[cowsandmilk]

> They refuse to let her host their instance of her product on AWS because Amex's security team supposedly hasn't vetted AWS yet. This despite the kinds of customers Amazon already hosts on AWS (the CIA comes to mind).

From my dealings with pharma companies, I will point out one thing.

For things where they have to follow regulations around privacy, they won't let you host your software on AWS for them to use.

They will have their in house team set up your software on AWS for them to use.

Setting it up themselves allows them to guarantee all the regulatory requirements are being met. The CIA isn't using Joe Schmoe's amazon instance, they spin up their own machines and install the software there.