AI Code Review for Regulated Teams: Claims Verified (2026)

Direct answer

We read the trust centres of 26 AI code review and code security vendors on 2026-10-18. Twenty-one name a SOC 2 Type II; every report is gated. Only 7 hold ISO/IEC 42001:2023. Only 4 will sign a HIPAA BAA. Only 1 publishes an actual FedRAMP authorization package. Nobody is “HIPAA certified”, because that scheme does not exist. Verify at the source, including against this page.

Two corrections most compliance comparison pages get wrong

Lead with these, because being right about them is the entire value of this page.

1. “HIPAA certified” is not a real certification scheme

There is no HHS-issued HIPAA certificate and no accreditation body that grants one. What HIPAA actually requires is a signed Business Associate Agreement. A vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate under 45 CFR 160.103, and you must have a BAA in place under 45 CFR 164.308(b) before it touches PHI.

A SOC 2 report does not substitute for a BAA. Neither does a privacy policy, an email confirming security practices, or a “HIPAA compliant” badge. A tool can hold SOC 2 Type II and ISO 27001 and still be legally unusable for PHI because it will not sign.

Of 26 vendors, exactly 4 offer a real BAA (verified on the vendor’s own property, 2026-10-18):

Vendor	BAA evidence
Claude Code / Anthropic	Trust centre carries a HIPAA badge, an FAQ titled “Is Anthropic willing to sign a BAA?”, HIPAA Type 1 reports for both Claude for Enterprise and the first-party API, and a HIPAA-Ready Offering Implementation Guide. A 2026-07-20 update notes revised service eligibility under the BAA
Cursor	Publishes a Cursor_HIPAA_Implementation_Guide.pdf described as a “HIPAA Guide for Enterprise customers wanting to sign BAA”. BAA available to Enterprise; no HIPAA audit report published
Augment Code	Security page carries both a “HIPAA / Compliant” badge and a separate “BAA / Available” badge. The second one is what matters
CodeAnt AI	Enterprise page states “SOC 2 and HIPAA compliant - Controls are audited yearly, with a signed BAA”. Trust centre lists “HIPAA - Compliant”

And the ones to be careful with. GitHub Copilot holds SOC 2 Type II, ISO 27001, ISO 42001 and a published PCI DSS Attestation of Compliance, and is not on Microsoft’s HIPAA BAA in-scope list. Azure DevOps is; GitHub is not. Do not assume parity between two Microsoft-owned properties, and note there is no BAA pathway at all on Free, Pro or Team plans.

Three vendors market to healthcare with no BAA offer anywhere on their property: Aikido targets “HealthTech”, Corgea targets “Healthcare & Biotech”, and Macroscope even lists “Personal health information” under data collected on its trust centre while publishing no HIPAA badge and no BAA. CodeRabbit also lists personal health information under data collected with no BAA offer found. None of that is wrongdoing. It is a mismatch between go-to-market and paperwork, and it is your job to catch it.

The sequence matters: ask the BAA question before the feature question. If the vendor will not sign, the feature comparison is irrelevant for any PHI-touching workflow. And the BAA must be signed before work begins, which rules out the common pattern of starting a trial with real records on a promise to paper it later. Operating without one is itself a violation with no breach required, and 2026 penalty tiers run from $145 to $2,190,294 per violation.

One nuance that cuts the other way, and almost nobody states it. The BAA trigger is whether PHI enters the vendor’s platform. If your repositories contain no production PHI - none in test fixtures, none in snapshots, none in committed debug logs - a code review tool may fall outside business associate status entirely. That is a real argument and it is the one your counsel will want to make. It only works if you can evidence that PHI is not in the repo, which means secrets and PII scanning running before the reviewer, with findings you can show an auditor. That moves the problem from legal to engineering, where you can actually solve it.

2. ISO/IEC 42001:2023 is the AI-specific standard, and almost nobody asks for it

ISO/IEC 42001:2023, “Information technology - Artificial intelligence - Management system,” was published 18 December 2023. It specifies requirements for an AI management system covering exactly the risks a traditional SOC 2 audit does not examine: model integrity, training-data security, AI pipeline risk, and governance of AI-enabled features. Certification comes from accredited third-party bodies on a three-year cycle with annual surveillance audits, after a Stage 1 documentation audit and a Stage 2 implementation audit.

It is the right question to ask an AI code review vendor and it is almost never asked. Seven of 26 hold it.

Vendor	ISO/IEC 42001:2023 evidence
Claude Code / Anthropic	Certificate published on the trust centre, dated 2025. Issued by Schellman Compliance under ANSI National Accreditation Board accreditation, scoped to the AI management system supporting AI research and development and AI services
GitLab	Announced 2025-09-04, certificate on trust.gitlab.com, described as covering AI governance
GitHub Copilot	”GitHub ISO/IEC 42001:2023 Certificate 2026” on the Copilot trust centre, announced 2026-03-25 as “extending ISO/IEC 42001:2023 certification across the GitHub Copilot portfolio”. A GitHub Copilot audit report also sits on Microsoft’s Service Trust Portal
Cursor	”ISO/IEC 42001:2023 - Cursor Products” with a published certificate covering SpaceXAI LLC, Anysphere Inc and first-party datacenter
Augment Code	”ISO/IEC 42001 / Certified” badge; describes an ISO/IEC 42001-certified AI Management System alongside customer-managed encryption keys
Aikido	”ISO 42001:2023 Initial Certification” plus an “AIMS Statement of Applicability” on its Vanta portal
Veracode	”ISO/IEC 42001:2023” compliance badge on trust.veracode.com

Absent: CodeRabbit, Qodo, Greptile, Sonar, Snyk, Semgrep, Checkmarx, Tabnine, Sourcegraph, DeepSource, Codacy, CodeAnt AI, Panto, cubic.dev, Macroscope, Sourcery, Kodus, Corgea and Bito. That is not a criticism of their security; it is a statement about which questions the market is answering.

Two curiosities in that list. Veracode and Augment Code both hold ISO 42001 but we found no ISO 27001 on either trust centre, which is an unusual order to do things in. And Sourcegraph lists the EU AI Act as a compliance item without holding ISO 42001, which is the only time we saw that.

