// Trust & Security Report
Amazon Web Services, Inc.
Amazon Q Developer - a generative AI coding assistant for developers with capabilities in IDEs (JetBrains, VS Code, Visual Studio, Eclipse), CLI, AWS Management Console, and chat applications (Teams, Slack, GitHub). Successor to Fig command-line tool, which AWS acquired in August 2023 and integrated into Amazon Q Developer.
Certifications held
5
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on docs.aws.amazon.com“Amazon Q Developer is included in the latest SOC 1/2/3 reports. Customers can download third-party audit reports using AWS Artifact.”
Verify on aws.amazon.com“AWS maintains ISO/IEC 27001:2022 certification. As Amazon Q Developer runs on AWS infrastructure and benefits from AWS security controls, ISO 27001 applies at the platform level, though Amazon Q Developer's specific service scope status should be confirmed with AWS.”
Verify on aws.amazon.com“AWS has incorporated GDPR Data Processing Agreement terms into the AWS Service Terms, which automatically apply to customers whose activities come within GDPR scope.”
Verify on aws.amazon.com“AWS maintains PCI DSS compliance certification at the infrastructure level. AWS services including Amazon Q, when properly configured, can support PCI DSS compliance requirements.”
Verify on aws.amazon.com“AWS maintains FedRAMP certification for AWS GovCloud regions. Amazon Q is accessible through AWS infrastructure that includes FedRAMP certified services.”
> Show 2 unconfirmed / not-held certifications
source: docs.aws.amazon.comAmazon Q Developer is not designed to transmit, store, or process ePHI (electronic protected health information). Customers must ensure Amazon Q Developer is never used with ePHI data. Only Amazon Q Business offers HIPAA compliance.
source: docs.aws.amazon.comAmazon Q Business is compliant with ISO/IEC 42001, but this certification is not explicitly confirmed for Amazon Q Developer.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Multiple AWS regions; customers can choose region for data residency
Amazon Q Developer Free Tier: AWS may use questions, responses, and generated code for service improvement, debugging, and model training. Users can opt out via AWS Organizations AI services opt-out policy or IDE settings. Amazon Q Developer Pro: AWS does NOT use content for service improvement. Data usage policies differ significantly by pricing tier.
// Security controls
Encryption in Transit
TLS 1.2 or later required; TLS protocol used for all data transmission
docs.aws.amazon.comEncryption at Rest
AWS encryption solutions and default security controls within AWS services; FIPS 140-2 validated cryptographic modules available
docs.aws.amazon.comAccess Controls
Enterprise-grade access controls via AWS IAM; respects AWS IAM Identity Center governance, identities, roles, and permissions
aws.amazon.com// Products & data scope
data: User code, questions, generated code suggestions. For Free Tier: may be used for service improvement and model training. For Pro: not used for service improvement.
Available in JetBrains, IntelliJ IDEA, Visual Studio, VS Code, Eclipse; inline code suggestions and vulnerability scanning
data: CLI commands and responses; subject to same data usage policies as IDE
Successor to Fig Desktop command-line tool; autocompletion and AI assistance in terminal
data: AWS resource queries and responses; respects AWS IAM permissions
Available in AWS Management Console and AWS Console Mobile Application
data: Chat interactions in Teams and Slack; subject to service improvement policies
Integrations with Microsoft Teams and Slack for operational monitoring and AWS troubleshooting
data: GitHub code and pull requests; currently does NOT use content for service improvement
Feature implementation, code review, Java transformation; AWS will provide notice before enabling data usage
// What to watch
- PRODUCT IDENTITY: 'Fig (Amazon Q)' refers to Fig Desktop, acquired by Amazon in August 2023 and integrated into Amazon Q Developer. Fig as a standalone product sunset September 1, 2024. Assessment is for Amazon Q Developer successor product.
- CERT SPECIFICITY: SOC 2 Type 1/2/3 and PCI DSS certifications apply to AWS platform overall. Amazon Q Developer's specific service-level inclusion in these certifications is asserted by AWS but should be confirmed via AWS Artifact for the most recent audit reports.
- HIPAA LIMITATION: Amazon Q Developer is explicitly NOT suitable for HIPAA use cases. Only Amazon Q Business (separate product) offers HIPAA BAA. This is a material difference from Amazon Q Business.
- DATA TRAINING TIER DIFFERENCE: Free Tier and Pro Tier have dramatically different data usage policies. Free Tier data is used for model training unless explicitly opted out. Pro Tier data is NOT used for service improvement. This is a critical distinction for compliance-sensitive customers.
- GDPR: AWS has global DPA and GDPR compliance, but responsibility is shared. Customers must configure Amazon Q appropriately to ensure GDPR compliance for their use case (no sensitive personal data in prompts).
- NO EXPLICIT ISO 42001 MENTION: While Amazon Q Business has ISO 42001 (AI governance), Amazon Q Developer's scope for this certification is not explicitly documented. Given it is an AI service, ISO 42001 compliance should be confirmed with AWS.
- GITHUB INTEGRATION PREVIEW: Data usage policy for Amazon Q Developer in GitHub may change in future versions; AWS committed to providing notice.
- INHERITED VS. SERVICE CERTS: Amazon Q Developer's compliance posture benefits from AWS's infrastructure certifications but should be distinguished from dedicated service-level certifications.
// At a glance
Pricing model
Freemium: Free Tier with limits (50 agentic interactions/month, 1000 lines code transformation/month); Pro Tier at $19/month per user
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Amazon Web Services, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
aws.amazon.com