On September 23, 2026, Amazon detailed Bee Private Compute, the privacy architecture of its Bee personal assistant. According to the manufacturer, captured audio is transcribed in real time and discarded, while transcripts, summaries, and to-dos are protected with keys controlled by the user's device. Processing that needs to take place in the cloud goes through an isolated environment whose software identity is verified before data is sent. This describes a concrete technical safeguard, but it does not mean that no usage-related data is retained or that information sent to other services remains under the same controls. An independent security assessment by Trail of Bits has also been published; it should not be confused with Amazon's commercial statements or treated as a permanent guarantee covering the entire service.
How Amazon says the protections are designed
- Capture and transcription: Bee turns speech into text as it is used and, according to Amazon, does not retain the audio file after processing. That is not the same as deleting the transcript or the knowledge extracted from the conversation.
- Device-held keys: Bee's technical publication describes root secrets generated on the device. Data leaves in protected form, and narrowly scoped processing keys are released only after the receiving environment has been verified.
- Server verification: before sharing content, the client checks that the server is running approved software. This procedure, called attestation, is intended to prevent an unauthorized instance from receiving secrets.
- Isolated processing: the manufacturer describes confidential virtual machines based on the AWS Nitro System and NitroTPM. Authorized software inside that environment needs to interpret the content to produce summaries, tasks, and useful memory.
- State and sharing: the architecture documents short-lived keys, transparency mechanisms, and cryptographic authorization for an assistant that retains context across interactions. According to Amazon, the user decides whether to send information to connected services.
The essential point is that Private Compute does not mean every operation runs locally. The proposed design combines on-device safeguards with computation on isolated servers. Amazon's statement that neither Amazon nor Bee can access the content applies to interaction data within the protected processing path and the conditions of that architecture, not to every piece of information associated with an account.
Audio, transcripts, and service data are different things
Bee's terms, updated on September 23, 2026, distinguish Bee Interaction Data from Bee Service Data. The first category includes transcripts, summaries and related data, as well as acoustic models produced when someone creates a voice profile or identifies another participant. By default, this set is processed and stored in the private environment described by the company. An acoustic model should not be mistaken for a raw audio recording, but it may still involve sensitive voice characteristics.
Bee Service Data, by contrast, includes account details, device identifiers, usage metrics, and technical logs. Amazon says it processes this information outside the private environment to operate, maintain, and improve the service. Thus, the promise to discard audio and protect content is not a statement that no metadata exists, nor does it by itself clarify every applicable retention period.
Is there an independent audit? Yes, but its scope matters
Amazon points to a security assessment by Trail of Bits, and the research firm publicly lists a September 2026 review of Amazon Bee Private Compute, with the report available in its repository. This establishes an identifiable external review in addition to the promotional article and technical publication written by the manufacturer.
However, a security review examines a defined scope and versions during a particular period. Its existence does not establish that every future deployment, integration, device, or stage of deletion has been continuously audited. To interpret individual findings or fixes, readers need to consult the report and distinguish findings, Amazon's responses, and any subsequent retesting. The announcement alone is no substitute for that examination. This explanation does not repeat counts or technical conclusions from the PDF that could not be checked directly during this research.
What changes when signing in with an Amazon account
The announcement says that, starting September 23, 2026, new customers can sign in to Bee with an Amazon account, while existing customers may continue signing in through Apple or Google. The company says Amazon-account authentication does not, by itself, grant access to private content protected by Bee Private Compute. Signing in still involves service data, however, and must not be confused with a promise of anonymity.
Where the same protections stop applying
The terms spell out an important boundary: when a user chooses to send interaction data to a connected service, it leaves the private environment. From that point, the recipient's copy is governed by that service's terms and privacy notices, including where the recipient is another Amazon service such as Alexa. The integration can be disconnected in the Bee app to stop future sharing, but Amazon says it cannot retrieve or delete information already transmitted to the connected service. Disconnecting is not the same as deleting the recipient's history.
This distinction is especially important for meeting summaries, calendars, and tasks mentioning other people. Users need to heed the recording indicator and obtain any consent required in the applicable context; Bee's terms assign this responsibility to the person using the product.
How to delete information in Bee
Amazon had already said in January 2026 that users could delete personal data, including transcripts and summaries. For complete account deletion, the official support page instructs users to open the Android or iOS app, tap their profile to reach settings, choose “Delete your account” at the bottom, and confirm. Bee says this operation removes the account's data, conversations, and personal context and cannot be reversed.
That procedure differs from stopping a recording, disconnecting an integration, or requesting deletion of an individual item. The public documentation consulted does not set out, on that help page, all deletion time frames for backups, service logs, or data previously shared with third parties. It would be incorrect to promise that deleting the account also erases copies already received by other services.
Questions that still need answers
- Retention: what specific periods apply to metrics, technical logs, and backups, separately from protected transcripts?
- Verifiable deletion: how can the removal of encrypted data and backup copies be demonstrated after a user requests deletion?
- Keys and recovery: how do the protections behave when a device is replaced or lost, or when more than one device is used, without creating an improper access route?
- Software changes: how can users follow the identity of approved versions and the scope of future independent reviews?
- External sharing: what information does each integration receive, how long is it retained, and what deletion controls does the recipient offer?
These are privacy-assessment questions, not allegations that a particular failure has occurred. The announcement describes the intended design, the technical publication explains its mechanisms, the audit exists as a bounded external assessment, and the terms disclose operational exceptions. Reading these layers separately makes it possible to understand the announced protections without turning them into an absolute guarantee.
Sources and references
- Amazon: September 23, 2026 announcement of Bee Private Compute
- Amazon Science: technical publication on the architecture
- Trail of Bits: public security assessment report
- Bee: terms of use updated September 23, 2026
- Bee: official account deletion instructions
- Amazon: earlier announcement on Bee features and data deletion
