Security, privacy, and architecture of Amazon Quick on desktop
| Applies to: Enterprise Edition |
| Intended audience: System administrators |
Amazon Quick on desktop is a native application that runs on the user's device and connects to the Amazon Quick service in the cloud. The service processes each request and stores the user's data in your Amazon Quick account. The application gives the service access to the device, such as the folders that the user grants.
Amazon doesn't use your conversations, files, or personal context to train or improve AI models.
Responsibility for security follows these trust boundaries:
-
The user's device, which your organization manages.
-
The Amazon Quick service, which Amazon manages.
-
Connected services, which your organization or a third party manages.
Components
The desktop application and the agent runtime handle each chat request.
Desktop application
The desktop application runs on the user's device. It connects to the Amazon Quick service and runs local tools when the agent runtime calls them. Local tools include folder access, browser automation, code execution, local connectors, and coding agents, and each one runs with the operating system permissions of the signed-in user.
Code execution runs in an operating system sandbox with no network access, either in the agent runtime or on the user's device. Amazon Quick updates the libraries in the agent runtime. The libraries on the device update with the desktop application.
Agent runtime
The agent runtime is the cloud environment that processes each chat request. It runs on Amazon Bedrock AgentCore and uses a model hosted on Amazon Bedrock. Each user's agent runtime runs in a dedicated, single-tenant environment. AgentCore isolates each session in its own microVM. For more information, see AgentCore Runtime session isolation.
To complete a request, the agent runtime calls tools, such as system tools and cloud connectors. It reads the user's data and the spaces, knowledge bases, and datasets that the user can access. It enforces resource permissions, plus document access control lists (ACLs) and row- and column-level security where they're configured.
Example: a chat request
The following steps show how the components work together for one chat request. Administrative requests, such as account and permission changes, follow a different path.
-
The desktop application sends the prompt and any attachments to Amazon Quick with the user's authentication token.
-
The agent runtime processes the prompt with the model.
-
Amazon Quick checks each tool call against the administrator, connector owner, and user permissions before the call runs.
-
The agent runtime saves the conversation, including the prompt, response, tool calls, and citations, encrypted at rest.
-
Amazon Quick returns the response to the desktop application.
Network connections
The desktop application opens its own connections to Amazon Quick, so the device needs only outbound firewall rules for that traffic. It connects over HTTPS and WebSocket Secure on port 443 with Transport Layer Security (TLS) 1.2 or later. The agent runtime sends local tool calls over the WebSocket connection that the application opened.
During sign-in, the application opens a local port to receive the identity provider's response from the browser, and it closes the port when sign-in completes. For more information, see Sign-in and credentials.
Calls to cloud connectors and data sources start in the Amazon Quick service and go over the public internet or a virtual private cloud (VPC) connection. They don't come from the user's device. For information about connecting to data sources in your VPC, see Configuring VPC connections in Amazon Quick Sight.
Some system tools run in the Amazon Quick agent runtime rather than on the device. Web search (including fetch URL), file download, and remote managed browser automation send their requests to the internet from Amazon-managed infrastructure, so your proxy, firewall, DNS filtering, and endpoint controls don't see these requests. Fetch URL can return a cached copy of a page instead of retrieving it live. When a user downloads a file, the agent runtime retrieves it and syncs it to the device.
Administrators can turn off web search and remote managed browser automation in a custom permissions profile, in the AI capabilities group. To turn off web search, including fetch URL, restrict the capability to use internet to enhance results. To turn off remote managed browser automation, which is in Preview, restrict the capability to automate remote managed browser actions. Each user controls file downloads through the access level of the File operations tool.
For information about proxies, see Proxy support. For information about traffic inspection, see Trusting a corporate certificate authority.
Network access and required domains
The application connects to Amazon Quick for discovery and data-plane operations, remote configuration, updates, and identity provider sign-in. In restricted networks, add the following domains to your allowlist.
| Category | Domain | Wildcard meaning | Purpose |
|---|---|---|---|
| Amazon Quick console | *.quicksight.aws.amazon.com |
* = Amazon Region (for example, us-east-1) |
Web console, resource discovery |
| Amazon Quick data plane | *.dp.appintegrations |
First * = per-account cell ID; second * =
Amazon Region |
Inference, streaming, search |
| Amazon Quick desktop sign-in |
|
* = cell ID, which can change |
Desktop sign-in, and token issuance and renewal |
| Amazon Quick enterprise resource server for Amazon Quick on desktop |
|
* = cell ID, which can change |
Desktop API access |
| Remote configuration and updates | *.cloudfront.net |
* = Amazon CloudFront distribution ID |
Feature flags, application updates, Apps in Amazon Quick content |
| Telemetry | cognito-identity.*.amazonaws.com |
* = Amazon Web Services Region |
Operational telemetry |
| Identity provider | Customer-specific (for example,
login.microsoftonline.com) |
Not applicable | Sign-in through your organization's identity provider |
-
For strict proxy environments that can't use wildcards, you can determine the account-specific cell hostname after you first sign in. It follows the pattern
<cell-id>.dp.appintegrations.<region>. In that pattern,<cell-id>is a stable identifier for each account, and<region>is the account's home Region. -
If your organization inspects encrypted traffic, add the inspection certificate authority to the operating system trust store, or exclude the Quick domains from inspection. The application doesn't pin certificates, so it trusts any certificate authority in that store.