Read the scope statement, not the badge. An ISO 42001 certificate covering one product line does not extend to another. Perforce announced ISO 42001 certification on 2026-02-09, and its certified list covers Delphix Data Control Tower, BlazeMeter test data and AI log analysis, Gliffy, Perfecto AI and Puppet Code Assist - not a code review product. And a supplier’s certificate stops at your boundary: your prompts, your retrieval pipeline, your agent tool permissions and the decisions the output feeds sit inside your management system, not theirs.

For the broader pattern of certification claims that do not survive checking, see fake SOC 2 and ISO 27001 certifications spreading across dev tools.

AI code review tools for regulated software teams

Direct answer: We read 26 vendor trust centres on 2026-10-18. Twenty-one name a SOC 2 Type II, all gated. Seven hold ISO/IEC 42001:2023. Four will sign a HIPAA BAA. One publishes a FedRAMP authorization package. cubic.dev is SOC 2 Type I only and Panto’s audit is still underway. Verified 2026-10-18.

This is a verification table, not a ranking. “Not found” means we could not locate the claim on the vendor’s own trust centre, security page or documentation on 2026-10-18. It does not mean the vendor lacks the control. It means a comparison table is not evidence.

Most trust centres in this market are JavaScript-only applications on Vanta, SafeBase, Drata, SecurityPal or Comp AI. We rendered them rather than reading cached text, and where a portal was login-walled or behind bot protection we have said so.

Vendor	SOC 2	ISO 27001	ISO 42001	DPA published	HIPAA BAA	FedRAMP	PCI DSS	Audit logs	No training on your code
CodeRabbit	Type II + SOC 3 + bridge letter	27001:2022	Not found	Yes	Not found	Not found	Not found	Not found on trust centre; Enterprise tier per pricing	Strongest in market - signed OpenAI ZDR Amendment and Anthropic ZDR Certification. Caveat in their own FAQ: code not retained “except when review caching is enabled”
Qodo	Type II doc listed	Not found	Not found	Not found	Not found	Not found	Not found	Yes, control listed	Not found. Trust centre last updated 2026-06-17
Greptile	Type II and Type I + bridge letter	Not found	Not found	Yes	Not found	Not found	Not found	Not found	ZDR at the model layer only - signed OpenAI, Anthropic and Baseten artifacts. Greptile itself caches: “Code remains cached on our machines until access is revoked”
CodeAnt AI	Type II	Not found	Not found	Yes	Yes, signed BAA	Not found	Not found	Yes - “every scan, access, and change. Export to CSV or SIEM”	Yes - “Code is analyzed in memory, not stored”
Codacy	Type II, by email to security@	Not found for Codacy itself	Not found	GDPR claimed, no DPA doc found	Not found	Not found	Explicitly disclaimed - “not subject to PCI obligations”	Internal only	No - “We retain your usage data after your trial.” Deletion on request. RBAC on all accounts
DeepSource	Type II	Not found	Not found	GDPR badge, no DPA doc	Not found	Not found	Not found	Not found	Not found. GCP listed as subprocessor for Vertex AI and Gemini with no ZDR artifact
Snyk Code	Type II, annual, Schellman	27001:2022 + 27017:2015	Not found	Yes	Not found	Conflicting - badge says “FedRAMP Rev. 5”, own FAQ cert list omits it, no package published	Yes - SAQ A certificate + SAQ published	Not found	Yes - “customer code is never used for AI training”. SSO tier-gated, RBAC yes
Semgrep	Type II, 2023-12-01 to 2024-11-30	Explicitly NOT certified	Not found	Yes + OpenAI DPA + transfer impact assessment	Not found	Not found	Not found	Yes - every scan, finding and status change with timestamps and user attribution	Not found as a commitment. Per-customer model opt-out instead
SonarQube / Sonar	Type II, scope includes AI CodeFix and Advanced Security. NDA explicitly required	27001:2022 + SoA v3.1 + 27018:2019 + CSA STAR L1	Not found	Yes	Not found	Not found	SAQ-A self-assessment only	Documented in product, not on trust centre	Not found on trust centre
Aikido	Type II, 2026 report	27001:2022 + SoA	Yes, 42001:2023	Yes	Not found	Claimed, unsubstantiated - “FedRAMP Certified: Class C (Moderate)” is not standard FedRAMP terminology; no package, only TX-RAMP L2	Not found; CAIQ v4.0.3 published	Yes - “Aikido does not store your code after an analysis”
GitHub Copilot	SOC 1 Type 2, SOC 2 Type 2, SOC 3 + monthly bridge letters	27001:2013 - the superseded version is what is listed	Yes, 2026 certificate	Not on the Copilot trust centre	No - not on Microsoft’s BAA in-scope list	Not found on trust centre	Yes - actual AoC plus a v4.0.1 Shared Responsibility Matrix	Documented in product docs	FAQ exists, answer gated
GitLab	Type 2 for GitLab.com and GitLab Dedicated + bridge letter	27001:2022 + 27017:2015 + 27018:2019	Yes, 2025-09-04	Yes + Data Privacy Framework certified	Not found	Not found on trust centre	Yes - AoC at SAQ D for Service Providers, strongest here	Yes + published Audit Logging Policy	Not a blanket commitment; publishes an AI Transparency Center and Prompt Guardrails
Claude Code / Anthropic	Type II + SOC 3 + 2 bridge letters + CSA STAR L2	27001:2022 + SoA	Yes, 2025, Schellman/ANAB	Yes	Yes + HIPAA Type 1 reports	Yes, FedRAMP High, package published for Claude for Government; DoD IL4/IL5	Not found	Not found at product level	ZDR available on request; per-model Training Data Summaries published. US region only
Cursor	Type II; Grok Bot is Type I only	27001:2022	Yes, 42001:2023	Yes	Yes, Enterprise, via HIPAA Implementation Guide	Not found	Not found	Yes	Opt-in only - Privacy Mode must be enabled. Also: “Cursor does not use or maintain any infrastructure in China”
Augment Code	Type II attested	Not found	Yes	Not found - trust portal is login-walled	Yes, BAA Available	Not found	Not found	Not found	No-training with an indemnification clause; customer-managed encryption keys
Sourcegraph	Bare “SOC 2”, type not stated	27001:2022	Not found, but lists EU AI Act	Yes	Not found	Not found	Not found	Yes	Not found. Self-hosted claim: “Sourcegraph employees have no access to customer code”. Cloud logs retained up to 365 days
Veracode	Bare “SOC 2”, type not stated	Not found	Yes, 42001:2023	Yes	Not found	FedRAMP Moderate + GovRAMP + TX-RAMP L2 + NIST 800-53 Rev 5	Not found	Yes	Not found
Checkmarx	Type II, annual, on request	27001:2022 (page footer still says :2013 - stale)	Not found	GDPR claimed, no DPA doc	Not found	Badge on homepage, absent from Trust Center, no artifact	Not found	Internal only (AWS CloudTrail)	No - “Client data is deleted within 7 days of receiving a formal deletion request”
Corgea	Type II + pentest summary, emailed manually	Not found	Not found	Not found - no DPA at all	Not found	Not found	Not found	Internal only	Yes - signed ZDR agreements with OpenAI and Azure OpenAI. Stores diffs only, AES-256 at rest. RBAC yes
Bito	Type II	Not found	Not found	Not found	Not found	Not found	Not found	Not found	Yes, architectural - “we do not store any code, code snippets, indexes or embedding vectors”. Indexing local or in your VPC
Macroscope	Type II, 2025 and 2026 reports + bridge letter	Not found	Not found	Not found; SCCs referenced	Not found, yet lists PHI under data collected	Not found	Not found	Not found	Per-subprocessor, unusually specific. Notes one exception where data “may be retained for 30 days for security purposes”. US-only inference available for extra cost
Sourcery	Type II and Type I, both dated 2026-03-03	Not found	Not found	Yes	Not found	Not found	Not found	Not found	Yes - “Sourcery keeps no copy of your code after a review and never trains AI on it”. Core analysis runs locally
Tabnine	Bare “SOC 2”, type not stated	ISO/IEC 27001 + ISO 9001:2015	Not found	GDPR badge, no DPA doc	Not found	Not found	Not found	Yes	Not found as a commitment
Panto	No - “SOC 2 Audit Underway”	27001:2022 claimed, no certificate published	Not found	GDPR claimed, no DPA doc	Not found	Not found	Not found	Yes, customer-visible - “who viewed which test report and when”	Claimed, but retention is configurable not zero. Enterprise SSO via SAML/OIDC
cubic.dev	Type I only, explicitly	Not found	Not found	Not found	Not found	Not found	Not found	Internal controls only	Not found. Zero documents published
Kodus	”SOC 2 Type 2” badge with 0 documents	Not found	Not found	Not found	Not found	Not found	Not found	Not found	Partial, and candid: “Nothing is retained for training by Kodus”, but review results are stored, and model-layer retention is explicitly pushed to your own provider contract. BYOK by default

