GenAI adoption is moving faster than data security. Records that took years to lock down in databases now flow through embeddings, vector stores, and prompts with far fewer controls around them. This session walks through a zero-trust reference architecture for protecting sensitive data across the AI pipeline on AWS: envelope encryption and key policies with KMS and CloudHSM, S3 Access Grants and VPC endpoints for data-plane isolation, Macie for sensitive-data discovery, Bedrock Guardrails and scoped IAM session policies for inference-time control, and CloudTrail audit evidence that holds up in a regulated environment. The patterns come from hands-on encryption and key lifecycle work in enterprise healthcare but apply to any organization putting sensitive data near an LLM. You'll leave with a concrete control checklist mapped to each pipeline stage. Assumes working knowledge of IAM and KMS.