SonarQube AI features, pricing and GDPR (October 2026)

SonarQube checks source code for bugs, maintainability problems and security vulnerabilities, either as the cloud service SonarQube Cloud or as a self-hosted server, and adds AI-generated fix suggestions for many of the issues it finds.

SonarQube runs static analysis on every branch and pull request and reports issues against quality gates that teams define. The Team plan covers more than 30 programming languages, Enterprise more than 40, and the service integrates with common Git platforms and IDEs. The Team and Enterprise plans include Advanced Security with static application security testing and software composition analysis. The contracting entity is SonarSource Sàrl in Geneva, and the vendor names Austin, Texas, and Geneva as its headquarters. A free tier covers up to 50,000 lines of code in private projects, and public open source projects can use it at no cost.

• Proposes fixes for detected issuesWith AI CodeFix, a developer selects Generate AI Fix on an eligible issue and receives a suggested code change that can be applied in the IDE. This shortens the step from finding a problem to fixing it, especially for routine rule violations.
• Keeps customer code out of model trainingCode snippets go to the language model only when a fix is requested. Sonar states that its agreements with the model providers prevent customer code from being used for training, and monthly usage limits apply per organization.
• Adds AI review and remediationGitar AI Code Review reviews every pull request, writes the fix and iterates until CI passes; it is included in Enterprise and otherwise billed per user. Enterprise also lists a Remediation Agent and a Hunter Agent with outcome-based pricing. Larger engineering organizations get automated review and fix work on top of the rule-based findings.

• Available both as SonarQube Cloud and as self-hosted Server editions (Developer, Enterprise, Data Center) priced by lines of code.
• Cloud data is stored in Frankfurt (AWS eu-central-1); US hosting in Northern Virginia is available for some customers, according to the trust center.
• Free for public repositories under an OSI-approved license.

The contracting entity is SonarSource Sàrl in Geneva, and the vendor lists Austin, Texas, and Geneva, Switzerland, as its headquarters.

Decide between the cloud service and a self-hosted server. The cloud service runs in Frankfurt by default, and US hosting is only offered to some customers. AI CodeFix is only included in the Team and Enterprise plans and sends code snippets to an external language model. Check the data processing addendum and the subprocessor list, and note that SSO and SCIM are limited to Enterprise.

No reviews yet. Be the first to share how your team uses it.

Every review shows its verification level. We read each one before it goes live. How we check reviews