Amazon Q Developer vs. Bolt.new: data protection per plan

yes (AWS Service Terms, section 1.14.1: 'These Service Terms incorporate the AWS Data Processing Addendum ("DPA"), when you use AWS Services to process Customer Data'; no exception for the Free Tier is stated there; section 50.13 additionally governs the use of Free Tier content for service improvement)

yes (according to the GDPR Center, the AWS GDPR DPA, including standard contractual clauses, is part of the AWS Service Terms and applies automatically)

not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)

not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)

not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)

not publicly documented (the privacy policy mentions data processing agreements/DPAs for customer data 'where applicable'; no publicly available template found)

FAQ and documentation 'Amazon Q Developer service improvement': in the Free Tier, content (questions, responses, generated code) may be used for service improvement, according to the documentation including 'for model training'. Service Terms 50.13: Amazon Q Content may be used to improve Amazon Q and, for that purpose, stored outside the AWS Region in use; content that does not contain personal data may also be used to train other AWS ML models. Opt-out depending on the environment: IDE/command line via the setting 'Share Amazon Q content with AWS' or 'Amazon Q: Share Content'; console/mobile app/AWS websites/chat applications via an AI services opt-out policy in AWS Organizations. Telemetry (without code) can be switched off separately. Pricing page: 'Opt-out available'.

FAQ: Amazon Q Developer Pro and Amazon Q Business do not use content for service improvement; content from the Pro Tier is not used to train underlying foundation models. Telemetry/usage metrics may be collected (opt-out in the IDE settings). Pricing page: 'Automatically opted out'.

Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active.

Privacy policy (as of 2026-09-22) section 5.C: Bolt may use inputs, outputs, interaction data and project files arising from Bolt AI features from 2026-10-07 onwards for training/fine-tuning its own models and may license de-identified datasets to third parties for remuneration, unless the user objects (opt-out free of charge, regardless of plan, in the account settings or by email; implemented within 15 days). Accounts in the EEA, the United Kingdom and Switzerland are exempt; accounts whose location cannot be determined are treated like EEA accounts. When 'Bolt Forge' is activated (Terms 3.6), the opt-out does not apply as long as Forge is active. Help Center 'Bolt Forge': when Forge is used, prompts, code, project files, configuration, tool calls and edit histories are stored in de-identified form and used by Bolt's partners to train open-source models (consent before first use of Forge); sessions from the EEA, UK and Switzerland are exempt; switching to another agent only stops future collection, data already collected is removed only on request to privacy@stackblitz.com.

Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.

Terms 3.5 and privacy policy 5.C: use for model training and dataset licensing does not apply to organisation-managed accounts (Teams and Enterprise workspaces), unless the administrator has activated it, nor to accounts with a separate written agreement. Accounts in the EEA/UK/CH are exempt in general.

Documentation 'Data storage in Amazon Q Developer': in the Free Tier, content is stored in a US Region (console error diagnosis: US West/Oregon, everything else: US East/N. Virginia). Cross-region inference may route requests to other Regions within the geography. Service Terms 50.13.1: content used for service improvement may be stored outside the Region in use. The sub-processor list names Canada, Germany, the Netherlands and the USA as locations of the AWS entities that process Free Tier content for service improvement (only without opt-out).

Documentation 'Amazon Q Developer Pro Region support': the Q Developer console and profile are available in US East (N. Virginia) and Europe (Frankfurt); Pro via a personal Builder ID only in US East (N. Virginia). Documentation 'Data storage': in the Pro Tier, content is stored in the profile Region only for the following features: Q chat in the AWS console, error diagnosis in the console, Q in Eclipse, JetBrains, VS Code and Visual Studio, and Q on the command line; for all other features 'your content may be stored and processed in a US Region' (can be blocked via a service control policy). Exceptions include: Amazon Q artifacts (visualisations) in a US Region; Console to Code stored in the console Region and processed in a US Region; CloudWatch investigations possibly in other Regions. Not available for profiles in Frankfurt: support chat, troubleshooting resources, .NET transformation in the IDE, Slack integration, Console Mobile App, GitLab Duo with Amazon Q, Amazon Q for GitHub. Cross-region inference stays within the geography (Europe: Frankfurt, Ireland, Paris, Stockholm).

Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.

Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.

Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented.

Trust Center: primary hosting at AWS in US-West-2 (Oregon), backup storage in AWS US-West-1. According to the security page, Bolt executes project code client-side in the browser (WebContainer). An EU region is not documented. For Enterprise, the pricing page mentions 'Data governance & retention policies'; location options are not described.

• Amazon Web Services EMEA SARL / Amazon Web Services, Inc. (contracting party, depending on the account country)
• AWS infrastructure entities per region (e.g. A100 ROW GmbH, region Europe/Frankfurt)
• Amazon Bedrock (LLM inference; cross-region inference within the geography)
• The sub-processor list (section 'AWS entities providing service improvement') names the locations Canada, Germany, the Netherlands, US for 'Amazon Q Developer Free Tier / Kiro Free Tier / Individual Subscriber'; applies provided the customer has not objected to use for service improvement

• Amazon Web Services EMEA SARL / Amazon Web Services, Inc. (contracting party, depending on the account country)
• AWS infrastructure entities per region (e.g. A100 ROW GmbH, region Europe/Frankfurt)
• Amazon Bedrock (LLM inference; cross-region inference within the geography)
• The sub-processor list (section 'AWS entities providing service improvement') names the locations Canada, Germany, the Netherlands, US for 'Amazon Q Developer Free Tier / Kiro Free Tier / Individual Subscriber'; applies provided the customer has not objected to use for service improvement

• AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
• Cloudfront (content delivery network)
• GitHub (code repository)
• Anthropic (code generation, LLM)
• Google Gemini (code generation, LLM)

• AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
• Cloudfront (content delivery network)
• GitHub (code repository)
• Anthropic (code generation, LLM)
• Google Gemini (code generation, LLM)

• AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
• Cloudfront (content delivery network)
• GitHub (code repository)
• Anthropic (code generation, LLM)
• Google Gemini (code generation, LLM)

• AWS (cloud and data hosting; according to the Trust Center region US-West-2, backups US-West-1)
• Cloudfront (content delivery network)
• GitHub (code repository)
• Anthropic (code generation, LLM)
• Google Gemini (code generation, LLM)

0 USD (pricing page)

19 USD per user per month (pricing page, no indication whether incl. VAT; according to AWS Tax Help, AWS Europe charges VAT on service charges for accounts in the EU)

0 USD (pricing page; net/gross not stated)

25 USD per month with monthly payment or 18 USD per month with annual payment (pricing page; net/gross not stated)

30 USD per month per member with monthly payment or 27 USD per month per member with annual payment (pricing page; net/gross not stated)

Individual (pricing page: 'Custom')

yes (50 agentic requests per month in IDE/CLI; Java upgrade transformation up to 1,000 lines of code per month; console Q&A)

yes (extended limits for agentic requests, according to the FAQ 10,000 inference calls per month or around 1,000 user requests; Java/.NET transformation up to 4,000 lines of code per user in the pool; admin dashboard, IP indemnity)

yes (AI app builder; 300,000 tokens per day, 1 million tokens per month)

yes (no daily limit, from 10M tokens per month, unused tokens roll over); according to the Help Center, Bolt Forge (agent using open-source models) was included at no extra cost during the research preview from 2026-09-14 to 2026-10-14, after which Pro no longer has Forge access

yes (features of Pro plus centralised billing, team management, admin controls)

yes (features of Pro plus SSO, audit logs, compliance support, data governance and retention policies)