The Companion Program · AWS Companion

Run Microsoft. Run AWS. Govern once.

Almost every large enterprise runs both Microsoft and AWS. Microsoft is where the data lives. AWS is where the AI runs. Smart Stack 3.0 governs the Microsoft source so Bedrock, SageMaker, Amazon Q, Redshift, Athena, and Glue activate on Trusted Data Collections with classification, retention, and provenance intact.

Listen to the Podcast

The Problem This Companion Solves

Almost every large enterprise runs both Microsoft and AWS. Microsoft for productivity, collaboration, identity, and the documents people actually create. AWS for the workloads that consumed the past decade of cloud transformation. Customer-facing applications. Modern data platforms. Machine learning. Custom AI. The analytical infrastructure data engineering teams have spent years building on S3, Redshift, Athena, and Glue.

The split is operationally workable when each cloud handles its own domain. It becomes a governance problem the moment AWS workloads start consuming Microsoft-resident content. Bedrock applications grounding on enterprise documents. SageMaker models training on operational records. Amazon Q reasoning over corporate knowledge bases. Redshift pipelines pulling from SharePoint. Athena queries running across S3 buckets that mirror file shares. Every one of these patterns requires Microsoft data to leave the Microsoft tenant and arrive in AWS.

The historical answer has been to copy the data, govern it independently, and accept the duplication cost and exposure surface that comes with it. That answer scales poorly. AWS workloads are not declining. They are expanding. Each new workload is another opportunity for ungoverned content to surface in an AWS output that no Microsoft policy can reach.

The Companion Program offers a different answer. The Microsoft tenant remains the source of truth. Smart Stack 3.0 governs the source. Trusted Data Collections are projected into AWS through controlled cross-cloud paths governed by the AI Governance Workflow. The choice is not Microsoft or AWS. The choice is governed or ungoverned.

Built for the executives who own the data estate

For the CDO

You are being asked to deliver enterprise AI capability that runs across both Microsoft and AWS. Copilot in the Microsoft tenant. Bedrock in AWS for production AI applications. SageMaker for model training. Amazon Q for knowledge work. None of these initiatives can deliver real business value if the underlying data has not been governed. The CDO who governs once at the source delivers AI capability across both clouds on a single foundation. The Companion Program is how the CDO answers the board question: how trusted is your data layer beneath every cloud the organization runs in.

For the CIO

You are paying for Microsoft data twice. Once in the Microsoft tenant where it originates. Once in AWS where it gets ingested for AWS workloads to consume. Add egress fees on the Microsoft side. Add ingress and storage fees on the AWS side. Multiply by the number of AWS workloads consuming Microsoft data. The Trusted Data Refinery eliminates ROT in place. Trusted Data Mirroring projects high-signal Trusted Data Collections through OneLake into AWS. Storage and compute costs across Bedrock, SageMaker, Redshift, and Athena fall proportionally to the ROT eliminated upstream.

For the CISO

Every AWS workload that consumes Microsoft data is a new exposure surface unless the data crossing the boundary has been governed before it leaves the tenant. The Companion Program makes the Microsoft tenant the security boundary across the cross-cloud surface. Sensitive Data Classification runs in place inside the tenant before any data leaves. The AI Governance Workflow controls what crosses into AWS. The CISO maintains one boundary, one classification model, and one audit trail across both clouds. The control surface scales with the source, not the workload count.

What the Trusted Data Toolkit Does for AWS Companion

Trusted Data Archive

Provenance-Verified Communications for AWS

Communications captured at the Microsoft source carry envelope, audit trail, and provenance metadata into AWS. Customer correspondence, internal communications, regulatory threads, and contract negotiations preserved with WORM retention become available to Bedrock, SageMaker, and Amazon Q through governed projection, not bulk copy. Every output traceable to its source message with envelope metadata intact.

Trusted Data Refinery

Classified, ROT-Eliminated Source Estate

Windows File Shares, SharePoint, and OneDrive scanned in place at eight million file objects per hour. ROT eliminated. Sensitive content classified through Sensitive Data Classification. OCR runs on image-based content. Trusted Data Collections produced with provenance embedded in every record. Classification and retention metadata travel with every dataset into AWS.

Trusted Data Portal

Governed Cross-Cloud Routing into AWS

Projects Trusted Data Collections into AWS through governed cross-cloud paths. The AI Governance Workflow ensures only policy-aligned data reaches Bedrock, SageMaker, Amazon Q, Redshift, Athena, or any AWS workload grounded on Microsoft-sourced content. Chain of custody preserved end to end. Safe Data Drop provides governed intake for any external content that needs to enter the AWS workflow.

Additional Toolkit Components

Trusted Data Mirroring delivers pointer-based projection of Trusted Data Collections from OneLake into AWS through native cross-cloud federation. No forklift migration. One source of truth in the Microsoft tenant.

Workflow Builder configures Cross-Cloud AI Workflows that orchestrate the projection of specific Trusted Data Collections to specific AWS workloads under specific policy constraints.

The ROI Calculator quantifies storage and compute reduction across Bedrock, SageMaker, Redshift, and Athena against the AWS spend the organization is already committed to.

What Changes for the Customer

Amazon Bedrock reasons over governed Trusted Data Collections projected from the Microsoft tenant. Hallucination risk falls because the model is no longer grounding on superseded versions, ROT, or content the user should not have access to.

Amazon SageMaker training and inference workloads operate on classified, ROT-eliminated, metadata-enriched datasets. Training data quality improvements show up as inference quality improvements.

Amazon Q grounded on Companion-projected Trusted Data Collections produces answers traceable to the original Microsoft sources. The connector reaches governed content, not raw SharePoint sprawl.

Amazon Redshift, Athena, and Glue ingest governed Trusted Data Collections rather than ungoverned file estate content. Scan and compute costs fall proportionally to ROT eliminated upstream. Outputs trace through to provenance-verified Microsoft sources.

Run Microsoft. Run AWS. Govern once.