Berlin-based hosted Redmine (Planio GmbH) with unlimited Git and SVN repositories, on the company's own German servers; account-gated Art. 28 DPA.
- FROM
- €19/mo
- CLOUD ACT
- NONE
US-incorporated code-hosting and collaboration platform owned by Microsoft (Redmond, US). Direct CLOUD Act exposure.
Codeberg (Germany, Berlin, non-profit, EU-hosted, free, CLOUD Act exposure: None) and Codebahn (Swedish operator, France-hosted, paid and supported with a public DPA, CLOUD Act exposure: None) are the strongest European alternatives to GitHub. Both run the open-source Forgejo engine, so the same platform can also be self-hosted on your own EU infrastructure. GitHub itself is owned by Microsoft (US) and carries direct CLOUD Act exposure; the European options here are EU-owned and EU-hosted, and each listing shows its verified exposure level.
DISCLOSURE Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.
Ordered by feature parity and migration friction, which is weighted higher than feature breadth.
Berlin-based hosted Redmine (Planio GmbH) with unlimited Git and SVN repositories, on the company's own German servers; account-gated Art. 28 DPA.
French-operated managed GitLab CE (Stackhero) on a dedicated EU-region VM; ISO 27001:2022, public DPA; hosting region is customer-selected.
Berlin non-profit (Codeberg e.V.) running the open-source Forgejo forge: free, EU-hosted, community-governed GitHub alternative.
All 4 alternatives, benchmarked against GitHub.
Berlin-based hosted Redmine (Planio GmbH) with unlimited Git and SVN repositories, on the company's own German servers; account-gated Art. 28 DPA.
French-operated managed GitLab CE (Stackhero) on a dedicated EU-region VM; ISO 27001:2022, public DPA; hosting region is customer-selected.
Berlin non-profit (Codeberg e.V.) running the open-source Forgejo forge: free, EU-hosted, community-governed GitHub alternative.
Swedish-run (Hackerman AB) managed Forgejo forge with EU-only CI: flat-rate, bootstrapped, all-EU sub-processors, public DPA.
| Product | Hosting | Sovereignty | Cert. | Pricing | Signals | Open |
|---|---|---|---|---|---|---|
|
GitHub
benchmark · US
|
— |
US-LINKED | SOC 2 no EU framework |
Freemium |
E2E
Public DPA
Sub-processors
Open source
|
|
|
Berlin-based hosted Redmine (Planio GmbH) with unlimited Git and SVN repositories, on the company's own German servers; account-gated Art. 28 DPA.
|
FALKENSTEIN · DE
Germany
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
— |
Freemium
€19 /mo
|
Public DPA
Sub-processors
Open source
|
→ |
|
French-operated managed GitLab CE (Stackhero) on a dedicated EU-region VM; ISO 27001:2022, public DPA; hosting region is customer-selected.
|
FR
France
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
ISO/IEC 27001
|
Paid
€49 /mo
|
Public DPA
Sub-processors
Open source
|
→ |
|
Berlin non-profit (Codeberg e.V.) running the open-source Forgejo forge: free, EU-hosted, community-governed GitHub alternative.
|
DE
Germany
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
— | Free |
Public DPA
Sub-processors
Open source
|
→ |
|
Swedish-run (Hackerman AB) managed Forgejo forge with EU-only CI: flat-rate, bootstrapped, all-EU sub-processors, public DPA.
|
PARIS · FR
France
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
— |
Paid
€9 /mo
|
Public DPA
Sub-processors
Open source
|
→ |
Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.
| Feature | Planio | GitLab by Stackhero | Codeberg | Codebahn |
|---|---|---|---|---|
| Self-hostable | No | Yes | Yes | Yes |
| CI/CD | No | Yes | Yes | Yes |
| Pull/merge requests | No | Yes | Yes | Yes |
| Issue tracking | Yes | Yes | Yes | Yes |
| Package registry | No | Yes | Yes | Yes |
| Container registry | No | Yes | Yes | Yes |
| Repo import/migration | Yes | Yes | Yes | Yes |
| Free tier | Yes | No | Yes | No |
Listed for transparency. Every product on this page is benchmarked against this baseline.
Listed for transparency. Every product on this page is benchmarked against this baseline.
US-incorporated code-hosting and collaboration platform owned by Microsoft (Redmond, US). Direct CLOUD Act exposure.
GitHub is the default home for source code for most of the software industry, but it remains a US product: GitHub, Inc. is a wholly owned subsidiary of Microsoft Corporation, runs largely on Microsoft-controlled infrastructure, and falls within the reach of the US CLOUD Act. For a repository, that reach covers not just the code but the issue history, CI logs, access tokens, and security advisories. This page maps the European alternatives against GitHub, checking who legally owns each service, where the data physically sits, and what compliance posture each one can evidence: the profile a European procurement team needs for a Schrems II transfer impact assessment.
The two European services here both build on Forgejo, the open-source forge governed by Codeberg e.V. in Germany, which means the underlying engine is auditable and self-hostable regardless of which you choose. Codeberg (Germany, Berlin, non-profit, EU-hosted, free, CLOUD Act exposure: None) is the community-governed option and the natural home for open-source projects. Codebahn (Swedish operator, France-hosted, paid and supported, CLOUD Act exposure: None) is the commercial managed option with a public DPA and a fully EU-incorporated sub-processor chain, aimed at teams that need contractual guarantees.
So what actually carries over from a GitHub account?
Not everything makes the trip, though:
Moving a repository off GitHub comes down to a handful of steps, whichever European forge you land on.
git push --mirror to the new remote also works.git remote set-url, and re-point any deployment webhooks, status checks, or bots to the new forge's API.Which European alternative fits depends on what you are replacing.
For every product we read the public DPA, sub-processors document, hosting region declaration, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.
Reviewed by the EU Vetted editorial team · Editorial guidelines
Last verified July 2026