Sonar
Sonar is a code verification and automated review platform that inspects human-written and AI-generated code for bugs, vulnerabilities, secrets and technical debt, then generates verified fixes across IDEs, pull requests and agentic coding workflows.
What is Sonar?
Sonar is the code verification platform published by the Swiss company SonarSource Sarl, with headquarters in Vernier near Geneva and a second headquarters in Austin, Texas. Its stated role in 2026 is to act as an independent, zero-trust verification layer over all code, whether a developer or an AI agent wrote it.
The company frames this around a method it calls the Agent Centric Development Cycle: Guide, where agents receive context and guardrails before they write; Verify, where output is reviewed by algorithmic and agentic methods; and Solve, where fixes are produced in real time and in the background. Three loops carry it, an agentic loop inside the agent sandbox, a CI verification loop with a quality gate at the exit, and a maintenance loop that clears legacy debt.
The core product is SonarQube, available three ways: Cloud, a multi-tenant SaaS on AWS; Server, self-managed inside your own perimeter with Developer, Enterprise and Data Center editions and an air-gapped option; and for IDE, a free extension giving on-the-fly analysis while you type. Around it sit SonarQube Advanced Security, covering software composition analysis, dependency-aware Advanced SAST, malicious package detection, SBOM and licence policy; Gitar, the AI code review product Sonar acquired in May 2026, which inspects pull requests, diagnoses CI failures and applies fixes until the build passes; plus Sonar Vortex, the Remediation Agent, the Hunter Agent, an open-source MCP Server and CLI, and SonarSweep in early access.
Analysis capabilities include SAST covering the OWASP Top 10, cross-file and cross-function taint analysis, secrets detection, infrastructure-as-code scanning for Terraform, Kubernetes, CloudFormation, Azure Resource Manager and Ansible, code coverage and architecture management. Coverage runs to more than 30 languages on the Team plan and more than 40 on Enterprise, including legacy estates in COBOL, ABAP, RPG, PL/I and JCL.
Sonar claims 7 million developers, 75% of the Fortune 100, 750 billion lines analysed daily and a 3.2% false-positive rate, and cites Cisco, Freshworks, Xero, Deutsche Bank, Ford and NASA among its users. It was named a Leader in the 2026 Gartner Magic Quadrant for Technical Debt Management Tools.
What it does
- Review every pull request, branch and commit automatically against curated rules
- Detect vulnerabilities, bugs, security hotspots, duplications and technical debt
- Catch leaked secrets such as API keys, passwords and tokens before they are committed
- Generate context-aware fixes with AI CodeFix and apply them in a single click
- Open verified, ready-to-merge remediation pull requests in the background
- Feed coding agents your architecture and standards, then verify their output in real time
- Block merges on a quality gate and produce auditable evidence of compliance
When to use Sonar / When not to
A quick filter to help you decide if Sonar is the right fit.
When to use Sonar
- Engineering teams shipping AI-generated code who need an independent verification layer before merge
- Platform and DevOps engineers standardising quality gates across hundreds or thousands of repositories
- Application security engineers who want SAST, taint analysis and secrets detection inside the developer workflow
- Regulated organisations that must evidence OWASP, PCI DSS, MISRA C++:2023, CRA or DORA compliance
- Enterprises needing data residency or an air-gapped install, served by the self-managed SonarQube Server
When not to use Sonar
- Developers hunting for a code generator or AI pair programmer, since Sonar deliberately verifies code rather than writing features
- Non-technical users, because everything happens in IDEs, CI pipelines and coding agents
- Anyone who needs a mobile app, as no iOS or Android client is published
- Small teams wanting SCA, SBOM or compliance reporting cheaply, since these sit in Enterprise and paid add-ons
- Teams that require a documented opt-out from AI training, which the site does not publish
How to use Sonar
A typical end-to-end flow, from setup to results.
