rule pinning the raw record may still permit sanitised text to cross.
- Amazon Bedrock runs only in Regions, so an on-premises or edge design moves the data, the redaction step, the index, and the cache outward, and leaves the foundation model where it is.
- AWS Outposts answers a rule written at the level of the building, which Region selection cannot; use it when in-country is genuinely not enough, and expect to own a rack.
- AWS Wavelength serves the interactive layer that a person actually feels, not generation, because no amount of proximity makes a foundation-model round trip fast.
- A cross-Region inference profile, and any multi-Region failover, will route invocations outside a permitted jurisdiction; pin the profile to one Region and deny the rest in IAM.
- Redaction and tokenisation have to execute on the protected side of the boundary, and the invocation log of what crossed is the evidence an auditor will ask to see.