Five things that table tells you that no vendor page will

1. The AI-specific standard is nearly absent, and the holders are not who you would guess. Seven of 26. The platform vendors (GitLab, GitHub, Anthropic, Cursor) and two security vendors (Aikido, Veracode) plus Augment. Not one of the dedicated AI PR-review startups holds it - not CodeRabbit, not Qodo, not Greptile, not cubic, not Macroscope. If AI governance is on your risk register, and under the EU AI Act it increasingly is, this is the question that separates the field.

2. “SOC 2 compliant” tells you almost nothing about what you can actually obtain. Every report in this market is gated, and the spread in effort is enormous. GitHub lets an organisation owner download it from Enterprise Account settings. Greptile and Codacy want an email. Sonar sends a clickwrap NDA. Corgea reviews your request by hand and emails from [email protected]. Kodus shows a SOC 2 Type 2 badge with zero documents behind it, and cubic.dev publishes none either. Build “can I get the report in five business days” into procurement scoring, because that is the control you exercise at every renewal.

3. Zero data retention is usually a model-provider commitment, not a vendor commitment, and the distinction is load-bearing. CodeRabbit, Greptile and Corgea publish signed ZDR amendments with OpenAI, Anthropic, Azure OpenAI and Baseten. That is the strongest evidence form in this market and deserves credit. But look at what each vendor itself retains: Greptile caches code until repository access is revoked, Corgea stores diffs, CodeRabbit retains cached data when review caching is enabled, Kodus stores review results, Cursor’s Privacy Mode is opt-in rather than default, and Codacy and Checkmarx are clear non-ZDR cases (“We retain your usage data after your trial”; “deleted within 7 days of receiving a formal deletion request”). A signed amendment with OpenAI does not describe what sits on the vendor’s own disks.

4. FedRAMP is where claims get softest. Exactly one vendor publishes an actual authorization package: Anthropic, FedRAMP High for Claude for Government, plus DoD IL4 and IL5. Veracode lists FedRAMP Moderate as a badge alongside GovRAMP and TX-RAMP Level 2. After that it degrades: Snyk’s trust centre carries a “FedRAMP Rev. 5” badge while its own “What certifications does Snyk hold?” FAQ omits FedRAMP entirely. Aikido claims “FedRAMP Certified: Class C (Moderate)”, which is not standard FedRAMP terminology, and publishes only TX-RAMP Level 2. Checkmarx has a FedRAMP badge on its homepage that does not appear in its Trust Center. Treat Snyk, Aikido and Checkmarx as unverified and check the FedRAMP Marketplace, which is the only authoritative source.

5. The compliance controls are priced above the review features. CodeRabbit gates custom RBAC, SSO and audit logs to Enterprise, and self-hosting to 500+ seats. So a regulated team cannot buy audit logs at the Essentials price of $24 per developer per month. Snyk states SSO is available “if the customer’s plan includes it”. Codacy offers SSO “for our enterprise customers”. Panto scopes SSO to Enterprise. The moment an auditor asks for an access log, you are in an Enterprise conversation. That is the single most under-reported cost of compliant AI review.

