// Trust & Security Report
Fig (Amazon Q)
by Amazon Web Services, Inc.
Amazon Q Developer - a generative AI coding assistant for developers with capabilities in IDEs (JetBrains, VS Code, Visual Studio, Eclipse), CLI, AWS Management Console, and chat applications (Teams, Slack, GitHub). Successor to Fig command-line tool, which AWS acquired in August 2023 and integrated into Amazon Q Developer.
Certifications held
5
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on docs.aws.amazon.com“Amazon Q Developer is included in the latest SOC 1/2/3 reports. Customers can download third-party audit reports using AWS Artifact.”
Verify on aws.amazon.com“AWS maintains ISO/IEC 27001:2022 certification. As Amazon Q Developer runs on AWS infrastructure and benefits from AWS security controls, ISO 27001 applies at the platform level, though Amazon Q Developer's specific service scope status should be confirmed with AWS.”
Verify on aws.amazon.com“AWS has incorporated GDPR Data Processing Agreement terms into the AWS Service Terms, which automatically apply to customers whose activities come within GDPR scope.”
Verify on aws.amazon.com“AWS maintains PCI DSS compliance certification at the infrastructure level. AWS services including Amazon Q, when properly configured, can support PCI DSS compliance requirements.”
Verify on aws.amazon.com“AWS maintains FedRAMP certification for AWS GovCloud regions. Amazon Q is accessible through AWS infrastructure that includes FedRAMP certified services.”
> Show 2 unconfirmed / not-held certifications
source: docs.aws.amazon.comAmazon Q Developer is not designed to transmit, store, or process ePHI (electronic protected health information). Customers must ensure Amazon Q Developer is never used with ePHI data. Only Amazon Q Business offers HIPAA compliance.
source: docs.aws.amazon.comAmazon Q Business is compliant with ISO/IEC 42001, but this certification is not explicitly confirmed for Amazon Q Developer.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Multiple AWS regions; customers can choose region for data residency
Amazon Q Developer Free Tier: AWS may use questions, responses, and generated code for service improvement, debugging, and model training. Users can opt out via AWS Organizations AI services opt-out policy or IDE settings. Amazon Q Developer Pro: AWS does NOT use content for service improvement. Data usage policies differ significantly by pricing tier.
// Security controls
Encryption in Transit
TLS 1.2 or later required; TLS protocol used for all data transmission
docs.aws.amazon.comEncryption at Rest
AWS encryption solutions and default security controls within AWS services; FIPS 140-2 validated cryptographic modules available
docs.aws.amazon.comAccess Controls
Enterprise-grade access controls via AWS IAM; respects AWS IAM Identity Center governance, identities, roles, and permissions
aws.amazon.com// Products & data scope
Data it handles: User code, questions, generated code suggestions. For Free Tier: may be used for service improvement and model training. For Pro: not used for service improvement.
Available in JetBrains, IntelliJ IDEA, Visual Studio, VS Code, Eclipse; inline code suggestions and vulnerability scanning
Data it handles: CLI commands and responses; subject to same data usage policies as IDE
Successor to Fig Desktop command-line tool; autocompletion and AI assistance in terminal
Data it handles: AWS resource queries and responses; respects AWS IAM permissions
Available in AWS Management Console and AWS Console Mobile Application
Data it handles: Chat interactions in Teams and Slack; subject to service improvement policies
Integrations with Microsoft Teams and Slack for operational monitoring and AWS troubleshooting
Data it handles: GitHub code and pull requests; currently does NOT use content for service improvement
Feature implementation, code review, Java transformation; AWS will provide notice before enabling data usage
// What to watch
- 'Fig (Amazon Q)' refers to Fig Desktop, which Amazon acquired in August 2023 and integrated into Amazon Q Developer; Fig as a standalone product sunset on September 1, 2024. This report covers Amazon Q Developer, the successor product.
- SOC 2 Type 1/2/3 and PCI DSS certifications apply to the AWS platform overall; AWS asserts that Amazon Q Developer is included at the service level, but customers should confirm this via AWS Artifact using the most recent audit reports.
- Amazon Q Developer is explicitly not suitable for HIPAA use cases; only Amazon Q Business, a separate product, offers a HIPAA BAA. This is a material difference between the two products.
- The Free Tier and Pro Tier have dramatically different data usage policies: Free Tier data is used for model training unless you explicitly opt out, while Pro Tier data is not used for service improvement. This is a critical distinction for compliance-sensitive customers.
- AWS offers a global DPA and GDPR compliance, but responsibility is shared: customers must configure Amazon Q appropriately to ensure GDPR compliance for their use case, including keeping sensitive personal data out of prompts.
- While Amazon Q Business has ISO 42001 (AI governance) certification, Amazon Q Developer's scope for this certification is not explicitly documented; given it is an AI service, confirm ISO 42001 coverage with AWS.
- The data usage policy for the Amazon Q Developer integration in GitHub, currently in preview, may change in future versions; AWS has committed to providing notice.
- Amazon Q Developer's compliance posture benefits from AWS's infrastructure certifications, but those inherited platform certifications should be distinguished from dedicated service-level certifications.
// At a glance
Pricing model
Freemium: Free Tier with limits (50 agentic interactions/month, 1000 lines code transformation/month); Pro Tier at $19/month per user
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Amazon Web Services, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
aws.amazon.com