- Start free from the pricing page or the Cloud onboarding link, since the free tier never expires
- Sign in to SonarQube Cloud with a GitHub, GitLab, Bitbucket Cloud or Azure DevOps account, as there is no separate Sonar password
- Import the repositories you want analysed and let the first scan establish a baseline
- Install SonarQube for IDE in VS Code, IntelliJ, Eclipse, Visual Studio or Android Studio to surface issues as you type
- Wire analysis into your pipeline with the SonarQube CLI or a scanner, authenticated by a revocable token
- Configure a quality gate and switch on pull request decoration so results appear in GitHub, GitLab, Bitbucket or Azure DevOps
- Enable AI CodeFix to generate and apply context-aware fixes straight from a finding
- Connect your coding agents through the MCP Server, the CLI or the plugins and slash commands for Claude Code, Gemini, Kiro, Antigravity and Codex
- Add Gitar for agentic pull request review, which comes with a 14-day free trial
- Choose SonarQube Server instead if you need complete data residency or an air-gapped deployment
Pros & Cons
Pros
- Quality, security and compliance in one platform, from the IDE through CI to the pull request
- A genuine choice between managed SaaS and self-hosting, including data residency and air-gapped installs
- Unusually wide language coverage, legacy stacks such as COBOL, ABAP, RPG and PL/I included
- Well-documented security posture: ISO 27001:2022, SOC 2 Type II, external penetration tests, published technical and organisational measures, DPA and subprocessor list
- A free tier that never expires, plus fully free use for open-source projects on both SonarQube and Gitar
- Native hooks into the main coding agents, from Claude Code and Cursor to Copilot, Devin, Windsurf, Gemini CLI and Codex
- The AI Annex assigns ownership of submitted code and generated fixes clearly to the customer
Cons
- Two pricing ladders that do not compare, since SonarQube bills per instance per year by lines of code while Gitar bills per user per month
- Only the entry prices are public, as Enterprise, Advanced Security and Agent Essentials all require a quote
- The compliance features regulated teams need most, such as OWASP, PCI DSS, MISRA, CRA, SCA, SBOM and audit logs, sit outside the Team plan
- No documented opt-out from AI training, and the training clause names only Cloud Enterprise and Server
- No support email is published, so everything routes through the portal or the community, and commercial support is a paid add-on
- No Article 27 EU representative and no named Data Protection Officer, with retention periods left unquantified
- The SOC 2 Type II report is only accessible under a non-disclosure agreement
Pricing & Plans
A permanent free tier is available and does not expire, covering unlimited public projects and private projects of up to 50,000 lines of code on SonarQube, while Gitar is offered at no cost to open-source repositories under an OSI-approved licence. Paid plans carry a 14-day trial. The lowest published price point is USD 20.00 per user per month for Gitar Core on annual billing, rising to USD 25.00 on monthly billing. The flagship SonarQube Team plan is priced on a separate scale and starts at USD 34 per month for up to 100,000 lines of code analysed. SonarQube Enterprise, SonarQube Server, Advanced Security and Sonar Agent Essentials are quoted on request.
- 50
- 000 private lines of code
- unlimited public projects
- never expires
- from USD 34 per month for 100
- 000 lines of code
- 30+ languages
- secrets detection
- AI-driven code fixes
- pull request analysis
- architecture management
- custom pricing
- 40+ languages
- security reports and audit logs
- OWASP
- CWE
- PCI DSS and MISRA C++:2023
- unlimited users and projects
- SSO
- Developer
- Enterprise and Data Center editions
- priced per instance per year by lines of code
- add-on for Team and Enterprise
- custom pricing
- covering CVE detection
- malicious packages
- dependency-aware taint analysis
- SBOM and licence policy
- usage-based add-on for Team and Enterprise
- bundling Sonar Vortex
- the Remediation Agent
- the SonarQube CLI
- the MCP Server and agent plugins
- USD 20 per user per month billed annually or USD 25 monthly
- unlimited public and private repositories
- up to 50 users
- USD 40 per user per month billed annually or USD 50 monthly
- adding auto-approve
- merge blocking
- auto-apply and Slack
- Linear and Jira integrations
- custom pricing
- self-hosted code hosting
- bring your own LLM API key
- SSO and SAML
- audit logs
- API access
- no cost for public OSI-licensed repositories
- with the Pro feature set
- Base included at no charge
- then Core
- Standard and Enterprise on quote
- with 24x5 or 24x7 coverage and response times from one hour to two business days
Data, GDPR & hosting
A consolidated view of how Sonar handles your data.
GDPR overview
Implementation is concrete and documented. The Privacy Notice, last updated 3 November 2025, names the GDPR alongside the UK Data Protection Act and the Swiss Federal Act on Data Protection, and sets out four legal bases: contractual necessity, legitimate interests, legal obligations and consent. Access, rectification, erasure, restriction, objection, withdrawal of consent and portability are all listed, exercised at security@sonarsource.com, with a one-month response commitment extendable by two months. Transfers outside adequate jurisdictions rely on Standard Contractual Clauses, UK International Data Transfer Agreements and Swiss addenda. A Data Processing Addendum and a subprocessor list with an RSS feed are published, and the company holds ISO 27001:2022 and SOC 2 Type II. Two gaps stand out: no Article 27 EU representative is designated and no Data Protection Officer is named.
Who owns the data?
Under the AI Annex, all right, title and interest in Input Data, meaning the customer content submitted for analysis, belong exclusively to the customer, intellectual property included. The fixes the platform produces, called Suggestions, are treated as Customer Data, and SonarSource states it claims no right, title or interest in them. One reservation applies: the Sonar Proprietary Logic, its rules, prompts, templates and their compilation, stays SonarSource property even where it is incidentally embedded in a Suggestion. For personal data, SonarSource Sarl acts as controller, while the customer organisation administers its own users, their permissions and their accounts.