-
In the desktop sign-in and resource server domains, replace
<tenant-id>with your tenant ID and<region>with your account's home Region. Allow both patterns for each domain. To find your tenant ID, do one of the following:-
In the Amazon Quick console, go to Inbound connectors, choose the Quick Desktop tab, and open the desktop connector.
-
Use the Amazon Quick API. Call
DescribeInboundConnector,ListInboundConnectors,DescribeAccessControlApplication, orListAccessControlApplications.
-
Sign-in and credentials
The desktop application doesn't store usernames or passwords, and it doesn't receive Amazon credentials. It keeps its sign-in tokens in the operating system credential vault, which is the macOS Keychain or Windows Credential Manager. It renews the tokens in the background, and each profile keeps its own token. When a token expires or is revoked, the user signs in again.
During sign-in, the application listens on http://localhost:18080 for
the response from the browser. The port is open only while sign-in is in progress. If
your endpoint security software blocks local listeners, allow this port.
Security scanning tools can flag this redirect URI because it uses HTTP. The traffic stays on the device. An application that intercepts the authorization code can't exchange it for tokens without the Proof Key for Code Exchange (PKCE) verifier. Only the desktop application holds that verifier.
Where data is stored
Amazon Quick stores data in your Amazon Quick account and on the user's device.
In your Amazon Quick account
Amazon Quick keeps each user's conversations, memory, knowledge graph, library, skills, and indexed folder content in your Amazon Quick account. Each user's data is separate from other users' data. Amazon Quick encrypts it at rest. You can register an Amazon Key Management Service (Amazon KMS) customer managed key for the resource types that page lists.
On the user's device
The desktop application stores its configuration in ~/.quickwork/
on macOS or %USERPROFILE%\.quickwork\ on Windows. This includes
settings, folder permissions, local connector and coding agent configuration, and
sandbox settings. The application also keeps file-sync metadata, browser session
state, logs, and cached content, such as previews of opened files.
Your organization is responsible for protecting this data. The application doesn't encrypt the directory itself, so turn on the operating system's full-disk encryption, such as FileVault on macOS or BitLocker on Windows. Any process that runs as the same operating system user can read the directory. Model Context Protocol (MCP) values that the user marks as secret go to the operating system keychain, and the application stores other values in plaintext.
Signing out or uninstalling the application doesn't remove all local data.
Administrator and user controls
The administrator, the connector owner, and the user each set controls for a tool call. They apply in that order, and each role can only narrow what the role before it allows. The connected service then authorizes the call with the user's identity or the connector's credential.
Administrator controls
Administrators set controls in the Amazon Quick account, which apply to every surface, and through device management. You can do the following:
-
Turn on desktop access and choose the sign-in method.
-
Allow or deny desktop capabilities with custom permissions, and deny new capabilities with Deny by Default.
-
Set managed policies and control application updates.
-
Cap usage with limit profiles.
-
Configure AI guardrails.
-
Deliver chat logs with vended logs.
-
Encrypt data with customer managed keys.
-
Block or warn about files based on sensitivity labels with data loss prevention.
To revoke one user's access, remove or delete the user. For more information, see User lifecycle and data handling in Amazon Quick. To revoke desktop access for a group or for every user, restrict the Quick desktop capability with custom permissions.
Connector owner controls
The owner of a cloud connector decides who can use it. The owner sets each action to Let users choose, Always ask, or Disabled. For more information, see Tool permissions.
Connection security
The agent runtime invokes cloud connectors from your Amazon Quick account, not from the device. Amazon Quick stores each connector's tokens in a token vault in your account. For more information, see Authentication methods.
Each connected service has its own connection, so users can disconnect and reconnect one service without affecting the others. Quick requests only the permissions that each service needs.
User controls
Users set the following controls for their own work:
-
Which folders the agent can reach, and whether files are uploaded for indexing. Granting a folder doesn't upload its files.
-
Which files to upload to spaces or attach to chat messages.
-
The access level for each system tool.
-
Whether write actions need approval, when the connector owner sets the action to Let users choose.
-
Which MCP servers and coding agents to add.
-
Whether Quick learns from conversations, set in privacy controls and incognito mode.
Local connectors belong to the user who adds them, and only that user can use them. Administrators can allow or deny local connectors and coding agents with custom permissions. They can't see which ones a user adds.
AI usage
The desktop application doesn't host or run models. Inference runs in the
agent runtime, and Amazon Quick hosts its embedding models on Amazon SageMaker AI. For
information about the controls that apply to model use, see AI guardrails and AI and agent security. Use of the service is subject to the Amazon
Responsible AI Policy
Monitoring and auditing
You audit Amazon Quick on desktop with the same tools as the rest of Amazon Quick. Amazon CloudTrail records API calls, and it records connector actions when you turn on data events. For more information, see Monitoring Amazon Quick using CloudTrail.
Vended logs deliver chat conversations, including incognito conversations, to a destination in your Amazon account. For more information, see Monitoring Amazon Quick using CloudWatch Logs. Users can also export diagnostic logs from the device. For more information, see Exporting diagnostics.
Data retention and deletion
Amazon Quick sets the retention periods for data in your Amazon Quick account. For information about the periods, see Amazon Quick desktop usage limits. You set retention for the logs that you deliver to your own destinations. For more information, see Security best practices. For information about what happens to a user's data when you remove the user, see User lifecycle and data handling in Amazon Quick.