Defense AI: Where Your Data Is Processed (US Data Centers and FedRAMP)
Last updated: November 11, 2026
Every Defense AI deployment runs in United States data centers, inside a FedRAMP-authorized cloud region. Which regions depends on your deployment type: GCC High (Azure Government), GCC (Azure Commercial), or the optional Claude add-on on Google Cloud.
By deployment type
Deployment type | Cloud | US regions | Cloud authorization | Data it's set up for |
|---|---|---|---|---|
GCC High | Azure Government | US Gov Virginia, US Gov Arizona | FedRAMP High | CUI, and ITAR / export-controlled data |
GCC | Azure Commercial | Central US (Iowa), East US 2 (Virginia), West US 3 (Arizona) | FedRAMP High | CUI. Not ITAR or export-controlled data |
Claude add-on (optional) | Google Cloud Vertex AI, in an Assured Workloads folder | US multi-region, plus us-central1, us-east4 and us-west1 | Assured Workloads folder under a FedRAMP Moderate regime by default, or FedRAMP High | CUI. Not ITAR or export-controlled data |
The FedRAMP authorizations belong to the cloud platforms (Microsoft Azure and Google Cloud). Defense AI is not itself a FedRAMP-authorized product. It deploys into those authorized environments in your own cloud account.
Claude models aren't supported for ITAR or export-controlled data on any deployment type, including GCC High. Send ITAR data only to Azure Government models.
How Defense AI keeps processing in the US
Azure: US-only deployment types. Defense AI deploys models only as Standard (a single US region) or Data Zone Standard (US). It refuses Global Standard deployments, which can process requests outside the US.
Google Cloud: Assured Workloads required. Setup checks that your Google Cloud project sits in an Assured Workloads folder with US locations and an active FedRAMP regime. Claude requests leave your Azure environment and go over an encrypted connection to Google's US Vertex AI endpoint, where they're processed inside Google's FedRAMP boundary.
Your region choice. Your admin picks the US region during setup, and all Defense AI resources are created there.
Why does Azure Commercial count for CUI but not ITAR?
CUI needs a cloud authorized at FedRAMP Moderate or higher. Azure Commercial US regions are authorized at FedRAMP High, so they meet that bar.
ITAR and other export-controlled data need more than a FedRAMP authorization. Azure Government adds contractual commitments that data stays in the US and that access to the systems is limited to screened US persons. Azure Commercial doesn't make those commitments, so Defense AI treats it as CUI only.
Related questions
Can I pick a region outside the US? No. Defense AI only offers US regions.
Does any part of the service run outside my cloud account? The Defense AI admin portal is hosted by Atomus. It stores settings and daily usage totals, not prompts or responses. See Defense AI: Data Retention, Who Sees Our Data, Is it Used for Training.
Related articles: Defense AI: How It Works (Architecture and Request Flow) · Defense AI: Can We Use It for CUI or ITAR Data? · Defense AI: Security Controls · Defense AI: What Setup Creates and What Permissions It Asks For