Sourcegraph Cody

AI coding assistant with deep codebase search and enterprise security controls

Poolside

Enterprise AI coding platform with on-premise and VPC deployment for secure software development

Sourcegraph Cody

Strong

18/25

Poolside

Strong

17/25

Score Breakdown

DimensionSourcegraph CodyPoolside

Data Residency

Where is your data stored and processed?

Sourcegraph Cody: Cloud product uses US infrastructure. Self-hosted enterprise deployment allows organisations to choose their own data centre region, including EU. Score reflects the enterprise self-hosted path which achieves 5; cloud product scores 1.

Poolside: On-premise and VPC deployment with zero data egress. Customer code never leaves the customer's environment. EU organisations can deploy on their own EU infrastructure. Maximum data sovereignty.

3/5

Cloud product uses US infrastructure. Self-hosted enterprise deployment allows organisations to choose their own data centre region, including EU. Score reflects the enterprise self-hosted path which achieves 5; cloud product scores 1.

5/5

On-premise and VPC deployment with zero data egress. Customer code never leaves the customer's environment. EU organisations can deploy on their own EU infrastructure. Maximum data sovereignty.

Legal Jurisdiction

Which laws govern the company and your data?

Sourcegraph Cody: US incorporation, Delaware jurisdiction. SOC 2 and ISO 27001 available. Enterprise self-hosted with EU data centres removes US cloud dependency. Bring-your-own-LLM allows choice of EU-incorporated model provider.

Poolside: Delaware incorporation (US). French SAS entity exists but parent is US. CLOUD Act applies to the corporate entity, though on-premise deployment means code never reaches Poolside's infrastructure.

3/5

US incorporation, Delaware jurisdiction. SOC 2 and ISO 27001 available. Enterprise self-hosted with EU data centres removes US cloud dependency. Bring-your-own-LLM allows choice of EU-incorporated model provider.

2/5

Delaware incorporation (US). French SAS entity exists but parent is US. CLOUD Act applies to the corporate entity, though on-premise deployment means code never reaches Poolside's infrastructure.

Data Retention & Training

Is your data used for model training?

Sourcegraph Cody: Code and queries are not used for model training. Self-hosted deployment gives organisations full control over data retention. Enterprise DPA and audit logging available. Strong data governance posture.

Poolside: On-premise/VPC mode: customer has full control, no data leaves their environment. Training uses synthetic data (RLCEF), not customer-contributed code. Structural separation.

5/5

Code and queries are not used for model training. Self-hosted deployment gives organisations full control over data retention. Enterprise DPA and audit logging available. Strong data governance posture.

5/5

On-premise/VPC mode: customer has full control, no data leaves their environment. Training uses synthetic data (RLCEF), not customer-contributed code. Structural separation.

Certifications

ISO 27001, SOC 2, Cyber Essentials, etc.

Sourcegraph Cody: Holds both SOC 2 Type II and ISO 27001 certifications. Strong certification posture for an enterprise developer tooling company. Appropriate for regulated-industry procurement.

Poolside: Drata trust centre exists, suggesting SOC 2 is in progress. No public confirmation of SOC 2 or ISO 27001. US government ATO achieved (military/public sector).

4/5

Holds both SOC 2 Type II and ISO 27001 certifications. Strong certification posture for an enterprise developer tooling company. Appropriate for regulated-industry procurement.

2/5

Drata trust centre exists, suggesting SOC 2 is in progress. No public confirmation of SOC 2 or ISO 27001. US government ATO achieved (military/public sector).

Regulatory Fit

Suitability for regulated industries and professional services

Sourcegraph Cody: Self-hosted enterprise deployment with EU data centres and EU-region LLM provider is well-suited for EU regulated industries. Cloud product requires SCCs. ISO 27001 and SOC 2 meet common enterprise procurement thresholds.

Poolside: On-premise deployment model is excellent for regulated industries. US jurisdiction is the main concern. French entity provides some EU connection. Public sector certifications (ATO, IL5) demonstrate security maturity.

3/5

Self-hosted enterprise deployment with EU data centres and EU-region LLM provider is well-suited for EU regulated industries. Cloud product requires SCCs. ISO 27001 and SOC 2 meet common enterprise procurement thresholds.

3/5

On-premise deployment model is excellent for regulated industries. US jurisdiction is the main concern. French entity provides some EU connection. Public sector certifications (ATO, IL5) demonstrate security maturity.

Total Score

18/25

17/25

Best For

Sourcegraph Cody

Best for privacy-conscious teams who need strong data retention controls; organisations that need self-hosted or on-premise deployment.