A note on our own position: Gitar is a paying sponsor of this site, and it appears in this analysis only because the evidence put it there. Following Sonar’s acquisition of Gitar on 2026-05-21, a 2026-09-07 update to Sonar’s trust centre folded in a “Gitar Platform SOC 2 Type 2 Report” and a signed “Gitar Certificate IAS ISO 27001-22”. That is a genuine, dated, verifiable improvement in Gitar’s compliance posture and we would report it for any vendor. For balance, the thing we always say about Gitar applies here too: it has no published third-party review-quality benchmark.

One structural note before the frameworks: the certification question and the deployment question are halves of the same security review. If your constraint turns out to be data residency rather than vendor attestation, no certificate solves it, and you need self-hosted AI code review tools instead. Most teams end up reading both.

Which code review tools help meet SOC 2 change management requirements?

Direct answer: No tool “meets” CC8.1; your process does, and the tool produces the evidence. What matters is exportable approval records, branch protection showing a non-author approved, per-change scan results, and twelve-month retention. GitHub and GitLab native controls carry most of it. Sonar, GitLab, CodeAnt, Semgrep and GitHub Enterprise add the logging. Verified 2026-10-18.

Be suspicious of any vendor claiming its product makes you SOC 2 compliant. The control is yours. The tool’s job is to leave a trail your auditor will sample.

Control need	What satisfies it	Which tools help
Changes authorised before build	Ticket required, linked to the PR	Your tracker plus branch policy. Not an AI reviewer’s job
Approval by someone other than the author	Branch protection requiring non-author approval from a code owner	GitHub and GitLab native. An AI reviewer cannot be this approver in practice
Tested before production	CI gating on passing tests, blocking merge on failure	GitHub Actions, GitLab CI, any CI
Per-change scanning attached to the change	SAST and secrets scanning on every PR, findings recorded against that PR	Semgrep, Snyk Code, SonarQube, DeepSource, Aikido, CodeAnt
Tamper-evident record of access and configuration changes	Audit logs, exportable to a SIEM	GitLab, GitHub Enterprise, Sonar, CodeAnt (CSV or SIEM export), Semgrep, Cursor, CodeRabbit Enterprise only
Retention across the observation period	Twelve months minimum for a Type II	Your VCS plus your SIEM. Not the reviewer

On whether an AI agent can be the approver, the textual argument is better than you would expect and it still loses. CC8.1 requires that “a process is in place to approve system changes prior to implementation.” It names no approver and does not say the approver is human. Segregation of duties is not actually in CC8.1 at all - the relevant point of focus sits in CC5.1: “management segregates incompatible duties and, where such segregation is not practical, management selects and develops alternative control activities.” A full argument would also touch CC3.4 (assessing technology change risk) and CC9.2 (vendor assessment).

So why does it still lose? Three reasons, none of them the standard’s text.

1. Your own policy names a human. Auditors test you against your system description, not against their reading of the criteria. If your change-management policy says “peer approval required,” an agent approval is an exception.
2. Non-determinism breaks reproducibility. An LLM reviewer can flag an issue on one pass and miss it on the next. A control you cannot reproduce is a control you cannot evidence.
3. The evidence burden shifts onto you. To argue independence as a technical property rather than a headcount, you would need the reviewer configuration in version control and unreachable by PR authors, mechanical gates blocking merge on unresolved findings, a separate credential for deploy, complete logging of every finding and tool call for replay, and measurement data - precision, recall, back-testing against past incidents. That is a serious engineering programme undertaken to avoid one human click.

Our position: an AI reviewer supplements the independent human approver and does not replace it. It is excellent at making the human approval faster and better informed. Treat it as a detective control feeding the approval, not the approval itself. PCI DSS is even more explicit, which we get to below.

How do code reviews support SOC 2 compliance?

Direct answer: Code review is the primary evidence source for CC8.1 change management. Auditors sample production deployments across the observation period and trace each back to the originating pull request, checking for a non-author approval, a linked ticket, passing tests and the merge record. Git history is the artefact. Verified 2026-10-18.

The mechanics, because teams get this wrong by over-engineering it.

Your auditor picks a sample of production deployments from the observation period - typically twelve months for a Type II - and traces each one backwards. Deployment, to merge commit, to pull request, to reviewer approval, to the ticket that authorised the work. If any link is missing on a sampled change, that is an exception.

The minimum control set that passes:

• A formal change-management policy, reviewed annually
• Branch protection preventing direct pushes to the production branch
• Required review by at least one non-author
• CI gating on passing tests
• Documented environment separation

Two things that reduce work. Neither SOC 2 nor ISO 27001 names “code review” as a control; both expect secure development and change management to be enforced and verifiable, and pull requests are simply the cheapest way to evidence that. And a Change Advisory Board is not an audit requirement for a typical SaaS product, whatever your GRC vendor’s template implies. It can add value for complex cross-team infrastructure changes. It is not required.

Two things that cause findings. Emergency changes are permitted, but only through a documented fast-track process with retroactive approval and a post-implementation review; undocumented hotfixes are the most common exception we hear about. And infrastructure-as-code counts - Terraform and CloudFormation changes are in scope for CC8.1 exactly like application code.

Small teams. If you genuinely cannot separate author from approver, CC5.1 contemplates alternative control activities. Document why segregation is impractical and compensate with automated pipeline gates plus demonstrable testing before production. Do not pretend to a separation you do not have; auditors find that faster than they find the gap.

Code review software for HIPAA compliance

Direct answer: Ask one question first: will the vendor sign a BAA? Four of 26 will - Anthropic, Cursor, Augment Code and CodeAnt AI. No tool is “HIPAA certified” because that scheme does not exist. Anthropic is the most documented, and the catch is sharp: the HIPAA configuration that makes Claude Code eligible also disables Anthropic Code Review. Verified 2026-10-18.

The ranking here is driven almost entirely by one contractual question rather than by product quality, which is uncomfortable and true.

Anthropic is the most documented position in the market, and the detail is where it gets interesting. Anthropic’s BAA article states that for Claude Enterprise features to be covered, “the Primary Owner of the organization must activate HIPAA compliance in the HIPAA-ready Claude Enterprise organization settings under ‘Data and privacy’ and accept Anthropic’s BAA.” Claude Code in the terminal and in the Code tab of Claude Desktop is eligible under that configuration, and Claude Code with a Console API key is covered when ZDR for Claude Code is enabled. But “Claude Code cloud sessions, whether started from Claude Code on the web, Claude Desktop, or claude --cloud” are explicitly “Not covered under BAA.” Batch API, Files API, Code Execution and Computer Use are also excluded even for otherwise-eligible organisations.

