Codeberg
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Codeberg e.V. (eingetragener Verein), Berlin, Germany
Berlin non-profit (Codeberg e.V.) running the open-source Forgejo forge: free, EU-hosted, community-governed GitHub alternative.
Codeberg is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Git hosting.
Assessment notes
Codeberg is the community-governed non-profit Git forge operated by Codeberg e.V., a registered association (eingetragener Verein) based in Berlin, Germany. It runs the open-source Forgejo engine (a hard fork of Gitea that Codeberg itself backs and develops), is funded by association membership and donations rather than venture capital, and deliberately keeps all infrastructure inside the EU to sit outside US DMCA and CLOUD Act reach. Signals: EU-owned (German e.V.), EU-hosted, no US legal entity, no US sub-processors, Forgejo engine open-source and self-hostable, no CLOUD Act exposure. Gap: as a free community service Codeberg does not offer a signed commercial DPA / AVV and publishes no formal sub-processors list, which is the single factor keeping this below 5/5 for procurement buyers who need a self-serve DPA.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 2 · 0 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Codeberg
Codeberg is a free, non-profit Git hosting service operated by Codeberg e.V., a registered association based in Berlin, Germany. Established in September 2018 and launched publicly as codeberg.org in January 2019, it exists specifically to give open-source projects a European home that is not subject to US corporate ownership or US legal pressure. As of late 2025 it hosts over 300,000 repositories and more than 200,000 registered accounts, sustained by 1,100+ paying association members rather than any venture capital.
The platform runs Forgejo, the open-source (GPL-3.0) forge software that Codeberg forked from Gitea in 2022 and now backs as its primary sponsor; Forgejo development itself happens on Codeberg's own infrastructure. Feature-wise it covers the full GitHub-style workflow: repositories, pull requests and code review, issue tracking, a package registry and container registry, webhooks, and hosted CI (Codeberg CI, based on Woodpecker), plus Codeberg Pages for static web hosting and one-click migration import from GitHub and GitLab.
For an EU-sovereignty audit Codeberg's posture is among the cleanest in the directory: German non-profit operator, EU-only infrastructure chosen deliberately to avoid US DMCA and CLOUD Act reach: None, no US legal entity, and no US sub-processors. Because Forgejo is open source, organisations can also self-host the identical engine on their own EU infrastructure as a zero-counterparty escape hatch. The one procurement caveat is that, as a free community service, Codeberg does not sign a commercial DPA and publishes no formal sub-processors list. Best fit: open-source maintainers, privacy-conscious developers, and public-sector or education teams that want a European, non-commercial forge and are comfortable with a donation-funded governance model.
Sub-processor map · 2
-
Hetzner Online GmbH EUGermany
Backups, redundancy, disaster recovery, DDoS protection, spare-resource efficiency
-
netcup GmbH EUGermany
Backups, redundancy, disaster recovery, DDoS protection, spare-resource efficiency
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Hetzner Online GmbH | Germany | Backups, redundancy, disaster recovery, DDoS protection, spare-resource efficiency | EU |
| netcup GmbH | Germany | Backups, redundancy, disaster recovery, DDoS protection, spare-resource efficiency | EU |
Source: the vendor’s published sub-processor list, read 21 Jul 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Codeberg
Integration & access
Compliance & governance
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicecodeberg.org/Codeberg…
Alternatives in this category
-
Sweden · €9/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
France · €49/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · €19/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Codebahn
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€9/mo |
GitLab by Stackhero
France
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€49/mo |
Planio
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€19/mo |