Reuse rights
The customer grants SonarSource the right to use Input Data to deliver the service and produce Suggestions. Reusing the generated fixes needs no further permission: they are Customer Data and may be used for any purpose, subject to two limits, the Acceptable Use Policy and a ban on extracting or recompiling the Sonar Proprietary Logic outside individual Suggestions. On training, the AI Annex is conditional rather than absolute: SonarSource will train on the Input Data of SonarQube Cloud Enterprise and SonarQube Server customers only where that training is solely for the benefit of that same customer. No opt-out mechanism from AI training is documented anywhere on the site. The large language models involved may be supplied by SonarSource, by third parties under contract, or by the customer through its own API key on the Gitar Enterprise plan. The Trust Center adds that only source code from the most recent scans is stored, never the whole repository, and that customers may delete their projects at any time.
Data retention & training
Hosting summary
SonarQube Cloud is a multi-tenant SaaS hosted in Amazon Web Services data centres. EU hosting is the default, in Frankfurt, Germany on AWS eu-central-1 through sonarcloud.io, while US hosting in Northern Virginia on AWS us-east-1 through sonarqube.us is available to some customers. Backups sit in AWS eu-west-1 for Europe and us-west-2 for the United States. Within each region services span three availability zones, databases replicate in near real time and are fully backed up daily off-site. Data at rest is encrypted to AES-256 with Sonar-managed keys, logs live in protected S3 buckets, and all public traffic requires TLS 1.2. The declared hosting subprocessor is Amazon Web Services EMEA SARL in Dublin, with locations listed as Germany, Ireland and the USA. Customers needing complete data residency can run SonarQube Server inside their own perimeter, with an air-gapped option. The Privacy Notice adds that the wider group operates from the European Union, United Kingdom, Switzerland, Japan, Singapore, the United Arab Emirates and the United States, and that personal data may be processed in those jurisdictions.
Things to keep in mind
Risks and trade-offs to weigh before adopting Sonar.
- Automated verification can breed complacency: the AI Annex states plainly that Suggestions may be incorrect, incomplete or contain vulnerabilities, and that reviewing them stays the customer's responsibility
- Letting an agent commit fixes on your behalf can erode a team's own grip on its codebase if the review and control features are left unconfigured and unmonitored
- The training clause is conditional, not a refusal: training on customer Input Data is permitted where it is solely for that customer's benefit, and no opt-out is documented
- Where you bring your own model, Sonar's proprietary prompts and rules are transmitted to it and must be treated as confidential information, including anything your provider logs
- Billing follows the lines of code in the largest branch of your private projects, so a large monorepo can push you into a higher tier without warning
- Personal data may be processed across the European Union, the United Kingdom, Switzerland, Japan, Singapore, the United Arab Emirates and the United States, which widens the jurisdictional surface
- A green quality gate is not a security guarantee, and treating a passing build as proof of safety misreads what static analysis can establish
Setup & Integrations
Technical difficulty
Low to moderate on the cloud path, higher if you self-host. SonarQube Cloud advertises being live in under ten minutes with no infrastructure to manage: you sign in with an existing GitHub, GitLab, Bitbucket or Azure DevOps account and import repositories. The IDE extension installs from the editor marketplace in one click. Wiring analysis into CI means configuring a scanner and a revocable token, so pipeline familiarity helps. SonarQube Server puts deployment, upgrades and infrastructure on your own team. Agentic setups add an MCP Server or CLI. Throughout, the audience is developers and platform teams, not general users.
Deployment
Integrations
Behind Sonar
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Sonar.
Frequently asked questions
Is there a free plan?
What is the cheapest paid plan?
Can Sonar be self-hosted?
Where is data hosted on the SaaS version?
Is my code used to train AI models?
Who owns the fixes that Sonar generates?
Which security certifications does Sonar hold?
Which programming languages does it analyse?
How does support work?
Is a Data Processing Addendum available?
Should you pick Sonar?
Sonar is one of the few established names in static analysis that has genuinely repositioned itself for agentic development rather than simply relabelling what it already had. After close to two decades on code quality, the 2026 line-up, with Vortex, the Remediation Agent, the Hunter Agent, an MCP Server and the Gitar acquisition, is built around a single argument: if agents write most of the code, verification has to be independent of whoever wrote it.
The depth is real. SAST, taint analysis, secrets detection, IaC scanning, software composition analysis and architecture management across more than 40 languages is a wider surface than most competitors cover, and the choice between managed SaaS and a self-hosted, optionally air-gapped server is rare at this level. The security and privacy documentation is above average for the category: ISO 27001:2022, SOC 2 Type II, published technical and organisational measures, a Data Processing Addendum and a subprocessor list with an RSS feed. The AI Annex assigns ownership of submitted code and generated fixes to the customer in plain terms.
Two reservations deserve weight. The training clause is conditional rather than a refusal, since training on customer input is permitted where it is solely for that customer's benefit, and no opt-out is documented anywhere on the site. And pricing is legible only at the entrance: two ladders that do not compare, with everything above the first tier behind a quote, including the compliance features regulated teams actually need.
For an engineering organisation already running AI coding agents at scale, especially one under regulatory scrutiny, Sonar is a serious candidate. For a small team after inexpensive SCA and compliance reporting, the free tier teaches a great deal but the useful features sit further up the ladder than the entry price suggests.
- Choosing a selection results in a full page refresh.
- Opens in a new window.