Then the collision. Anthropic’s Code Review product is not available to organisations with Zero Data Retention, with the HIPAA configuration applied, or using customer-managed encryption keys. So the exact configuration that makes Claude Code usable for PHI is the configuration that turns Code Review off. Two Anthropic products, mutually exclusive compliance postures. Nobody else in this market has written that down, and it is the single most useful fact on this page for a healthcare engineering team.

What to do if you handle PHI:

1. Inventory first, including free tiers and card purchases. A developer’s personal Copilot Pro account reviewing a repo with PHI in a fixture is the exposure nobody models, and GitHub Copilot has no BAA pathway on Free, Pro or Team.
2. Request the BAA before the demo. If the vendor will not sign, stop. That eliminates 22 of the 26 vendors above.
3. Read the BAA for four things: the scope of permitted PHI uses; the breach notification window (HIPAA requires reporting without unreasonable delay and no later than 60 days after discovery, and vendors negotiate hard on both the window and the definition of “discovery”); data return or destruction at termination; and subcontractor flow-down. That last one is critical for AI review specifically, because these tools route data to third-party model providers and HIPAA requires the same restrictions to flow down by written agreement. A vendor with a signed ZDR amendment from its model provider is in a much better position to satisfy that clause.
4. Prove PHI is not in the repository. If you can evidence it, you may be outside business associate status entirely. That is the strongest available position. See AI code review security.

Can automated code review support PCI DSS audits?

Direct answer: Yes for Requirement 6.2.3, which requires bespoke and custom software to be reviewed before release and explicitly permits manual, automated, or combined processes. The limit is 6.2.3.1: if manual review is used, a non-author knowledgeable in secure coding must review it and management must approve before release. This was 6.3.2 in v3.2.1, so older guidance is renumbered. Verified 2026-10-18.

Requirement 6.2.3 requires that bespoke and custom software is reviewed prior to release into production or to customers to identify and correct potential coding vulnerabilities, such that reviews ensure code is developed according to secure coding guidelines, look for both existing and emerging vulnerabilities, and that appropriate corrections are implemented before release.

Four consequences that decide how you tool this:

• Automated review counts. The requirement permits manual processes, automated processes, or a combination. A SAST tool or an AI reviewer can carry 6.2.3.
• Per release, not per year. The most common scoping error we see. An annual pentest does not satisfy 6.2.3.
• A scanner alone is not the control. Reviewers must understand the tool’s limits and investigate findings rather than mechanically dismissing them. “The scanner was green” will not survive an assessor.
• Requirement 6.2.3.1 applies only if you do manual review, and then it requires review by individuals other than the originating author who are knowledgeable about code review techniques and secure coding practices, plus review and approval by management prior to release. This is the clearest statement in any major framework that the author cannot be the approver, and it is a stronger constraint than SOC 2’s.

Scoping definitions matter. Bespoke software is developed for you by a third party to your specification; custom software is developed by you for your own use. If a vendor builds either and it affects cardholder data security, you are responsible for ensuring they develop it to Requirement 6. Public-facing web applications pick up additional controls under Requirement 6.4. The requirement sits in a cluster with 6.2.1 documented development practices, 6.2.2 secure coding training and 6.2.4 engineering techniques against common attacks.

Tooling. For PCI, deterministic SAST carries more weight than LLM commentary because the findings reproduce. Semgrep, Snyk Code, SonarQube and the enterprise tools - Veracode, Checkmarx, Coverity - produce evidence an assessor recognises. Layer AI review on top for what patterns miss. See shift-left security and best code audit tools.

And distinguish two different PCI claims. Most tools market PCI DSS as something they help you achieve, which is useful and is not the same as the vendor holding an attestation. On their own property, only two vendors publish an actual Attestation of Compliance: GitLab at SAQ D for Service Providers, with a responsibility matrix and pentest attestation, and GitHub with a 2026 PCI DSS AoC plus a v4.0.1 Shared Responsibility Matrix. Snyk publishes a SAQ A certificate. Sonar publishes a SAQ-A self-assessment questionnaire, which is a questionnaire and not an AoC. Codacy explicitly disclaims PCI scope because Stripe handles its payments. Those are five materially different claims and they are routinely flattened into one tick-box.

Code review tools with GDPR-compliant data handling

Direct answer: Your code review vendor is a processor under GDPR Article 28, so you need a signed DPA naming subprocessors, Article 32 security measures, and a lawful transfer mechanism for data leaving the EEA. Thirteen of 26 publish or link an actual DPA. Five list a GDPR badge with no DPA document we could find. Anthropic is US-region only. Verified 2026-10-18.

Vendors with an actual DPA document published or linked on their own property: CodeRabbit, Greptile, CodeAnt AI, Snyk, Semgrep, Sonar, Aikido, Anthropic, GitLab, Cursor, Sourcegraph, Veracode and Sourcery.

Vendors showing a GDPR badge or claim with no DPA document we could locate: Qodo, DeepSource, Codacy, Tabnine, Macroscope, Checkmarx, Panto. Corgea publishes no DPA at all - its document list is Terms of Service, Privacy Policy and security documentation only.

