SonarQube
Stay informed with code quality notifications in SlackSonarQube Cloud is a simple, scalable, and fast SaaS solution for high-quality code. It empowers teams to deliver integrated code quality and security by providing actionable code intelligence that drives better development.This integration for Slack seamlessly connects SonarQube Cloud's power directly to your team's workflows, transforming reactive fire drills into proactive quality control. It easily integrates with DevOps platforms to deliver continuous quality improvements without slowing your team down.Key benefits:• Prevent bad merges: This integration acts as a safety net for team leads, instantly notifying them in Slack when a project's Quality Gate fails. This crucial visibility allows them to act as soon as critical issues have been identified.• Reduce developer friction: Developers receive immediate feedback in the tool they use all day. No more hunting through UIs to find out why a check failed; a single click takes them directly from the Slack alert to the code issue.• Improve team collaboration: Real-time alerts on failures and recoveries keep everyone on the same page about code health, fostering a shared sense of ownership over quality.• Simple and powerful: A quick setup connects your organization, and simple slash commands are used to subscribe specific channels to project notifications.─────────Getting startedOnce the app has been installed, anyone with 'browse' access or higher to a project in Sonar can add Quality Gate notifications to their chosen channel.Navigate to your desired channel and run the following commands:
/invite @SonarQube/sonarqube connect/sonarqube subscribe [project_key]To unsubscribe, simply run:/sonarqube unsubscribe [project_key]You can find more information here.SonarQube will be able to view:
SonarQube will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Developer
SonarSource SA
Company headquarters location
Switzerland
Terms of service
Privacy & data governance
Data retention policy
We do not store any personal user data (PII). We retain only the minimum, non-sensitive information required to post notifications to your Slack channels:
- Channel IDs where you set up subscriptions.
- Workspace ID and the Slack access token needed to send messages.
- The mapping entry that links the user's Slack account to their SonarQube Cloud (SQC) account, and the associated SQC project IDs for subscriptions.
This data is kept only until the user removes a subscription via the unsubscribe command or until a full data deletion request is processed by our support team.
Data archiving and removal policy
All stored data is deleted when a user manually unsubscribes a notification via the relevant Slack command.
For full data deletion, including the removal of the Slack access token and the SQC account mapping, users must contact our support team directly. We are currently working on implementing automated deletion upon app uninstallation and a dedicated 'disconnect' command.
Data storage policy
The SonarQube integration is fully compliant with GDPR. We only store non-sensitive technical data required exclusively for the Slack application's features. We store the following:
- Slack Channel IDs for active notifications.
- Workspace ID and the Slack access token for posting messages.
- The Slack-to-SQC account mapping and associated SQC project IDs connected to your alerts.
Data hosting details
Details on hosting are available in our Data Processing Addendum: https://www.sonarsource.com/legal/data-processing-addendum/ and our Subprocessor List: https://www.sonarsource.com/legal/sub-processors/.
Data hosting company
AWS
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
no
Certifications & compliance
SOC attestation
ISO/IEC-27001 certification
GDPR commitment
Data deletion request procedure
When you run the connect command, we store an entry in our database linking your Slack account to your SonarQube Cloud account, along with your subscription records. Users can request data deletion in two ways:
1. Subscription Deletion: Running the command (e.g., /sonarqube unsubscribe {project_key}) deletes the specific subscription and its data.
2. Full Account Deletion: For complete removal of the Slack-to-SQC account mapping and all associated data, users must contact our support team via email at contact@sonarsource.com.
We are actively developing features to automate full data cleanup, including a 'disconnect' command and listening for app uninstallation events.
HIPAA compliant
no
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Date of latest pen test
2025-05-01
Executive summary is available to potential customers upon request
yes
Supports Single Sign On (SSO) with the following providers
SAML
Supports Security Assertion Markup Language (SAML)
yes
Has a dedicated security team
yes
Contact for security issues
security@sonarsource.com
Has a vulnerability disclosure program
yes
Vulnerability disclosure program URL
Vulnerability disclosure program covers Slack app
yes
Has a bug bounty program
no
Requires third party authorization/connections
yes
Uses token rotation
no