Codebahn
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Hackerman AB (org.nr 559079-1918), Gothenburg, Sweden
Swedish-run (Hackerman AB) managed Forgejo forge with EU-only CI: flat-rate, bootstrapped, all-EU sub-processors, public DPA.
Codebahn is an EU-owned service hosted in France, with no identified CLOUD Act exposure. It is listed under Git hosting.
Assessment notes
Codebahn is a managed, commercially supported Forgejo forge operated by Hackerman AB (Gothenburg, Sweden), positioned as an independent European GitHub alternative for teams. It hits every 5/5 criterion: EU-owned Swedish operator, EU-only infrastructure (Scaleway fr-par in Paris for compute and storage, Hetzner Falkenstein in Germany for encrypted backups), a publicly accessible DPA at codebahn.net/dpa, a public sub-processors list where all four named sub-processors (Scaleway FR, Hetzner DE, Mollie NL, Crisp FR) are EU-incorporated, and no US legal entity anywhere in the data path: None. The product is built on the open-source Forgejo engine with one-click open-format export, so there is no vendor lock-in. No third-party certification (ISO 27001 / SOC 2) is published yet, but the rubric does not require one for 5/5 given the fully transparent all-EU posture.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 0 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Codebahn
Codebahn is a managed, commercially supported Git hosting and CI platform operated by Hackerman AB (org.nr 559079-1918), a bootstrapped Swedish company based in Gothenburg. It markets itself as a focused, independent GitHub alternative for European teams: unlimited users on every plan, flat-rate pricing, and hosted CI runners included on every paid organisation tier. The service is built on the open-source Forgejo engine (GPL-3.0), and Codebahn provides one-click export in an open format so customers can leave without lock-in.
The infrastructure story is the differentiator. Primary compute, object storage, managed PostgreSQL, the container registry, transactional email and observability all run on Scaleway fr-par (Paris, France), with encrypted daily backups (via Restic) stored separately on Hetzner Falkenstein (Germany). Codebahn publishes a full sub-processors list naming exactly four vendors, all EU-incorporated: Scaleway (France), Hetzner (Germany), Mollie (Netherlands, payments) and Crisp (France, in-app support). There is no US entity in the data path, and the DPA is public at codebahn.net/dpa without a login. Feature coverage includes repositories, issues, pull requests with branch protection, webhooks, container registry, releases, a package registry, EU-based CI/CD, GitHub workflow compatibility, and migration import of up to 100 repositories with full history preserved.
Pricing runs from Personal at 9 EUR/month (5 GiB, bring-your-own CI runners) through Starter (39 EUR, 25 GiB, 3,000 CI minutes), Team (119 EUR, 200 GiB, 10,000 minutes) and Scale (249 EUR, 500 GiB, 25,000 minutes), with annual billing saving two months and a 30-day money-back guarantee. As a bootstrapped company with no investors, Codebahn positions its terms as stable with no acquisition risk. Best fit: European teams and businesses that want a paid, supported managed forge with a contractual DPA and a verifiably all-EU sub-processor chain, rather than a free community service.
Sub-processor map · 4
-
Crisp EUFrance
In-app support chat
-
Hetzner EUGermany
Encrypted backup storage (fsn1 / Falkenstein)
-
Mollie EUNetherlands
Payment processing
-
Scaleway EUFrance
Compute, object storage, managed PostgreSQL, container registry, transactional email, observability (primary, fr-par / Paris)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Crisp | France | In-app support chat | EU |
| Hetzner | Germany | Encrypted backup storage (fsn1 / Falkenstein) | EU |
| Mollie | Netherlands | Payment processing | EU |
| Scaleway | France | Compute, object storage, managed PostgreSQL, container registry, transactional email, observability (primary, fr-par / Paris) | EU |
Source: the vendor’s published sub-processor list, read 21 Jul 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Codebahn
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
France · €49/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · €19/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Codeberg
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
GitLab by Stackhero
France
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€49/mo |
Planio
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€19/mo |