What to check, in order:

1. A signed DPA, not a privacy policy. Semgrep goes furthest here, publishing its own DPA, an OpenAI DPA and a Data Transfer Impact Assessment. GitLab adds Data Privacy Framework certification. Those are the two strongest GDPR postures in this market.
2. The subprocessor list, and whether you get notice of changes. This is the live risk for AI review tools because the model provider is a subprocessor. CodeRabbit’s August 2026 subprocessor update added Wiz, Suger and Clerk. Greptile’s subprocessor notices reference your right to object “under your DPA” and reference standard contractual clauses. Kodus publishes 19 subprocessors. Macroscope discloses that Slack occasionally contains customer information, which is unusually honest and exactly the kind of thing you want disclosed.
3. Residency, stated concretely. Anthropic supports only the US region; EU data residency is not available. Snyk states regional residency. Macroscope offers US-only data and inference “for an extra cost”, which tells you the default is not US-only. For most others we could not confirm a residency option from vendor documentation.
4. Retention, in days. The spread is wide and real. CodeRabbit describes reviews in isolated environments disposed of after comments post, with repositories cloned in memory and discarded - except when review caching is enabled. Greptile states code remains cached until repository access is revoked. Codacy retains usage data after your trial. Checkmarx deletes within 7 days of a formal request. Sourcery and Bito keep no copy. Those are five different answers to one question, and only some survive a data-minimisation challenge under Article 5.
5. Your audit rights and their limits. CodeRabbit’s DPA allows written confirmation of compliance including audit report summaries, but no more than once per rolling twelve-month period. A normal clause, and one you want to have read before an incident rather than after.

The trap nobody mentions. GDPR exposure from a code review tool usually comes from personal data sitting in the repository, not from the review. Seed data with real names. A support ticket export committed as a fixture. Logs with email addresses. The reviewer reads all of it and your lawful basis for that processing is unclear at best. Scan the repository, not just the vendor.

AI code review tools with audit logs

Direct answer: Six vendors document audit logging as a product control on their own trust centre: Qodo, Semgrep, Tabnine, GitLab, Cursor and Sourcegraph. CodeAnt AI and Panto AI are the most specific about customer-facing logs. Four describe internal-only logging that does not help you at audit. CodeRabbit gates audit logs to Enterprise. Verified 2026-10-18.

Vendor	Audit logs	Customer-facing?	Export
CodeAnt AI	”Log every scan, access, and change”	Yes	CSV or SIEM, stated
Panto	”Customers can view their own audit logs, including who viewed which test report and when”	Yes, most explicit in market	Dashboard; export not stated
GitLab	Audit Logging control plus a published Audit Logging Policy and access-restriction guidance	Yes	Yes
Semgrep	”every scan execution, security finding, remediation action, and status change with timestamps and user attribution”	Yes	Not stated
Cursor	”Audit Logs and Monitoring” resource; compliance logging linked from the security page	Yes	Not stated
Sourcegraph	Audit Logging control under Product Security	Yes	Not stated
Tabnine	Audit Logging control under Product Security	Yes	Not stated
Qodo	Audit Logging control under Product Security	Yes	Not stated
Veracode	Audit Logging control plus a Security Logging and Monitoring Policy	Yes	Not stated
GitHub Copilot	Audit events including suggestion acceptance and rejection, in product docs	Yes, Enterprise	SIEM streaming
SonarQube Cloud	Administrative actions, permission changes, configuration changes; described as tamper-evident	Yes	SIEM export
CodeRabbit	All platform actions and administrative changes	Yes, Enterprise tier only	Their own blog raises SIEM export as a question buyers should ask
Codacy	”logs to provide an audit trail of our applications activity”	Internal only	n/a
Corgea	”access logs are continuously audited”	Internal only	n/a
Checkmarx	AWS CloudTrail across AWS environment and web applications	Internal only	n/a
cubic.dev	”Audit log management process maintained”, “Audit logs collected”	Internal controls only	n/a
Greptile, DeepSource, Snyk, Aikido, Macroscope, Sourcery, Bito, Augment Code, Kodus	Not found on the vendor’s own property as of 2026-10-18	-	-

Two asks that separate a real audit log from a feature-matrix tick.

Ask for a sample export - JSON or CSV covering a month, with actor, action, target, timestamp and source IP. If the vendor can only show you a UI, your auditor will be reading screenshots and you will be taking them.

Ask whether the log records review-level events, not just admin events. Who requested a review, which findings were raised, which were dismissed and by whom. That is the data that evidences the control operating. Admin-only logging evidences only that the tool exists. Semgrep’s description and CodeAnt’s are the two that explicitly cover findings and status changes; most of the rest describe administrative events.

And note the self-hosting trap from the other half of this analysis: SSO, RBAC and audit logs sit behind the commercial licence in several open-source self-hosted tools. Tabby puts SSO and LDAP in its separately licensed ee/ directory; Kodus uses the same dual-licence layout. A free self-hosted install can pass the data-residency test and fail the access-control test, which is the worst possible order to discover it in.

What security evidence should code reviews leave for an audit?

Direct answer: Six artefacts, all exportable: an approval record from a non-author with a timestamp, branch protection configuration proving separation of duties, traceability from ticket to commit to approval to deploy, per-change scan results attached to the change, retention across the full observation period, and documented emergency-change handling with retroactive approval. Verified 2026-10-18.

The full inventory an auditor asks for, roughly in order:

1. Change management policy, dated and reviewed annually.
2. Change tickets or pull requests with approvals, sampled across the period.
3. Approval by a non-author - the actual record, not a policy saying it is required.
4. Branch protection configuration showing direct pushes to the production branch are blocked and review is required.
5. Written test or QA sign-off, or CI results gating the merge.
6. Per-change scan results. Not a monthly dashboard. The findings for that change, attached to that change.
7. Deploy logs and rollback plans.
8. VCS and RBAC exports showing who can deploy.
9. Emergency change records with retroactive approval and post-implementation review.
10. Environment separation configuration.

This is where the 2026 compliance-as-code shift is genuinely useful rather than a slogan. The idea: check every pull request against SOC 2, HIPAA, PCI-DSS and OWASP rules inline, in the developer’s workflow, instead of reconciling a separate compliance dashboard after the fact. Policies live in version control alongside application code, violations surface at review time, and the audit trail accumulates as a by-product rather than as a quarterly fire drill.

Aikido automates policy checks across SOC 2, ISO 27001, CIS, NIS2, NIST 800-53, PCI, HIPAA, DORA, HITRUST and ENS. Panto and CodeAnt market custom policies written in plain English, with CodeAnt claiming 30,000+ deterministic checks alongside its AI checks and over 10,000 IaC policies per PR. Semgrep and Snyk Code occupy the same space from the SAST side and are the two with published control mappings - Semgrep documents mappings to ISO 27001 Annex A controls including A.8.8 for technical vulnerability management, A.8.25 to A.8.32 for the secure development lifecycle, and A.5.19 to A.5.23 for supplier relationships. Those vendor counts are self-reported and we did not verify them.

