- Deployment
- hosted
- Hq Country
- Israel
- Hq City
- Tel Aviv
- Ownership
- private
- Founded
- 2022
- Training Default
- never
- Gov Access Exposure
- mixed
- Eu Ai Act Role
- deployer
- Certs
- SOC 2 (type unverified)
- DPA available
- yes
- Self Host Option
- Yes
- Retention Default
- No inference retention window is published. The privacy policy covers Qodo's own controller-side processing and states retention is "as long as it is necessary based on the purpose it was collected for"; the pricing and enterprise pages both state "Qodo does not train models on your code" and "No code is used for training".
- Retention Exceptions
- Qodo sells three deployment models — multi-tenant SaaS, single-tenant in the customer's VPC, and on-premises including air-gapped — and describes the single-tenant option as "ideal if you need data residency". It publishes nothing about where the default multi-tenant service actually runs, which is why this row carries no residency class at all.
- Subprocessors
- not published — the trust centre at trust.qodo.ai returns HTTP 403 to every automated path attempted
- Subprocessor Count
- 0
- Transfer Mechanism
- none-stated
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- Qodo is unambiguous about the one thing buyers ask first — "Qodo does not train models on your code", stated on both the pricing FAQ and the enterprise page — and it offers the deployment ladder a regulated buyer wants: multi-tenant, single-tenant VPC, on-premises and air-gapped. Everything downstream of that is unpublished. The privacy policy acknowledges international transfers and names no Chapter V mechanism for them, the same posture that costs Cursor its transfer points. No region is published for the default hosted service, so a buyer cannot tell whether an EU option exists without asking. No sub-processor list is reachable and no foundation-model provider is named, which is unusual for a platform that markets itself as model-agnostic. The compliance claim is "SOC 2" with no type, and trust.qodo.ai returned HTTP 403 to every automated request, so it is recorded here as unverified rather than absent — worth a human browser and a direct request for the report before this row is read as a verdict on Qodo's security posture.
- Training Claim Basis
- stated
- Training Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- medium
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- undisclosed
- Underlying model providers
- model-agnostic — "powered by leading foundation models"; no provider is named in any public document
