End of support notice: On September 15, 2025, AWS will discontinue support for Amazon Lex V1. After September 15, 2025, you will no longer be able to access the Amazon Lex V1 console or Amazon Lex V1 resources. If you are using Amazon Lex V2, refer to the [Amazon Lex V2 guide](https://docs.aws.amazon.com/lexv2/latest/dg/what-is.html) instead. . 

# Data Protection in Amazon Lex
Data Protection

Amazon Lex collects customer content for troubleshooting and to help improve the service. Customer content is secured by default. You can delete content for individual customers using the Amazon Lex API.

Amazon Lex stores four types of content:
+ Sample utterances, which are used to build and train a bot
+ Customer utterances from users interacting with the bot
+ Session attributes, which provide application-specific information for the duration of a user's interaction with a bot
+ Request attributes, which contain information that applies to a single request to a bot

Any Amazon Lex bot that is designed for use by children is governed by the Children's Online Privacy Protection Act (COPPA). You tell Amazon Lex that the bot is subject to COPPA by using the console or the Amazon Lex API to set the `childDirected` field to `true`. When the `childDirected` field is set to `true`, no user utterances are stored.

**Topics**
+ [

# Encryption at Rest
](at-rest.md)
+ [

# Encryption in Transit
](in-transit.md)
+ [

# Key Management
](key-management.md)

# Encryption at Rest


Amazon Lex encrypts the user utterances that it stores. 

**Topics**
+ [

## Sample Utterances
](#at-rest-sample)
+ [

## Customer Utterances
](#at-rest-utterances)
+ [

## Session Attributes
](#at-rest-session)
+ [

## Request Attributes
](#at-rest-request)

## Sample Utterances


When you develop a bot, you can provide sample utterances for each intent and slot. You can also provide custom values and synonyms for slots. This information is encrypted at rest, and it is used to build the bot and to create the user experience.

## Customer Utterances


Amazon Lex encrypts utterances that users send to your bot unless the `childDirected` field is set to `true`.

When the `childDirected` field is set to `true`, no user utterances are stored.

When the `childDirected` field is set to `false` (the default), user utterances are encrypted and stored for 15 days for use with the [GetUtterancesView](API_GetUtterancesView.md) operation. To delete stored utterances for a specific user, use the [DeleteUtterances](API_DeleteUtterances.md) operation .

When your bot accepts voice input, the input is stored indefinitely. Amazon Lex uses it to improve your bot's ability to respond to user input.

Use the [DeleteUtterances](API_DeleteUtterances.md) operation to delete stored utterances for a specific user.

## Session Attributes


Session attributes contain application-specific information that is passed between Amazon Lex and client applications. Amazon Lex passes session attributes to all AWS Lambda functions configured for a bot. If a Lambda function adds or updates session attributes, Amazon Lex passes the new information back to the client application.

Session attributes persist in an encrypted store for the duration of the session. You can configure the session to remain active for a minimum of 1 minute and up to 24 hours after the last user utterance. The default session duration is 5 minutes.

## Request Attributes


Request attributes contain request-specific information and apply only to the current request. A client application uses request attributes to send information to Amazon Lex at runtime. 

You use request attributes to pass information that doesn't need to persist for the entire session. Because request attributes don't persist across requests, they aren't stored.

# Encryption in Transit


Amazon Lex uses the HTTPS protocol to communicate with your client application. It uses HTTPS and AWS signatures to communicate with other services, such as Amazon Polly and AWS Lambda on your application's behalf.

# Key Management


Amazon Lex protects your content from unauthorized use with internal keys.