Private Claude · on Amazon Bedrock
Private Claude, for the whole company.In your own AWS account.
The Claude your people already want — Desktop, Cowork and Claude Code — signed in with their work account and answered by models running in your own AWS account. You decide which models, tools and sites it may reach, and what each person may spend.
- Runs in your AWS account
- No vendor in the data path
- Work sign-in, no keys handed out
- Rolled out by MDM
The problem
Your people already use Claude. Just not on an account you can see.
The question is not whether your staff use Claude. It is whether they do it on an account you can see, provision and take away.
On personal accounts
Company documents go into consumer chats, under terms nobody in your legal team agreed to.
Invisible to IT
Nothing to provision, nothing to audit, and nothing to revoke when somebody leaves.
A ban moves it. It does not stop it.
Blocking the website stops you seeing the work. It does not stop the work.
The fix is a sanctioned way in that is better than the personal one: the same Claude, signed in with a work account, inside your own cloud.
Why Amazon Bedrock
The same Claude models, running where your data already lives.
Claude on Amazon Bedrock runs in your AWS account, in regions you choose, under the agreement you already have with AWS. For most security teams that settles the question before it is asked.
Your account, your regions
Inference runs in the AWS regions you choose. Geographic inference profiles keep it inside a geography, and TokenLock records which region served each request.
Not shared, not trained on
Prompts go to Bedrock in your own account, not to the model provider.
“Your data is not shared with model providers, and is not used to improve the base models.” AWS
Your keys, your network
Encrypted in transit and at rest, with keys you control in AWS KMS, and reachable over AWS PrivateLink without exposing your VPC to internet traffic.
Compliance you already rely on
The compliance scope is AWS's, which your security team has most likely reviewed already.
“Bedrock is in scope for common compliance standards including ISO, SOC, CSA STAR Level 2, is HIPAA eligible, and customers can use Bedrock in compliance with the GDPR.” AWS
On the bill you already pay
Tokens are billed to your AWS account like any other AWS service. There is no new AI vendor to take on as a data processor.
AWS quotes from Amazon Bedrock security and compliance, September 2026.
Bedrock on its own is private. It is not governed.
The Claude apps authenticate with AWS credentials on each machine rather than a work sign-in, and there is no per-person budget, no fleet rollout and no policy on what the app may reach. Private Claude is that gap closed: TokenLock adds the identity, the budgets and the policy, inside the same account.
Compared
Four ways to give a company Claude.
Anthropic's own plans are good choices when Anthropic's cloud is acceptable to you. This comparison is for when prompts have to stay in your AWS account.
| Compared on | Claude TeamAnthropic's plan | Claude EnterpriseAnthropic's plan | Bedrock on its ownin your AWS account | Private ClaudeBedrock + TokenLock, your account |
|---|---|---|---|---|
| Where the model runs | Anthropic's cloud | Anthropic's cloud | Your AWS account | Your AWS account |
| Who processes prompts | Anthropic | Anthropic | AWS, not shared with the model provider | AWS, not shared with the model provider |
| How a person signs in | Claude account, with SSO | Claude account, with SSO | AWS credentials on each machine | Work sign-in in the Claude app; no key handed out |
| Provisioning | Not listed | SCIM | Your own IAM set-up | Entra ID groups create accounts and suspend leavers |
| Spend limits | Spend controls | User and organisation spend limits | AWS Budgets alerts, per account | Per person or shared pool; block or fall back to a cheaper model |
| Spend reporting | Usage analytics | Usage analytics | By AWS account and model | By person, team, project and application |
| What the work was for | Not listed | Not listed | Not available | Classified from conversations into labels you write |
| Tools and egress | Connector controls | Role-based permissions | MDM settings files, pushed per fleet | Models, tools, egress and MCP servers per group; live |
| Fleet rollout | Not listed | Not listed | A settings file on every machine | One MDM setting; configuration follows policy |
| Price | $20–25 per standard seat | $20 per seat, plus usage at API rates | Bedrock tokens, on your AWS bill | Bedrock tokens, plus $14 per person with spend |
Claude Team and Claude Enterprise as listed on claude.com/pricing on 15 September 2026. “Not listed” means that page does not mention it, not that the plan lacks it. Bedrock guarantees as published by AWS. TokenLock prices per month.
Rollout & identity
One setting on every machine. Nobody is handed a key.
