View a markdown version of this page

PII, consent, and log redaction - Guidance for Agentic Vehicle Experience on AWS
PII redaction in logsData residency

PII, consent, and log redaction

AVX handles personally identifiable information — caller identity, vehicle location, call recordings, and conversation transcripts — as regulated data. The handling posture is: collect the minimum required for service delivery, redact by default in logs, and gate session recordings on explicit per-tenant consent configuration.

PII redaction in logs

AVX Lambda handlers and the AgentCore supervisor follow a redact-by-default discipline:

  • Phone numbers and account IDs extracted during caller resolution are masked in all CloudWatch log messages. Logs reference the resolved sub (Cognito subject) and tenantId rather than the raw contact identifier.

  • Vehicle location coordinates (latitude/longitude) from live telemetry are never written to application logs. The AgentCore supervisor prompt instructs the model to omit raw coordinates from any text it generates; coordinate data is consumed by tool logic and surfaced only as a human-readable location description (city/region level or service-center proximity, not GPS-exact).

  • Transcripts of Connect chats are stored in Connect’s managed storage. AVX does not copy raw transcript content to application logs; references in logs use the session ID only.

A tenant’s data lives in the Region where AVX is deployed; no tenant setting moves it. To keep a tenant’s data in another Region, deploy AVX in that Region.