SonarQube · Trust Center

Sonarqube Trust Center

Trust center

SonarSource publishes a Vanta-hosted trust center (trust.sonarsource.com, "Sonar and Gitar Security and Data Protection", rendered 2026-11-05) listing certifications, self-assessments, penetration-test summaries and policies, with a request-access gate for the documents themselves, plus a marketing trust-center page on sonarsource.com that links it, the status page and the accessibility statement. The dossier's security-programs probe wrote nothing because the certifications are rendered client-side; they were read from the rendered page.

SonarQube maintains a public trust center documenting SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 27018:2019, CSA STAR Level 1, and PCI DSS SAQ-A compliance.

Code QualityDeveloper ToolsDevOpsSecurityStatic AnalysisCode SecuritySAST
Trust center: https://trust.sonarsource.com/

Certifications & Compliance

SOC 2 Type IIISO/IEC 27001:2022ISO/IEC 27018:2019CSA STAR Level 1PCI DSS SAQ-A

Source

Trust Center

Raw ↑ 
generated: '2026-11-05'
method: searched
source:
- https://trust.sonarsource.com/
- https://www.sonarsource.com/trust-center/
- https://www.sonarsource.com/legal/security-tom/
url: https://trust.sonarsource.com/
platform: vanta
name: Sonar Security Trust Center
description: SonarSource publishes a Vanta-hosted trust center (trust.sonarsource.com, "Sonar and Gitar Security
  and Data Protection", rendered 2026-11-05) listing certifications, self-assessments, penetration-test summaries
  and policies, with a request-access gate for the documents themselves, plus a marketing trust-center page on sonarsource.com
  that links it, the status page and the accessibility statement. The dossier's security-programs probe wrote nothing
  because the certifications are rendered client-side; they were read from the rendered page.
contact: security@sonarsource.com
certifications:
- SOC 2 Type II
- ISO/IEC 27001:2022
- ISO/IEC 27018:2019
- CSA STAR Level 1
- PCI DSS SAQ-A
penetration_tests:
- SonarQube Server October 2026 Pentest Executive Summary.pdf
- SonarQube Cloud May 2026 Pentest Executive Summary.pdf
- SonarQube Hunter Agent August 2026 Pentest Executive Summary.pdf
- SonarQube Remediation Agent PenTest June 2026.pdf
related:
  status_page: https://status.sonarqube.com/
  accessibility_statement: https://www.sonarsource.com/accessibility/
  subprocessors: https://www.sonarsource.com/legal/sub-processors/
  security_measures: https://www.sonarsource.com/legal/security-tom/
  vulnerability_reporting: '"please follow our Responsible Vulnerability Disclosure process to report it to our
    security team" (https://www.sonarsource.com/trust-center/); contact security@sonarsource.com. No standalone
    disclosure-policy page or security.txt was found on sonarsource.com during this pass.'
platform_evidence: trust.sonarsource.com serves the Vanta Trust Center app (data-signature-manifest-url assets.vanta.com
  in the page HTML, 2026-11-05)
frameworks:
- name: SOC 2 Type II
  evidence: '"Sonar SOC 2 Type II Report Nov 2025 - Oct 2026.pdf" listed under Certifications and Attestations on
    https://trust.sonarsource.com/; "Sonar maintains both ISO 27001:2022 certification and SOC 2 Type II attestation
    for all products and services" (https://www.sonarsource.com/trust-center/)'
  scope: all products and services
- name: ISO/IEC 27001:2022
  evidence: '"ISO 27001:2022 Certificate" and "ISO 27001 SoA" listed on https://trust.sonarsource.com/'
  scope: all products and services
- name: ISO/IEC 27018:2019
  evidence: '"Sonar ISO 27018 Certification" on https://trust.sonarsource.com/; https://www.sonarsource.com/legal/security-tom/
    "Maintains ISO 27001:2022 certification, ISO 27018:2019 certification, and/or AICPA SOC 2 attestation."'
  scope: null
- name: CSA STAR Level 1
  evidence: '"CSA STAR Level 1 Registry - SonarQube Cloud" and "SonarQube Cloud 2026 CSA CAIQ v4.1.0" under Self
    Assessments on https://trust.sonarsource.com/'
  scope: SonarQube Cloud
- name: PCI DSS SAQ-A
  evidence: '"Sonar PCI-DSS SAQ-A" under Self Assessments on https://trust.sonarsource.com/'
  scope: SonarQube Cloud

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/sonarqube-trust-center"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.