Claude on Bedrock, Vertex or the Anthropic API: pick for control, not fashion
The right Claude runtime is about data residency, IAM and procurement, not a leaderboard. Match the platform to the review you have to pass.
Claude runs on the Anthropic API, Amazon Bedrock and Google Vertex. Quality differences on a given model generation are usually smaller than the differences in IAM, networking, logging and legal paper. Pick the runtime that your security review can sign.
A startup with no residency constraint can start on the Anthropic API and move later. A bank that already lives in AWS will often want Bedrock. A public-sector buyer may dictate Vertex or a private region. None of those choices replace evals or tool design.
What actually changes
| Concern | Why it matters |
|---|---|
| Data processing terms | Training, retention, subprocessors |
| Identity | How the app authenticates, not a shared key in Slack |
| Networking | PrivateLink, VPC-SC, no public egress |
| Quotas and batch | How you absorb a launch spike |
| Feature lag | Caching, tools, computer use land on platforms on different clocks |
Do not fork the product per cloud
Keep the agent loop, schemas and evals in your repository. Treat the model client as an adapter. If you fork prompts per vendor, you will never know which change broke quality.
Isolation is a requirement, not a slogan
Healthcare, finance and government buyers will ask where bytes sit. Answer with a diagram, not a brand preference. That is the same conversation as HIPAA and SOC 2.
We meet your stack. The production build does not import a mystery platform you have to keep renting.
Related notes
Shipping in companies
Prompt injection defense for Claude agents that can write
Injection is a product and permissions problem. Treat untrusted text as data, constrain tools, and put a human on irreversible actions.
Shipping in companies
Claude Code workflows that your engineers will actually keep
Claude Code is useful when the repository has conventions, evals and a review path. Without those it is a faster way to merge guesswork.
Shipping in companies
Shipping Claude agents under HIPAA, SOC 2 and SOX
Regulated Claude work is a deployment and audit-log problem first. Model quality is necessary and still not sufficient for a security review.