Poolside

Best for privacy-conscious teams who need strong data retention controls; organisations that need self-hosted or on-premise deployment; teams on a tight budget.

Detailed Comparison

Poolside vs Sourcegraph Cody: Trust & Compliance Comparison

Poolside (Poolside, US) scores 17/25 overall with a Silver (Strong) trust badge. Enterprise AI coding platform with on-premise and VPC deployment for secure software development. Sourcegraph Cody (Sourcegraph, US) scores 18/25 with a Silver (Strong) trust badge. AI coding assistant with deep codebase search and enterprise security controls.

Dimension-by-Dimension Breakdown

#### Data Residency

Poolside leads with 5/5 vs 3/5.

●Poolside (5/5): On-premise and VPC deployment with zero data egress. Customer code never leaves the customer's environment. EU organisations can deploy on their own EU infrastructure. Maximum data sovereignty.

●Sourcegraph Cody (3/5): Cloud product uses US infrastructure. Self-hosted enterprise deployment allows organisations to choose their own data centre region, including EU. Score reflects the enterprise self-hosted path which achieves 5; cloud product scores 1.

#### Legal Jurisdiction

Sourcegraph Cody leads with 3/5 vs 2/5.

●Poolside (2/5): Delaware incorporation (US). French SAS entity exists but parent is US. CLOUD Act applies to the corporate entity, though on-premise deployment means code never reaches Poolside's infrastructure.

●Sourcegraph Cody (3/5): US incorporation, Delaware jurisdiction. SOC 2 and ISO 27001 available. Enterprise self-hosted with EU data centres removes US cloud dependency. Bring-your-own-LLM allows choice of EU-incorporated model provider.

#### Data Retention & Training

Both score equally at 5/5.

●Poolside (5/5): On-premise/VPC mode: customer has full control, no data leaves their environment. Training uses synthetic data (RLCEF), not customer-contributed code. Structural separation.

●Sourcegraph Cody (5/5): Code and queries are not used for model training. Self-hosted deployment gives organisations full control over data retention. Enterprise DPA and audit logging available. Strong data governance posture.

#### Certifications

Sourcegraph Cody leads with 4/5 vs 2/5.

●Poolside (2/5): Drata trust centre exists, suggesting SOC 2 is in progress. No public confirmation of SOC 2 or ISO 27001. US government ATO achieved (military/public sector).

●Sourcegraph Cody (4/5): Holds both SOC 2 Type II and ISO 27001 certifications. Strong certification posture for an enterprise developer tooling company. Appropriate for regulated-industry procurement.

#### Regulatory Fit

Both score equally at 3/5.

●Poolside (3/5): On-premise deployment model is excellent for regulated industries. US jurisdiction is the main concern. French entity provides some EU connection. Public sector certifications (ATO, IL5) demonstrate security maturity.

●Sourcegraph Cody (3/5): Self-hosted enterprise deployment with EU data centres and EU-region LLM provider is well-suited for EU regulated industries. Cloud product requires SCCs. ISO 27001 and SOC 2 meet common enterprise procurement thresholds.

Certifications at a Glance

Certification	Poolside	Sourcegraph Cody
ISO 27001	No	Yes
SOC 2 Type II	No	Yes

Overall Verdict

Poolside and Sourcegraph Cody are closely matched on trust and compliance, with scores of 17/25 and 18/25 respectively. The right choice depends on your specific regulatory requirements and existing technology stack.

Frequently Asked Questions

Which is better for EU compliance, Sourcegraph Cody or Poolside?

Sourcegraph Cody has a TrustKit score of 18/25 while Poolside scores 17/25. Sourcegraph Cody currently rates higher across data residency, legal jurisdiction, data retention, certifications, and regulatory fit.

How do Sourcegraph Cody and Poolside compare on data residency?

Sourcegraph Cody scores 3/5 for data residency (Cloud product uses US infrastructure. Self-hosted enterprise deployment allows organisations to choose their own data centre region, including EU. Score reflects the enterprise self-hosted path which achieves 5; cloud product scores 1.), while Poolside scores 5/5 (On-premise and VPC deployment with zero data egress. Customer code never leaves the customer's environment. EU organisations can deploy on their own EU infrastructure. Maximum data sovereignty.).

Are Sourcegraph Cody and Poolside GDPR compliant?

Both tools are assessed across five compliance dimensions. Sourcegraph Cody has a regulatory fit score of 3/5 and Poolside scores 3/5. Check the full comparison above for a detailed breakdown.

Explore Each Tool