Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

  1. Explore
  2. Q Developer Pro
QD

Q Developer Pro

Sovereignty grade C (52/100). EU region selectable; no training on your data. AWS, United States.

Category
coding-assistant
Certifications
C5HDSISO 27001ISO 27017ISO 27018ISO 42001SOC 2 Type II
Categories
Coding assistant
EU AI Act role
Deployer
Deployments
Hosted API
Government access exposure
US CLOUD Act
Countries
United States

Details

Deployment
hosted
Hq Country
United States
Hq City
Seattle
Ownership
public
Founded
2006
Trust Center Url
aws.amazon.com/compliance/sub-processors
Training Default
never
Residency Options
Europe geography — Frankfurt, Ireland, Paris, Stockholm, United States geography, Asia Pacific geography
Gov Access Exposure
us-cloud-act
Eu Ai Act Role
deployer
Certs
ISO 42001, ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, C5, HDS
DPA available
yes
Retention Default
"We do not use content from Amazon Q Developer Pro or Amazon Q Business for service improvement." The Free tier is the opposite — its questions, responses and generated code may be used for service improvement including model training, with opt-out via an AWS Organizations AI services policy or an IDE setting.
Retention Exceptions
Cross-region inference is on by default and is scoped to the geography, not the Region: a request from a Europe profile may be served from Frankfurt, Ireland, Paris or Stockholm. AWS states this does not change where data is stored but that "your requests and output results may move outside of the Region where the data originally resides". Certain features may also make cross-region API calls, which can be blocked with an IAM policy at the cost of those features.
Subprocessors
AWS infrastructure entities per Region, plus service-specific AWS entities and contracted third parties — published in full at aws.amazon.com/compliance/sub-processors, with the European Sovereign Cloud listed separately
Subprocessor Count
4
Transfer Mechanism
sccs+dpf
Eu Procurement Ready
conditional
Eu Procurement Reason
The clean part is genuinely clean: paying for Q Developer Pro buys a written commitment that AWS does not use the content for service improvement, and the Free tier's opposite default makes that a real product distinction rather than boilerplate. AWS's sub-processor disclosure is the most complete in this batch, updated on 30 days' notice, with the European Sovereign Cloud broken out separately. What a European buyer has to accept is the shape of the rest: a US controller under the CLOUD Act, transfers on SCCs plus the Data Privacy Framework, and cross-region inference that is scoped to a geography rather than a Region — so "Europe" means Frankfurt or Ireland or Paris or Stockholm, chosen by AWS at request time. There is no exit either: Q Developer is an AWS-only assistant wired to Bedrock, so the prompts, the context engine and the IDE plugin all end at the same vendor.
Training Evidence Url
docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/service-improvement.html
Training Claim Basis
stated
Training Confidence
high
Residency Evidence Url
docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/cross-region-processing.html
Residency Claim Basis
stated
Residency Confidence
high
Retention Evidence Url
docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/data-protection.html
Retention Claim Basis
stated
Retention Confidence
medium
Subprocessors Evidence Url
aws.amazon.com/compliance/sub-processors
Subprocessors Claim Basis
stated
Subprocessors Confidence
high
Residency Class
eu-selectable
Portability / Exit Path
proprietary-only
Subprocessor Jurisdiction
non-eu
Underlying model providers
Amazon Bedrock (Anthropic Claude and Amazon Nova models)
At a glance
Governance Grade
C
Governance Score
52
EC SOV-2 Legal & Jurisdictional (0-4)
1
EC SOV-3 Data & AI (0-4)
2
Website

Similar

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D

More Certifications

  • SOC 2 Type II46
  • ISO 2700136
  • ISO 4200113
  • ISO 270177
  • ISO 277017
  • ISO 270186
  • HDS5
  • HIPAA4
  • CSA STAR4
  • C54
  • ISO 90013
  • PCI DSS3
  • FedRAMP High3
  • ISO 27001:20223
  • SOC 2 (type unverified)2
  • ISO 500012
  • BSI C52
  • SOC 32
  • FedRAMP2
  • GDPR2
  • CSA STAR Level 12

More Categories

  • Coding assistant15
  • meeting-ai13
  • Sovereign host13
  • Inference host13
  • SaaS-embedded11
  • Foundation model11
  • Cloud platform7

More EU AI Act role

  • Deployer59
  • General-purpose AI (GPAI)10
  • provider9
  • GPAI with systemic risk5

More Deployments

  • Hosted API68
  • Self-hosted weights6
  • On-premise6
  • Private VPC2

More Government access exposure

  • US CLOUD Act44
  • No non-EU government access27
  • Mixed jurisdiction9
  • PRC National Intelligence Law2

More Countries

  • United States45
  • Germany9
  • France7
  • Switzerland5
  • Singapore3
  • Israel2
  • United Kingdom2
  • China2
  • Netherlands2