A single roll-up of ownership and CLOUD Act exposure.
Stackhero, France
French-operated managed GitLab CE (Stackhero) on a dedicated EU-region VM; ISO 27001:2022, public DPA; hosting region is customer-selected.
GitLab by Stackhero, in the Git hosting category, is a European service with France as its hosting location and at most minor, transient US exposure under the CLOUD Act.
GitLab by Stackhero is a managed GitLab Community Edition instance operated by Stackhero, a French company, on a dedicated, isolated VM with automatic daily backups. Signals: EU-owned French operator, its own ISO 27001:2022 certification (British Assessment Bureau, certificate #254338), and a publicly downloadable DPA (PDF). When a European region is chosen the repository content stays in the EU, but Stackhero's DPA (section 5.2) names two US-incorporated sub-processors, Stripe (payments) and Intercom (support), that process account and billing personal data, giving minor CLOUD Act exposure: [[stackhero-gitlab.cloud_act]]. That, together with the hosting region being customer-selected at service creation (a USA region is also offered) and the DPA not naming the underlying cloud host, holds the score at 4/5. This listing reflects the EU-region deployment.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Where ultimate control over the operating company sits.
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
GitLab by Stackhero is a managed GitLab Community Edition offering from Stackhero, a French company that provisions and maintains open-source software on dedicated cloud instances. Rather than sharing a multi-tenant platform, each customer gets a private, isolated VM running a full GitLab CE, with CI/CD pipelines, a container registry and package registry, one-click updates, and automatic daily backups retained for up to three months. Because the software is GitLab CE, teams get the complete GitLab workflow (merge requests, issues, CI/CD, registries) with Stackhero handling the infrastructure, security, and upgrades.
For an EU-sovereignty audit the operator profile is strong: Stackhero is a French company holding its own ISO 27001:2022 certification (British Assessment Bureau, certificate #254338), and it publishes a downloadable DPA without a login. When a European region is selected, the repository content stays in the EU, but Stackhero's DPA names two US-incorporated sub-processors, Stripe for payments and Intercom for support, that handle account and billing personal data, so the exposure is minor rather than none: [[stackhero-gitlab.cloud_act]]. Two further caveats keep this a 4/5 rather than a clean 5/5: hosting location is a customer choice made at service creation and Stackhero also offers a USA region, so European residency is opt-in rather than a contractual guarantee; and the DPA does not name the underlying cloud host, so the specific EU provider behind the European region cannot be confirmed. Buyers should select a European region explicitly and record that choice.
Pricing starts at [[stackhero-gitlab.price_from]] per month with unlimited users, repositories, and CI/CD time, billed per hour on a single monthly invoice. The underlying engine is GitLab CE (US-origin open source, with no phone-home for the Community Edition), so it is the operator and infrastructure, not the software vendor, that determine the sovereignty posture. Best fit: teams that specifically want GitLab's full feature set but need it run by an EU operator on a private EU-region instance, with a certificate and a public DPA they can hand to procurement.
Customer support communication (first name, last name, email, company name)
Payment processing (credit card numbers)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Intercom | United States | Customer support communication (first name, last name, email, company name) | US |
| Stripe | United States | Payment processing (credit card numbers) | US |
Swedish-run (Hackerman AB) managed Forgejo forge with EU-only CI: flat-rate, bootstrapped, all-EU sub-processors, public DPA.
Berlin non-profit (Codeberg e.V.) running the open-source Forgejo forge: free, EU-hosted, community-governed GitHub alternative.
Berlin-based hosted Redmine (Planio GmbH) with unlimited Git and SVN repositories, on the company's own German servers; account-gated Art. 28 DPA.