And here is the limitation to internalise before you buy the category. These tools detect code-level proxies for compliance - secrets, missing encryption, weak access-control patterns - not compliance itself. SOC 2 and HIPAA cover organisational controls: training, vendor management, incident response, risk assessment. No PR scanner evidences any of those. Treat “automated audit trail” as evidence support, not audit readiness. A tool telling you it makes you compliant is telling you something about its marketing, not about your control environment.

What your AI acceptable use policy needs to say

Auditors have started asking for this document, and the version that passes is short and specific. Four clauses do most of the work:

1. Approved tools, named, with the tier named. “CodeRabbit Enterprise,” not “CodeRabbit.” No consumer or free tiers of approved tools - the free tier usually has different retention terms, no DPA and no BAA pathway, which makes it a different vendor for compliance purposes even though it shares a logo.
2. No submitting code containing customer data, PHI, cardholder data or secrets to any AI tool, with the detection control named - secrets scanning, PII detection on fixtures - so the clause is enforceable rather than aspirational.
3. Mandated human review of AI-assisted commits. This is also the clause that keeps your CC8.1 story and your PCI 6.2.3.1 story intact.
4. A model and subprocessor change notice requirement. Your approved vendor can change which model provider reads your code without changing its own name. Kodus is unusually direct about this, telling customers that retention windows “are set by the provider, not by Kodus” and that a contractual guarantee has to come from your own provider contract. That is honest, and it is also the risk you are accepting with every bring-your-own-key tool.

A note on incident transparency, which nobody scores

If you are evaluating trust centres rather than just certificates, publishing incident history is a stronger signal than any badge. Three vendors do it: Snyk publishes the Klue and Salesforce third-party breach and the npm ChainDrop campaign; Semgrep publishes a detailed postmortem of a May 2026 Qilin ransomware incident, stating no customer code or findings were accessed; Veracode publishes 2025 outage notices. CodeRabbit has published its own account of a 2025 Rubocop-related incident, after which it rotated secrets, sandboxed the tool and hardened deploy gates. Most vendors publish nothing. A vendor that has never had an incident and a vendor that does not disclose them look identical from outside, and only one of those is a thing you can underwrite.

How we verified this

Checked on 2026-10-18. We read vendor trust centres, security pages, legal pages and product documentation. Most trust centres in this market are JavaScript-only single-page applications on Vanta, SafeBase, Drata, SecurityPal or Comp AI, so we rendered them in a headless browser rather than reading cached text. Where a portal was login-walled (Augment Code) or behind bot protection (Bito, on Drata), we have said so and fallen back to the vendor’s public security page.

“Request access” below means gated behind an access-request form, typically a clickwrap NDA, rather than a public download.

Trust centres read directly: trust.coderabbit.ai, trust.qodo.ai, trust.greptile.com, codeantai.trust.site, codacy.com/security, trust.deepsource.com, trust.snyk.io, trust.semgrep.dev, trust.sonarsource.com, trust.tabnine.com, trustcenter.aikido.dev, getpanto.ai/security, copilot.github.trust.page, trust.gitlab.com, trust.anthropic.com, trust.cursor.com, augmentcode.com/security, security.sourcegraph.com, trust.veracode.com, checkmarx.com/trust, corgea.com/trust-center, docs.bito.ai/privacy-and-security, trust.cubic.dev, trust.macroscope.com, app.mycroft.io/trust/sourcery, trust.kodus.io.

Primary documents and statements we quote:

• Anthropic’s certifications page lists exactly four credentials: HIPAA-ready configuration with BAA available, ISO 27001:2022, ISO/IEC 42001:2023, and SOC 2 Type I and Type II.
• Anthropic’s BAA article for the activation requirement and the explicit exclusion of Claude Code cloud sessions. Quoted verbatim.
• Anthropic’s Code Review docs for the exclusions on Zero Data Retention organisations, HIPAA-configured organisations and customer-managed encryption keys.
• Semgrep’s ISO 27001 compliance page: “Semgrep Inc. is not itself ISO 27001 certified, but the product can be used in deployment models that support an organization’s ISO 27001 certification efforts.” Quoted verbatim, and the only affirmative negative we found anywhere in this market.
• Semgrep’s SOC 2 page for the Type II period of 1 December 2023 to 30 November 2024 and the Include Security penetration test.
• docs.coderabbit.ai/self-hosted for the 500-seat self-hosting minimum, and CodeRabbit’s DPA for the once-per-twelve-months audit-request limit.
• Greptile’s security page: “Code remains cached on our machines until access is revoked in GitHub or GitLab, at which point it is deleted.” Quoted verbatim.
• Aikido’s ISO 42001 announcement and its trust centre resource index, which together produce the FedRAMP discrepancy we flag.
• Microsoft’s ISO 42001 offering page and the Service Trust Portal index for GitHub Copilot’s inclusion in scope.
• GitHub’s Copilot runner configuration docs for the firewall allowlist that proves review inference is not local, which matters for the residency question.

Framework sources: 45 CFR 160.103 and 45 CFR 164.308(b) for the business associate definition and the BAA requirement. The SOC 2 Trust Services Criteria for CC8.1, CC5.1, CC3.4 and CC9.2. PCI DSS v4.x Requirements 6.2.1 to 6.2.4 and 6.4, including the renumbering of v3.2.1’s 6.3.2 to 6.2.3. ISO/IEC 42001:2023, edition dated 18 December 2023. ISO 27001 Annex A control references as mapped in Semgrep’s own documentation. DO-178C and DO-330 for the aerospace FAQ, with FAA AC 20-115D and EASA AMC 20-115D on legacy tool qualification transition.