Push a single MDM setting and Claude Desktop does the rest: it asks the person to sign in with their work account, then fetches everything their policy allows. Change a policy and it reaches every running machine within minutes, without touching any of them.
Push one setting
bootstrapUrl, by any MDM that can set a managed preference. The same JSON on macOS, Windows and Linux, and the console refuses to call a payload ready while it still has a placeholder in it.
The person signs in
Claude Desktop shows a code and opens a browser. They sign in with their work account and approve it. There is nothing to copy back.
Their group decides the rest
Somebody who joins Engineering in Entra ID gets an account and Engineering's policies the first time they sign in. Nobody administers people twice.
Access runs out on its own
Tokens last eight hours and renew silently for a fortnight. Revoke a person and their next refresh fails; take them out of the group and a directory check suspends them.
| Method | What the person does | Taking access away |
|---|---|---|
| Sign-in recommended | Approves a code in a browser, once per token lifetime | Immediate: the next refresh fails |
| Credential helper | Nothing, if the helper can fetch a token silently | When the current token expires |
| Static key | Pastes a key once | Only by revoking that key by hand |
Works with
The AI firewall
Decide what Claude may reach, group by group.
TokenLock sits in the model's path and serves each app its configuration, so a rule written once applies to every request and every running app in the group, without pushing anything to a fleet.
Models
Which models a group may call
Deny by default: a model nobody has granted is one the group does not get. A cheaper fallback can be named for when a budget runs out.
Server-side tools
Web search, fetch and code execution
Each is granted always, only when the app asks, or never, and a tool that is not granted is refused. Fetching can be forced through the tool running inside your account instead of the one on the laptop.
App egress & MCP
Where the app may reach
The domains the app may connect to, the MCP servers it loads, whether those are the only ones allowed, and tools it may not use. Running apps pick up a change in about ten minutes.
Requests
Change a request before it leaves
Declarative rules the console can preview before you save them, or your own JavaScript in an isolated sandbox, on a time budget you set: 250 ms by default.
Residency
Keep traffic in a geography
A residency rule that cannot be met refuses the request rather than sending it somewhere wider, and the region that served each request is recorded.
- Models
- haiku-4-5
- Web search
- when asked
- Web fetch
- always · in your account
- Code execution
- never
- Egress
- github.comdocs.acme.com
- MCP servers
- jiraconfluencelocked
- Budget
- $40 / week · block
- Residency
- eu only
- refusedAsks to run codeCode execution is not granted to Contractors.
- redirectedFetches a web pageRun by the fetch tool inside your account, not the laptop's own.
- servedSummarises a Jira ticketAllowed model, inside budget, served from an EU region.
Awareness
People spend differently when they can see the meter.
A budget that only refuses teaches nobody anything. TokenLock tells people what a conversation is costing as it runs, answers them when they ask, and warns them before a limit lands — in the client they are already working in.
…and that is the last of the retry logic.
FYI — this conversation has cost $4.18 so far; your Claude spend today is $12.60. Send whatsthecost at any time for an update.
Reports at $5, $10, $15 — not once ever, which goes quiet exactly when a conversation starts getting expensive, and not every turn, which nobody reads by the third one.
› whatsthecost
This conversation has cost $9.86 so far; your Claude spend today is $18.40.
Answered without calling a model, so asking what something costs never costs anything. Same sentence as the automatic notice, because somebody who has seen one should recognise the other.
…and that is the last of the retry logic.
[TokenLock] You have used $96.00 of your $120.00 monthly budget. Requests are still being served. Ask #platform-help if this needs raising.
Fires while requests are still being served — the whole point of a soft limit is that somebody can act before the hard one arrives.
Visibility
Every request has a name on it.
Bedrock bills an AWS account, by model. TokenLock attributes each request to a person, a team, a project and an application — one total, four ways, reconciling with the bill.
- Who spent it?
- By person, and by team straight from your directory — nothing to tag.
- Who is about to hit a limit?
- Budgets beside the spend, including who is already being refused.
- What was it for?
- Classified from the conversations, into labels you write. Below.
Purpose
The bill says $18,402.66. It does not say what for.
You write the prompt and the labels. An extraction reads an excerpt of each conversation, classifies it into the dimensions you defined, and reports what the run itself cost.
