How many subprocessors does SonarQube use?

SonarQube lists 16 subprocessors on its published list, including Amazon Web Services EMEA SARL, Okta, Inc., Atlassian Pty Ltd, Clerk, and Slack Technologies Limited and 11 more.

Where does SonarQube process customer data?

The subprocessors named by SonarQube are located in Europe, Ireland, USA, Germany, France, and Japan and 3 other locations, as stated on its list.

Does SonarQube use customer data to train AI models?

According to its AI terms, SonarQube may use customer data to train AI models: “SonarSource will Train on the Input Data of Customers of SonarQube Cloud Enterprise or SonarQube Server only if such Training is solely for the benefit of Customer.”

How quickly does SonarQube report a personal data breach to customers?

According to its DPA, SonarQube reports a personal data breach to customers within 72 hours: “SonarSource will notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”

How much notice does SonarQube give before adding a subprocessor?

SonarQube's DPA gives 14 days' notice of a new subprocessor, the time customers have to object: “SonarSource will give Customer at least fourteen (14) calendar days' notice prior to providing that Sub-processor with access to Customer Personal Data by updating the Trust Center accordingly ("Sub-processor Notice Period").”

How does SonarQube transfer personal data outside the EU?

SonarQube's DPA relies on standard contractual clauses and adequacy decisions: “The EU SCCs are hereby incorporated into this DPA by reference as follows:”

When was SonarQube's subprocessor list last checked?

ClauseTrail last checked SonarQube's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when SonarQube adds or removes a subprocessor?

ClauseTrail monitors SonarQube's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

SonarQube Subprocessors List (September 2026): Changes and History

SonarQube names 16 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

SonarQube subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services EMEA SARL	Hosting and Cloud Infrastructure	Germany, Ireland, USA
2	Okta, Inc.	Customer Identity and Access Management	Ireland, USA
3	Atlassian Pty Ltd	Jira service management commercial support via ticket system	Europe
4	Clerk	Authentication and user management. Data location: Global	United States
5	Slack Technologies Limited	Internal communication and collaboration tool	Europe
6	Google Ireland Limited	Workspace cloud infrastructure for information assets	Europe
7	Kaseya Limited	Cloud backup for Google Workspace data	Europe
8	Zendesk, Inc.	Customer commercial support via ticket system	Europe
9	Zoom Video Communications, Inc.	Video and Audio communications	Europe
10	SonarSource France Sárl	Customer Service & Support; Configuration; Security of Services & Performance Monitoring	France
11	SonarSource Gmbh	Customer Service & Support; Configuration; Security of Services & Performance Monitoring	Germany
12	SonarSource Ireland Limited	Customer Service & Support; Configuration; Security of Services & Performance Monitoring	Ireland
13	SonarSource Japan KK	Customer Service & Support; Configuration; Security of Services & Performance Monitoring	Japan
14	SonarSource PTE, LTD.	Customer Service & Support; Configuration; Security of Services & Performance Monitoring	Singapore
15	SonarSource UK LTD	Customer Service & Support; Configuration; Security of Services & Performance Monitoring	United Kingdom
16	SonarSource US, Inc.	Customer Service & Support; Configuration; Security of Services & Performance Monitoring	USA

Get an email when SonarQube changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track SonarQube free

AI and customer data at SonarQube

What SonarQube's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: Yes

“SonarSource will Train on the Input Data of Customers of SonarQube Cloud Enterprise or SonarQube Server only if such Training is solely for the benefit of Customer.”
AI terms, www.sonarsource.com ↗
Sends customer data to AI model providers: Yes

“The LLM Technologies used by Sonar AI Software may be provided directly by SonarSource, by nonparties under contract to SonarSource, or by the Customer, as specified in the applicable Supplemental Terms for each Sonar AI Software.”
AI terms, www.sonarsource.com ↗
How to opt out: Not stated in the documents we track.

Key DPA terms at SonarQube

What SonarQube's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“SonarSource will notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”
DPA, www.sonarsource.com ↗
Notice of a new subprocessor: 14 days ahead

“SonarSource will give Customer at least fourteen (14) calendar days' notice prior to providing that Sub-processor with access to Customer Personal Data by updating the Trust Center accordingly ("Sub-processor Notice Period").”
DPA, www.sonarsource.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“The EU SCCs are hereby incorporated into this DPA by reference as follows:”

“to a country outside of Europe that is not subject to an adequacy decision, the following applies:”
DPA, www.sonarsource.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Following expiration or termination of the Agreement, SonarSource will delete all Customer Personal Data.”
DPA, www.sonarsource.com ↗
Audit rights: Through certifications and audit reports only

“Upon written request, SonarSource will provide Customer with a summary of its most recent independent certification or attestation report(s) once every twelve (12) months during the term of the Agreement ("Audit Information"), so that Customer can verify SonarSource's compliance with the audit standards and this DPA.”
DPA, www.sonarsource.com ↗

Documents we track for SonarQube

AI terms: checked September 28, 2026 www.sonarsource.com ↗
DPA: checked September 28, 2026 www.sonarsource.com ↗
Privacy policy: checked September 28, 2026 www.sonarsource.com ↗
Subprocessor list: checked September 28, 2026 www.sonarsource.com ↗
Terms of service: checked September 28, 2026 www.sonarsource.com ↗
Trust page: checked September 28, 2026 www.sonarsource.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

SonarQube subprocessors FAQ

How many subprocessors does SonarQube use?: SonarQube lists 16 subprocessors on its published list, including Amazon Web Services EMEA SARL, Okta, Inc., Atlassian Pty Ltd, Clerk, and Slack Technologies Limited and 11 more.
Where does SonarQube process customer data?: The subprocessors named by SonarQube are located in Europe, Ireland, USA, Germany, France, and Japan and 3 other locations, as stated on its list.
Does SonarQube use customer data to train AI models?: According to its AI terms, SonarQube may use customer data to train AI models: “SonarSource will Train on the Input Data of Customers of SonarQube Cloud Enterprise or SonarQube Server only if such Training is solely for the benefit of Customer.”
How quickly does SonarQube report a personal data breach to customers?: According to its DPA, SonarQube reports a personal data breach to customers within 72 hours: “SonarSource will notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”
How much notice does SonarQube give before adding a subprocessor?: SonarQube's DPA gives 14 days' notice of a new subprocessor, the time customers have to object: “SonarSource will give Customer at least fourteen (14) calendar days' notice prior to providing that Sub-processor with access to Customer Personal Data by updating the Trust Center accordingly ("Sub-processor Notice Period").”
How does SonarQube transfer personal data outside the EU?: SonarQube's DPA relies on standard contractual clauses and adequacy decisions: “The EU SCCs are hereby incorporated into this DPA by reference as follows:”
When was SonarQube's subprocessor list last checked?: ClauseTrail last checked SonarQube's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when SonarQube adds or removes a subprocessor?: ClauseTrail monitors SonarQube's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.