What we could not verify, stated plainly

• Any FedRAMP authorisation other than Anthropic’s. Snyk’s badge and its own FAQ contradict each other. Aikido’s “FedRAMP Certified: Class C (Moderate)” is not standard FedRAMP terminology and no package is published. Checkmarx’s homepage badge does not appear in its Trust Center. Treat Snyk, Aikido and Checkmarx as unverified and check the FedRAMP Marketplace, which is the only authoritative source.
• The SOC 2 type for Tabnine, Sourcegraph and Veracode. All three publish a bare “SOC 2” badge and document with no Type I or Type II designation anywhere on the portal. For a regulated buyer that distinction is the whole point, so ask.
• Whether Kodus’s SOC 2 Type 2 badge is backed by a report. Its trust centre shows the badge and zero documents. cubic.dev publishes no documents either.
• ISO 27001 for Veracode and Augment Code. Neither trust centre lists it, which is surprising given both hold ISO 42001.
• Whether GitHub Copilot’s ISO 27001 has been updated to the 2022 revision. The Copilot trust centre still lists ISO 27001:2013, the superseded version. Checkmarx has the inverse problem: its trust page states 27001:2022 while the page footer still says 27001:2013.
• Most SOC 2 report scopes. Sonar’s explicitly names AI CodeFix and Advanced Security; Semgrep’s names Code, Supply Chain and Secrets; GitHub’s names Enterprise Cloud and Copilot. For the rest, scope is unreadable without executing an NDA first, which is itself the finding. You cannot verify scope from outside.
• Audit log availability for Greptile, DeepSource, Snyk, Aikido, Macroscope, Sourcery, Bito, Augment Code and Kodus. Not found on their own property.
• Panto AI’s ISO 27001:2022 certificate. The claim is on the security page; no certificate is published and trust.pantoai.com does not resolve.
• Sourcery’s framework status. Its trust centre header says it lists frameworks it “currently meets or is working toward” without distinguishing which is which. Both a Type I and a Type II report are listed, both dated 2026-03-03.
• DO-330 tool qualification for any AI code review tool. No evidence any has been qualified.
• PCI DSS attestations held by vendors themselves, beyond GitLab’s AoC at SAQ D, GitHub’s AoC, Snyk’s SAQ A certificate and Sonar’s SAQ-A questionnaire.

On conflicting sources, of which there were many

Several third-party vendor-risk aggregators list Semgrep as compliant with SOC 2, PCI, HIPAA, GDPR, ISO 27001, FedRAMP and CSA STAR Level 1. Semgrep’s own documentation says it is not ISO 27001 certified, and its trust portal lists only GDPR and SOC 2. Those scraped profiles are simply wrong. We report Semgrep’s own statement.

That is the single clearest illustration of why this page exists, and it generalises: aggregator profiles are built by scraping marketing pages, marketing pages are written to pass a skim, and the certificate is the only artefact with a scope statement on it.

Recommendations

Criteria: can we verify the certification at the vendor’s own source, is the report obtainable in practice, does the certified scope include the AI feature, and are the audit controls purchasable at a sane tier.

If you need the widest verifiable certification coverage: GitLab or Anthropic. GitLab holds SOC 2 Type 2 for both GitLab.com and GitLab Dedicated, ISO 27001:2022 plus 27017 and 27018, ISO/IEC 42001 since 2025-09-04, a published DPA with Data Privacy Framework certification, a PCI DSS Attestation of Compliance at SAQ D for Service Providers, TISAX and a published Audit Logging Policy. That is the broadest set in this market by a clear margin. Anthropic is the only vendor publishing an actual FedRAMP High authorization package, alongside DoD IL4 and IL5, HIPAA Type 1 reports and ISO 42001.

If AI governance is on your risk register: the seven ISO 42001 holders, and read each scope statement. Anthropic, GitLab, GitHub Copilot, Cursor, Augment Code, Aikido, Veracode. Under the EU AI Act this question gets more load-bearing every quarter, and no dedicated AI PR-review startup holds it yet.

If your procurement gate is “show me the report”: GitHub. Organisation owners self-serve the SOC 2 Type II from Enterprise Account settings under Compliance. Nobody else makes it that easy, and ease of obtaining evidence is a control you exercise at every renewal, not once at purchase.

If you handle PHI: your options are Anthropic, Cursor, Augment Code or CodeAnt AI. Four of twenty-six. Note Anthropic’s internal collision - the HIPAA configuration disables Code Review. GitHub Copilot is out. And the strongest position remains evidencing that PHI is not in the repository at all.

If you need evidence an assessor recognises for PCI DSS 6.2.3: deterministic SAST first. Semgrep, Snyk Code, SonarQube, or Veracode, Checkmarx and Coverity at the enterprise end. Reproducible findings attached to the change. Then layer AI review on top for what patterns miss. Remember 6.2.3.1: if you do manual review, the author cannot be the approver and management must approve before release.

If zero data retention is a hard requirement, read past the badge. The strongest evidence is a signed ZDR amendment with the model provider, which CodeRabbit, Greptile and Corgea all publish. Then check what the vendor itself retains, because that is a separate question: Bito and Sourcery keep no copy, Aikido wipes after analysis, Greptile caches until access is revoked, Codacy and Checkmarx retain by default, and Cursor’s Privacy Mode is opt-in.

If you need audit logs with SIEM export: budget for Enterprise. GitHub, GitLab, Sonar Cloud and CodeAnt are the clearest. CodeRabbit has them on Enterprise only, which means the $24 Essentials seat is not the price of compliant AI review for a regulated team. Price the compliance tier, not the review tier.

Do not describe cubic.dev or Panto AI as SOC 2 Type II. cubic is explicitly Type I only; Panto’s audit is underway. Both may be excellent products. Neither claim survives a procurement review and you do not want to be the person who put it in the paperwork.

If your real constraint turns out to be data residency rather than certification, no certificate solves it. Go to self-hosted AI code review tools and work the deployment question instead. Also worth reading: AI code review for enterprise and the state of AI code review in 2026.

And finally, the only recommendation that really matters. Verify every cell in the table above against the vendor’s own trust centre and their signed BAA before you sign anything. Not against a comparison table. Including ours. We rendered 26 trust centres, dated every claim, quoted the load-bearing sentences verbatim and marked what we could not confirm - and we are still a web page, not a certificate. Request the document, read the scope section, and put the date you checked it in your vendor file. If this page saves you two weeks of diligence, it has done its job. If you cite it instead of the certificate, it has not.