You already told us
Comes from a header or your identity provider. No inference involved.
project · department · key
The request said so
Read off the call itself — which client, which model, which region.
client · model · region
Read from the content
The only dimensions that require reading conversations, and the only ones no bill or header could give you.
task · subject · sensitivity
A conversation
“help me refactor the payments migration script so it retries on throttling and logs which profile served each call”
Dimensions it produced
Then you get the cross-tab.
Most of what looks like one list is two questions. Task is what someone was doing; subject is what it was about. Keep them apart and each list stays short and additive — and you gain a table no bill and no header could ever produce.
$1,240 of writing about performance reviews. No gateway, no bill and no header can surface that. It is the kind of line that starts a conversation with HR — and the reason somebody buys this.
How extractions work →How it works
Your data does not leave your AWS account.
You chose Bedrock so your data would stay yours. A SaaS spend tool in front of it undoes the decision you spent six months getting approved. TokenLock deploys into your account, and the console runs browser-to-your-own-API. We operate nothing in the path.
Your people
Still your account
There is no vendor to assess
Because there is no vendor in the data path. Security review is of your own infrastructure, which you already have a process for.
Residency is recorded, not assumed
Cross-region inference profiles mean a request is not automatically served from the region it was sent to — a global. profile may be served from any geography. TokenLock prefers regional profiles and records which one actually served each request.
Applications
Not only the people. The things you build, too.
A CI pipeline, a nightly job, a product that serves your own customers — each gets its own key, its own budget and its own line in the report. A service account is not a person with a login, and attaching one to a pretend user is how a directory fills up with accounts nobody can sign in as.
| Application | Kind | Cost |
|---|---|---|
| ci-review-botpull request review | service account | $1,566.02 |
| support-assistantper end user | application key | $745.10 |
| nightly-summarisercron, 02:00 | scheduled job | $412.88 |
One key, a budget for each of your customers.
A product built on TokenLock spends against one service-account budget, but the cost belongs to whichever of its customers made the request. Say who they are on the request, and optionally what they are allowed to spend.
x-api-key: tl_sk_live_support_assistant x-tokenlock-end-user: acct_2077 x-tokenlock-end-user-budget: 5.00
A declared budget can only ever restrict. It applies on top of the key's own budget, never instead of it, so a caller cannot raise its ceiling by sending a bigger number. The worst it can do is decline to restrict itself.
Questions
What security, IT and finance ask first.
Straight answers, including the ones that do not flatter us.
Is it the same Claude?
Yes. Private Claude is not a different product or a fork: people use Anthropic's own Claude Desktop, Cowork and Claude Code, pointed at an endpoint in your AWS account. The models are Claude models served by Amazon Bedrock.
Which models are available follows what Bedrock offers in your regions, narrowed by what your policies allow.
Why not just buy Claude Enterprise?
If Anthropic's cloud is acceptable to your security team, do. It is simpler, and it has single sign-on, SCIM and spend limits of its own.
TokenLock is for when prompts have to stay inside your AWS account and under your AWS agreement, or when you want to set what the app may reach, group by group.
Can we just use Bedrock directly?
Yes, and plenty of teams start there. You get private inference and give up the rest: AWS credentials on every machine, no work sign-in, and no per-person budget, rollout, policy or reporting.
TokenLock adds those without adding a vendor, because it deploys into the same account.
Can you see our prompts, or who spent what?
No. TokenLock runs in your account and nothing about a request is sent to us: not prompts, not responses, not who spent what.
The one thing we read is the number we invoice against. Our billing run asks your stack, over a shared key, for a count of active users, per-day counts and a request total, and nothing identifying. A test fails if a user, a model or a spend figure is ever added to that answer.
What happens if TokenLock goes away?
The stack, its database and your usage history stay in your account. Point the apps back at Bedrock directly and they keep working. You lose the governance, not the service.
Do we need a services engagement to roll it out?
No. You deploy one stack into your AWS account, connect your directory from the console, and push one MDM setting. The console generates that setting and will not call it ready while it still contains a placeholder.
Does it record what our staff write?
Only if you turn conversation retention on, and cost reporting works fully with it off.
If you do turn it on, you are recording staff conversations, which carries obligations that are yours to meet. The Data & your staff page covers it in full.
Is TokenLock certified?
TokenLock holds no SOC 2 or ISO certification of its own. It runs in your account, so what your security team assesses is your deployment of it, on top of Bedrock's own compliance scope as AWS publishes it.
See it on your own spend.
Point one team's Claude Code at TokenLock and the first breakdown is there within the hour. Priced per seat. Private beta.