GitLab by Stackhero
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Stackhero, France
French-operated managed GitLab CE (Stackhero) on a dedicated EU-region VM; ISO 27001:2022, public DPA; hosting region is customer-selected.
GitLab by Stackhero is a European service hosted in France, with at most minor, transient US exposure under the CLOUD Act. It is listed under Git hosting.
Assessment notes
GitLab by Stackhero is a managed GitLab Community Edition instance operated by Stackhero, a French company, on a dedicated, isolated VM with automatic daily backups. Signals: EU-owned French operator, its own ISO 27001:2022 certification (British Assessment Bureau, certificate #254338), and a publicly downloadable DPA (PDF). When a European region is chosen the repository content stays in the EU, but Stackhero's DPA (section 5.2) names two US-incorporated sub-processors, Stripe (payments) and Intercom (support), that process account and billing personal data, giving minor CLOUD Act exposure: Minor. That, together with the hosting region being customer-selected at service creation (a USA region is also offered) and the DPA not naming the underlying cloud host, holds the score at 4/5. This listing reflects the EU-region deployment.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 2 · 2 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About GitLab by Stackhero
GitLab by Stackhero is a managed GitLab Community Edition offering from Stackhero, a French company that provisions and maintains open-source software on dedicated cloud instances. Rather than sharing a multi-tenant platform, each customer gets a private, isolated VM running a full GitLab CE, with CI/CD pipelines, a container registry and package registry, one-click updates, and automatic daily backups retained for up to three months. Because the software is GitLab CE, teams get the complete GitLab workflow (merge requests, issues, CI/CD, registries) with Stackhero handling the infrastructure, security, and upgrades.
For an EU-sovereignty audit the operator profile is strong: Stackhero is a French company holding its own ISO 27001:2022 certification (British Assessment Bureau, certificate #254338), and it publishes a downloadable DPA without a login. When a European region is selected, the repository content stays in the EU, but Stackhero's DPA names two US-incorporated sub-processors, Stripe for payments and Intercom for support, that handle account and billing personal data, so the exposure is minor rather than none: Minor. Two further caveats keep this a 4/5 rather than a clean 5/5: hosting location is a customer choice made at service creation and Stackhero also offers a USA region, so European residency is opt-in rather than a contractual guarantee; and the DPA does not name the underlying cloud host, so the specific EU provider behind the European region cannot be confirmed. Buyers should select a European region explicitly and record that choice.
Pricing starts at €49 per month with unlimited users, repositories, and CI/CD time, billed per hour on a single monthly invoice. The underlying engine is GitLab CE (US-origin open source, with no phone-home for the Community Edition), so it is the operator and infrastructure, not the software vendor, that determine the sovereignty posture. Best fit: teams that specifically want GitLab's full feature set but need it run by an EU operator on a private EU-region instance, with a certificate and a public DPA they can hand to procurement.
Sub-processor map · 2
-
Intercom USUnited States
Customer support communication (first name, last name, email, company name)
-
Stripe USUnited States
Payment processing (credit card numbers)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Intercom | United States | Customer support communication (first name, last name, email, company name) | US |
| Stripe | United States | Payment processing (credit card numbers) | US |
Source: the vendor’s published sub-processor list, read 21 Jul 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of GitLab by Stackhero
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Sweden · €9/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €19/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Codebahn
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€9/mo |
Codeberg
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
Planio
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€19/mo |